Install with a top-level collection
1 collection include itsudo cscli collections install crowdsecurity/supabase-composeInstalls 3 parsers and 50 scenarios.
View Supabase →Installation
sudo cscli parsers install crowdsecurity/supabase-docker-pgsqlThen reload CrowdSec: sudo systemctl reload crowdsec
Sign in to see which of your engines run it →Configuration
Hover a line or a note to see what each field does.
onsuccess: next_stagename: crowdsecurity/supabase-docker-pgsqldescription: "Parse PgSQL logs"filter: "evt.Parsed.program == 'postgres'"nodes:- grok:#supabase docker compose postgres password auth failpattern: '%{IPORHOST:source_ip} %{TIMESTAMP_ISO8601:timestamp} %{WORD:zone} \[%{INT:PID}\] %{USERNAME:pgsql_user}@%{GREEDYDATA:pgsql_dbname} FATAL: %{WORD:auth_method} authentication failed for user "%{USERNAME:pgsql_target_user}"'apply_on: messagestatics:- meta: log_typevalue: pgsql_failed_auth- meta: auth_methodexpression: "evt.Parsed.auth_method"- meta: source_ipexpression: "evt.Parsed.source_ip"- meta: userexpression: "evt.Parsed.pgsql_target_user"- meta: dbexpression: "evt.Parsed.pgsql_dbname"- target: evt.StrTimeexpression: evt.Parsed.timestamp
Installed on
Know where it runs
Sign in to see the Security Engines that run this log parser, the version they run and whether it was modified locally.
Documentation
Parser for postgres flavor provided by supabase docker compose deployment.