cscli parsers install crowdsecurity/mariadb-logsMariadb authentication failure parser.
1onsuccess: next_stage2name: crowdsecurity/mariadb-logs3description: "Parse MariaDB logs"4filter: "evt.Parsed.program startsWith 'mariadb'"5pattern_syntax:6 LONG_DATE_YMD: "%{YEAR:year}-%{MONTHNUM:month}-%{MONTHDAY:day}"7 SHORT_DATE_YMD: "%{YEAR:year}%{MONTHNUM2:month}%{MONTHDAY:day}"8 PASSWORD_SYNTAX: " ?%{TIME:time} (%{NUMBER:thread_id} )?\\[Warning\\] Access denied for user '%{DATA:user}'@'%{IP:source_ip}' \\(using password: %{WORD:using_password}\\)"9nodes:10 - grok:11 pattern: "%{LONG_DATE_YMD:date} %{PASSWORD_SYNTAX}"12 apply_on: message13 onsuccess: next_stage14 - grok:15 pattern: "%{SHORT_DATE_YMD:date} %{PASSWORD_SYNTAX}"16 apply_on: message17 statics:18 - target: evt.StrTimeFormat19 value: "060102 15:04:05"20 onsuccess: next_stage21statics:22 - target: evt.StrTime23 expression: "evt.Parsed.date + ' ' + evt.Parsed.time"24 - meta: log_type25 value: "mariadb_failed_auth"26 - meta: source_ip27 expression: "evt.Parsed.source_ip"28 - meta: user29 expression: "evt.Parsed.user"30