1onsuccess: next_stage
2#debug: true
3filter: "evt.Parsed.program == 'sshd'"
4name: crowdsecurity/sshd-success-logs
5description: "Parse successful ssh logins"
6pattern_syntax:
7  IPv4_WORKAROUND: (?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)
8  IP_WORKAROUND: (?:%{IPV6}|%{IPv4_WORKAROUND})
9nodes:
10  - grok:
11      pattern: "Accepted (publickey|password) for %{USERNAME:sshd_auth_user} from %{IP_WORKAROUND:sshd_client_ip} port %{NUMBER:sshd_client_port} ssh2%{GREEDYDATA:sshd_trail}"
12      apply_on: message
13statics:
14    - meta: service
15      value: ssh
16    - meta: source_ip
17      expression: "evt.Parsed.sshd_client_ip"
18    - meta: user
19      expression: "evt.Parsed.sshd_auth_user"
20    - meta: log_type
21      value: auth_success
22