Install with a top-level collection
6 collections include itsudo cscli collections install crowdsecurity/sshd-impossible-travelInstalls 1 parser and 2 scenarios.
View SSHD - Impossible Travel Detection →Installation
sudo cscli parsers install crowdsecurity/sshd-success-logsThen reload CrowdSec: sudo systemctl reload crowdsec
Sign in to see which of your engines run it →Configuration
Hover a line or a note to see what each field does.
onsuccess: next_stage#debug: truefilter: "evt.Parsed.program in ['sshd-session', 'sshd']"name: crowdsecurity/sshd-success-logsdescription: "Parse successful ssh logins"pattern_syntax:IPv4_WORKAROUND: (?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)IP_WORKAROUND: (?:%{IPV6}|%{IPv4_WORKAROUND})nodes:- grok:pattern: "Accepted (publickey|password) for %{USERNAME:sshd_auth_user} from %{IP_WORKAROUND:sshd_client_ip} port %{NUMBER:sshd_client_port} ssh2%{GREEDYDATA:sshd_trail}"apply_on: messagestatics:- meta: servicevalue: ssh- meta: source_ipexpression: "evt.Parsed.sshd_client_ip"- meta: userexpression: "evt.Parsed.sshd_auth_user"- meta: log_typevalue: auth_success
Installed on
Know where it runs
Sign in to see the Security Engines that run this log parser, the version they run and whether it was modified locally.
Documentation
A parser for ssh success logs. It will parse password and public key authentication. It will also parse the username and the source IP address.