iptables-logs Log Parser by crowdsecurity | CrowdSec Hub

iptables-logs

Log parser

By: crowdsecurity
Version: 0.7

Parse iptables drop logs

Install with a top-level collection

1 collection include it

sudo cscli collections install crowdsecurity/unifi

Installs 5 parsers and 2 scenarios, via Iptables - Portscan Detection.

View UniFi →

Installation

sudo cscli parsers install crowdsecurity/iptables-logs

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

parsers/s01-parse/crowdsecurity/iptables-logs.yaml· 34 linesGitHub

1onsuccess: next_stage1
2#debug: true
3filter: "evt.Parsed.program == 'kernel' and evt.Parsed.message contains 'IN=' and not (evt.Parsed.message contains 'ACCEPT') and not (evt.Parsed.message contains '[UFW AUDIT]' )"2
4name: crowdsecurity/iptables-logs
5description: "Parse iptables drop logs"
6statics:3
7  - parsed: unused #this is never used setting to random var
8    expression: ParseKV(evt.Parsed.message, evt.Unmarshaled, "iptables")
9  - meta: service
10    expression: Lower(evt.Unmarshaled.iptables.PROTO)
11  - meta: log_type
12    expression: |
13        evt.Meta.log_type != "" ? evt.Meta.log_type : evt.Meta.service in ["tcp", "udp"] && evt.Unmarshaled.iptables.OUT == "" ? "iptables_drop" : ""
14  - meta: icmp_type
15    expression: evt.Unmarshaled.iptables.TYPE
16  - meta: icmp_code
17    expression: evt.Unmarshaled.iptables.CODE
18  - meta: source_ip
19    expression: "evt.Unmarshaled.iptables.SRC"
20## For backporting reason all previous variables will be reparsed out to the parsed object
21  - parsed: dst_port
22    expression: evt.Unmarshaled.iptables.DPT
23  - parsed: int_eth
24    expression: evt.Unmarshaled.iptables.IN
25  - parsed: src_ip
26    expression: evt.Unmarshaled.iptables.SRC
27  - parsed: dst_ip
28    expression: evt.Unmarshaled.iptables.DST
29  - parsed: length
30    expression: evt.Unmarshaled.iptables.LEN
31  - parsed: proto
32    expression: evt.Unmarshaled.iptables.PROTO
33  - parsed: src_port
34    expression: evt.Unmarshaled.iptables.SPT

Installed on

Know where it runs

Documentation

A parser for iptables -j LOG logs :

Only parse kernel messages containing IN=
Skip lines if decisions is ACCEPT
All parsed TCP and UDP packets are considered as DROPs.
ICMP packets are parsed and sets the following meta attributes: (Note we do not have scenarios around ICMP as they are FPs prone)
- icmp_type
- icmp_code
If you wish to code your own scenarios around ICMP, you can use the following link as a reference. Please note you are solely responsible for the scenarios you write.

To make this parser relevant, you should have a iptables -A INPUT -m state --state NEW -j LOG or similar into your configuration. This one will log all new connections, successful or not.