1onsuccess: next_stage
2#debug: true
3filter: "evt.Parsed.program == 'sabnzbd'"
4name: crowdsecurity/sabnzbd-logs
5description: "Parse sabnzbd authentication failures"
6pattern_syntax:
7  SABNZBD_TIMESTAMP: '%{SYSLOGTIMESTAMP:timestamp}'
8  SABNZBD_SUFFIX: '( \(X-Forwarded-For: %{IP:first_forwarded}.*\))? \[%{GREEDYDATA:user_agent}\]'
9nodes:
10  - grok:
11      pattern: '%{TIMESTAMP_ISO8601:timestamp}::%{DATA:log_level}::\[%{DATA}:%{INT:pid}\] %{GREEDYDATA:sabnzbd_message}'
12      apply_on: message
13    nodes:
14      - grok:
15          pattern: 'Unsuccessful login attempt from %{IP:first_ip}%{SABNZBD_SUFFIX}'
16          apply_on: sabnzbd_message
17          statics:
18            - meta: log_type
19              value: sabnzbd_failed_auth
20      - grok:
21          pattern: 'Fehlerhafter Login Versuch von %{IP:first_ip}%{SABNZBD_SUFFIX}'
22          apply_on: sabnzbd_message
23          statics:
24            - meta: log_type
25              value: sabnzbd_failed_auth
26      - grok:
27          pattern: 'Echec de la tentative de connexion de %{IP:first_ip}%{SABNZBD_SUFFIX}'
28          apply_on: sabnzbd_message
29          statics:
30            - meta: log_type
31              value: sabnzbd_failed_auth
32      - grok:
33          pattern: 'Mislukte login poging van %{IP:first_ip}%{SABNZBD_SUFFIX}'
34          apply_on: sabnzbd_message
35          statics:
36            - meta: log_type
37              value: sabnzbd_failed_auth
38
39statics:
40  - meta: service
41    value: sabnzbd
42  - target: evt.StrTime
43    expression: evt.Parsed.timestamp
44  - meta: source_ip
45    expression: "evt.Parsed.first_forwarded != '' ? evt.Parsed.first_forwarded : evt.Parsed.first_ip"
46