1filter: "evt.Parsed.program == 'exchange-pop'"
2onsuccess: next_stage
3#debug: true
4name: crowdsecurity/exchange-pop-logs
5description: "Parse exchange POP logs"
6#dateTime,sessionId,seqNumber,sIp,cIp,user,duration,rqsize,rpsize,command,parameters,context,puid
7#2022-06-20T00:03:48.531Z,0000000000001E86,1,192.168.9.241:995,192.168.9.212:33526,testuser,171,21,69,auth, PLAIN,"R=""-ERR Authentication failure: unknown user name or bad password."";Msg=""AuthFailed:LogonDenied,User: testuser"";ErrMsg=AuthFailed:LogonDenied",
8grok:
9  pattern: "%{TIMESTAMP_ISO8601:date},%{DATA:session_id},%{INT:sequence_number},%{IPORHOST:server_ip}:%{INT:server_port},%{IPORHOST:client_ip}:%{INT:client_port},%{DATA:username},%{INT:duration},%{INT:rqsize},%{INT:rpsize},%{WORD:command},%{DATA:parameters},%{DATA}AuthFailed:LogonDenied\",%{DATA:puid}?"
10  apply_on: message
11statics:
12  - target: evt.StrTime
13    expression: evt.Parsed.date
14  - meta: source_ip
15    expression: evt.Parsed.client_ip
16  - meta: service
17    value: exchange
18  - meta: log_type
19    value: pop
20  - meta: sub_type
21    value: auth_fail