iptables-logs Log Parser by crowdsecurity

Name: iptables-logs
Author: crowdsecurity

A parser for iptables -j LOG logs :

Only parse kernel messages containing IN=
Skip lines if decisions is ACCEPT
All parsed TCP and UDP packets are considered as DROPs.
ICMP packets are parsed and sets the following meta attributes: (Note we do not have scenarios around ICMP as they are FPs prone)
- icmp_type
- icmp_code
If you wish to code your own scenarios around ICMP, you can use the following link as a reference. Please note you are solely responsible for the scenarios you write.

To make this parser relevant, you should have a iptables -A INPUT -m state --state NEW -j LOG or similar into your configuration. This one will log all new connections, successful or not.

1onsuccess: next_stage

2#debug: true

3filter: "evt.Parsed.program == 'kernel' and evt.Parsed.message contains 'IN=' and not (evt.Parsed.message contains 'ACCEPT') and not (evt.Parsed.message contains '[UFW AUDIT]' )"

4name: crowdsecurity/iptables-logs

5description: "Parse iptables drop logs"

6statics:

7 - parsed: unused #this is never used setting to random var

8 expression: ParseKV(evt.Parsed.message, evt.Unmarshaled, "iptables")

9 - meta: service

10 expression: Lower(evt.Unmarshaled.iptables.PROTO)

11 - meta: log_type

12 expression: |

13 evt.Meta.log_type != "" ? evt.Meta.log_type : evt.Meta.service in ["tcp", "udp"] && evt.Unmarshaled.iptables.OUT == "" ? "iptables_drop" : ""

14 - meta: icmp_type

15 expression: evt.Unmarshaled.iptables.TYPE

16 - meta: icmp_code

17 expression: evt.Unmarshaled.iptables.CODE

18 - meta: source_ip

19 expression: "evt.Unmarshaled.iptables.SRC"

20## For backporting reason all previous variables will be reparsed out to the parsed object

21 - parsed: dst_port

22 expression: evt.Unmarshaled.iptables.DPT

23 - parsed: int_eth

24 expression: evt.Unmarshaled.iptables.IN

25 - parsed: src_ip

26 expression: evt.Unmarshaled.iptables.SRC

27 - parsed: dst_ip

28 expression: evt.Unmarshaled.iptables.DST

29 - parsed: length

30 expression: evt.Unmarshaled.iptables.LEN

31 - parsed: proto

32 expression: evt.Unmarshaled.iptables.PROTO

33 - parsed: src_port

34 expression: evt.Unmarshaled.iptables.SPT

Hub configuration

« iptables-logs »
v0.7 by crowdsecurity
Attack scenario

Hub configuration

« iptables-logs »v0.7 by crowdsecurityAttack scenario

« iptables-logs »
v0.7 by crowdsecurity
Attack scenario