postscreen-logs Log Parser by crowdsecurity | CrowdSec Hub

postscreen-logs

Log parser

By: crowdsecurity
Version: 0.3

Parse postscreen logs

Install with a top-level collection

2 collections include it

sudo cscli collections install crowdsecurity/apiscp

Installs 9 parsers and 56 scenarios, via Postfix - Bruteforce Protection.

View ApisCP →

Installation

sudo cscli parsers install crowdsecurity/postscreen-logs

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

parsers/s01-parse/crowdsecurity/postscreen-logs.yaml· 20 linesGitHub

1onsuccess: next_stage1
2filter: "evt.Parsed.program in ['postfix/postscreen', 'haproxy/postscreen']"2
3name: crowdsecurity/postscreen-logs
4pattern_syntax:3
5  POSTSCREEN_PREGREET: 'PREGREET'
6  POSTSCREEN_PREGREET_TIME_ATTEMPT: '\d+(.\d+)?'
7description: "Parse postscreen logs"
8nodes:4
9  - grok:5
10      apply_on: message
11      pattern: '%{POSTSCREEN_PREGREET:pregreet} %{INT:count} after %{POSTSCREEN_PREGREET_TIME_ATTEMPT:time_attempt} from \[%{IP:remote_addr}\]:%{INT:port}: %{GREEDYDATA:message_attempt}'
12statics:6
13    - meta: service
14      value: postscreen
15    - meta: source_ip
16      expression: "evt.Parsed.remote_addr"
17    - meta: pregreet
18      expression: "evt.Parsed.pregreet"
19
20

postscreen-logs

Installation

Configuration

Installed on

Know where it runs