1filter: "evt.Parsed.program == 'litespeed'"
2onsuccess: next_stage
3name: crowdsecurity/litespeed-logs
4description: "Parse litespeed access and error logs"
5nodes:
6  - grok:
7      #access log
8      pattern: '%{IPORHOST:remote_addr} - (%{NGUSER:remote_user})? \[%{HTTPDATE:time_local}\] "%{WORD:verb} %{DATA:request} HTTP/%{NUMBER:http_version}" %{NUMBER:status} %{NUMBER:body_bytes_sent} "%{NOTDQUOTE:http_referer}" "%{NOTDQUOTE:http_user_agent}"'
9      apply_on: message
10      statics:
11        - meta: log_type
12          value: http_access-log
13        - target: evt.StrTime
14          expression: evt.Parsed.time_local
15  - grok:
16      #user not found or bad password for HTTP auth
17      pattern: "%{TIMESTAMP_ISO8601:time} \\[%{DATA:log_level}\\] \\[%{NONNEGINT:pid}\\] \\[%{IPORHOST:remote_addr}:%{DATA:misc}#%{DATA:vhost}\\] User '%{NGUSER:username}' failed to authenticate\\."
18      apply_on: message
19      statics:
20        - meta: sub_type
21          value: "auth_fail"
22        - meta: username
23          expression: evt.Parsed.username
24        - target: evt.StrTime
25          expression: evt.Parsed.time
26  - grok:
27      #admin UI auth fail
28      pattern: "%{TIMESTAMP_ISO8601:time} \\[%{DATA:log_level}\\] \\[%{NONNEGINT:pid}\\] \\[%{IPORHOST:remote_addr}:%{DATA:misc}#%{DATA:vhost}\\] \\[%{WORD}\\] \\[%{DATA}\\] Failed Login Attempt - username:%{DATA:username} ip:%{IP:client_ip} url:%{DATA:url}"
29      apply_on: message
30      statics:
31        - meta: sub_type
32          value: "litespeed_admin_auth_fail"
33        - target: evt.StrTime
34          expression: evt.Parsed.time
35        - meta: username
36          expression: evt.Parsed.username
37statics:
38  - meta: service
39    value: http
40  - meta: source_ip
41    expression: "evt.Parsed.remote_addr"
42  - meta: http_status
43    expression: "evt.Parsed.status"
44  - meta: http_path
45    expression: "evt.Parsed.request"
46  - meta: http_verb
47    expression: "evt.Parsed.verb"
48  - meta: http_user_agent
49    expression: "evt.Parsed.http_user_agent"
50  - meta: target_fqdn
51    expression: "evt.Parsed.target_fqdn"
52