postfix-logs

1# Copyright (c) 2014, 2015, Rudy Gevaert
2# Copyright (c) 2020 Crowdsec
3
4# Permission is hereby granted, free of charge, to any person obtaining
5# a copy of this software and associated documentation files (the
6# "Software"), to deal in the Software without restriction, including
7# without limitation the rights to use, copy, modify, merge, publish,
8# distribute, sublicense, and/or sell copies of the Software, and to
9# permit persons to whom the Software is furnished to do so, subject to
10# the following conditions:
11
12# The above copyright notice and this permission notice shall be
13# included in all copies or substantial portions of the Software.
14
15# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
16# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
17# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
18# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
19# LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
20# OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
21# WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
22
23# Some of the groks used here are from https://github.com/rgevaert/grok-patterns/blob/master/grok.d/postfix_patterns
24onsuccess: next_stage1
25filter: "evt.Parsed.program endsWith '/smtpd'"2
26name: crowdsecurity/postfix-logs
27pattern_syntax:3
28  POSTFIX_HOSTNAME: '(%{HOSTNAME}|unknown)'
29  POSTFIX_COMMAND: '(AUTH|STARTTLS|CONNECT|EHLO|HELO|RCPT)'
30  POSTFIX_ACTION: 'discard|dunno|filter|hold|ignore|info|prepend|redirect|replace|reject|warn'
31  RELAY: '(?:%{HOSTNAME:remote_host}(?:\[%{IP:remote_addr}\](?::[0-9]+(.[0-9]+)?)?)?)'
32  SMTP_BASIC_STATUS_CODE: '[0-9]{3}' #250
33  SMTP_ENHANCED_STATUS_CODE: '[0-9.]+' #2.0.0
34  SMTP_RETURN_CODES: '%{SMTP_BASIC_STATUS_CODE:smtp_basic_status_code}( %{SMTP_ENHANCED_STATUS_CODE:smtp_enhanced_status_code})?' #250 2.0.0
35description: "Parse postfix logs"
36nodes:4
37  - grok:5
38      apply_on: message
39      pattern: 'lost connection after %{DATA:smtp_response} from %{RELAY}'
40      statics:6