cscli parsers install crowdsecurity/home-assistant-logsHome assistant authentication failure parser.
Supports homeassistant docker image and HassOS logs.
1onsuccess: next_stage2name: crowdsecurity/home-assistant-logs3description: "Parse Home Assistant logs"4filter: "evt.Parsed.program in ['home-assistant', 'hass'] or evt.Parsed.program endsWith 'homeassistant'"5pattern_syntax:6 TIMESTAMP: '%{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{HOUR}:%{MINUTE}:%{SECOND}'7nodes:8 - grok:9 pattern: "%{TIMESTAMP:time} WARNING \\(%{DATA:threadName}\\) \\[homeassistant.components.http.ban\\] Login attempt or request with invalid authentication from %{DATA:source_rdns} \\(%{IPORHOST:source_ip}\\). \\(%{GREEDYDATA:http_user_agent}\\)"10 apply_on: message11 statics:12 - meta: log_type13 value: home-assistant_failed_auth14 - grok:15 pattern: "%{TIMESTAMP:time} WARNING \\(%{DATA:threadName}\\) \\[homeassistant.components.http.ban\\] Login attempt or request with invalid authentication from %{DATA:source_rdns} \\(%{IPORHOST:source_ip}\\). Requested URL: '%{GREEDYDATA:url}'. \\(%{GREEDYDATA:http_user_agent}\\)"16 apply_on: message17 statics:18 - meta: log_type19 value: home-assistant_failed_auth20statics:21 - target: StrTime22 expression: "evt.Parsed.time"23 - meta: service24 value: http25 - meta: source_ip26 expression: "evt.Parsed.source_ip"27 - meta: source_rdns28 expression: "evt.Parsed.source_rdns"29