litespeed-logs

1filter: "evt.Parsed.program == 'litespeed'"1
2onsuccess: next_stage2
3name: crowdsecurity/litespeed-logs
4description: "Parse litespeed access and error logs"
5nodes:3
6  - grok:4
7      #access log
8      pattern: '%{IPORHOST:remote_addr} - (%{NGUSER:remote_user})? \[%{HTTPDATE:time_local}\] "%{WORD:verb} %{DATA:request} HTTP/%{NUMBER:http_version}" %{NUMBER:status} %{NUMBER:body_bytes_sent} "%{NOTDQUOTE:http_referer}" "%{NOTDQUOTE:http_user_agent}"'
9      apply_on: message
10      statics:5
11        - meta: log_type
12          value: http_access-log
13        - target: evt.StrTime
14          expression: evt.Parsed.time_local
15  - grok:4
16      #user not found or bad password for HTTP auth
17      pattern: "%{TIMESTAMP_ISO8601:time} \\[%{DATA:log_level}\\] \\[%{NONNEGINT:pid}\\] \\[%{IPORHOST:remote_addr}:%{DATA:misc}#%{DATA:vhost}\\] User '%{NGUSER:username}' failed to authenticate\\."
18      apply_on: message
19      statics:5
20        - meta: sub_type
21          value: "auth_fail"
22        - meta: username
23          expression: evt.Parsed.username
24        - target: evt.StrTime
25          expression: evt.Parsed.time
26  - grok:4
27      #admin UI auth fail
28      pattern: "%{TIMESTAMP_ISO8601:time} \\[%{DATA:log_level}\\] \\[%{NONNEGINT:pid}\\] \\[%{IPORHOST:remote_addr}:%{DATA:misc}#%{DATA:vhost}\\] \\[%{WORD}\\] \\[%{DATA}\\] Failed Login Attempt - username:%{DATA:username} ip:%{IP:client_ip} url:%{DATA:url}"
29      apply_on: message
30      statics:5
31        - meta: sub_type
32          value: "litespeed_admin_auth_fail"
33        - target: evt.StrTime
34          expression: evt.Parsed.time
35        - meta: username
36          expression: evt.Parsed.username
37statics:
38  - meta: service
39    value: http
40  - meta: source_ip