cscli parsers install crowdsecurity/mysql-logsMysql authentication fail parser.
1onsuccess: next_stage2name: crowdsecurity/mysql-logs3description: "Parse MySQL logs"4filter: "evt.Parsed.program == 'mysql'"5pattern_syntax:6 MYSQL_ACCESS_DENIED: "Access denied for user '%{DATA:user}'@'%{IP:source_ip}' \\(using password: %{WORD:using_password}\\)"7nodes:8 - grok:9 pattern: "%{TIMESTAMP_ISO8601:time} %{NUMBER} \\[Note\\]( \\[%{DATA:err_code}\\] \\[%{DATA:subsystem}\\])? %{MYSQL_ACCESS_DENIED}"10 apply_on: message11 - grok:12 pattern: "%{TIMESTAMP_ISO8601:time}.*%{NUMBER} Connect.*%{MYSQL_ACCESS_DENIED}"13 apply_on: message14statics:15 - meta: log_type16 value: mysql_failed_auth17 - meta: source_ip18 expression: "evt.Parsed.source_ip"19 - target: evt.StrTime20 expression: evt.Parsed.time21 - meta: user22 expression: "evt.Parsed.user"23