cscli parsers install crowdsecurity/supabase-docker-pgsqlParser for postgres flavor provided by supabase docker compose deployment.
1onsuccess: next_stage2name: crowdsecurity/supabase-docker-pgsql3description: "Parse PgSQL logs"4filter: "evt.Parsed.program == 'postgres'"5nodes:6 - grok:7 #supabase docker compose postgres password auth fail8 pattern: '%{IPORHOST:source_ip} %{TIMESTAMP_ISO8601:timestamp} %{WORD:zone} \[%{INT:PID}\] %{USERNAME:pgsql_user}@%{GREEDYDATA:pgsql_dbname} FATAL: %{WORD:auth_method} authentication failed for user "%{USERNAME:pgsql_target_user}"'9 apply_on: message1011statics:12 - meta: log_type13 value: pgsql_failed_auth14 - meta: auth_method15 expression: "evt.Parsed.auth_method"16 - meta: source_ip17 expression: "evt.Parsed.source_ip"18 - meta: user19 expression: "evt.Parsed.pgsql_target_user"20 - meta: db21 expression: "evt.Parsed.pgsql_dbname"22 - target: evt.StrTime23 expression: evt.Parsed.timestamp