cscli parsers install crowdsecurity/suricata-logsThis parser supports both formats :
eve.json format (type: suricata-evelogs)fast.log format (type: suricata-fastlogs)The parser only parses logs that are alerts.
1onsuccess: next_stage2filter: "evt.Parsed.program == 'suricata-fastlogs'"3name: crowdsecurity/suricata-fastlogs4description: "Parse suricata fast.log"5pattern_syntax:6 SURICATA_MARKER: '\[\*\*\]'7 SURICATA_DATE: '%{DATE_US:date}-%{TIME:time}'8 SURICATA_RULE_ID: '\[%{NUMBER:suricata_gid}:%{NUMBER:rule_id}:%{NUMBER:suricata_alert_signature_rev}\]'9grok:10 pattern: '%{SURICATA_DATE} %{SURICATA_MARKER} %{SURICATA_RULE_ID} %{DATA:suricata_alert_signature} %{SURICATA_MARKER} \[Classification: %{DATA:suricata_classification}\] \[Priority: %{NUMBER:suricata_priority}\] \{%{DATA:proto}\} %{IP:source_ip}:%{NUMBER:source_port} \-> %{IP:dest_ip}:%{NUMBER:dest_port}'11 apply_on: message12statics:13 - meta: service14 value: suricata15 - meta: log_type16 value: suricata_alert17 - meta: sub_log_type18 value: suricata_alert_fast_log19 #we build back RFC3339 format20 - target: evt.Parsed.suricata_timestamp21 expression: evt.Parsed.date + ' ' + evt.Parsed.time22 - target: evt.StrTime23 expression: evt.Parsed.date + ' ' + evt.Parsed.time24 - meta: suricata_alert_signature_id25 expression: evt.Parsed.rule_id26 - meta: suricata_rule_severity27 expression: evt.Parsed.suricata_priority28 - meta: source_ip29 expression: evt.Parsed.source_ip30---31onsuccess: next_stage32filter: |33 evt.Parsed.program == "suricata-evelogs" && JsonExtract(evt.Parsed.message, "event_type") == "alert"34name: crowdsecurity/suricata-evelogs35description: "Parse suricata eve.json logs"36pattern_syntax:37 SURICATA_EVE_TS: '%{TIMESTAMP_ISO8601:time}'38nodes:39 - grok:40 pattern: '%{SURICATA_EVE_TS:time}(\-|\+)%{INT}'41 expression: JsonExtract(evt.Parsed.message, "timestamp")42statics:43 - meta: service44 value: suricata45 - meta: log_type46 value: suricata_alert47 - meta: sub_log_type48 value: suricata_alert_eve_json49 - target: evt.StrTime50 expression: evt.Parsed.time + 'Z'51 - target: evt.Meta.suricata_flow_id52 expression: JsonExtract(evt.Parsed.message, "flow_id")53 - target: evt.Meta.source_ip54 expression: JsonExtract(evt.Parsed.message, "src_ip")55 - target: evt.Parsed.dest_ip56 expression: JsonExtract(evt.Parsed.message, "dest_ip")57 - target: evt.Parsed.dest_port58 expression: JsonExtract(evt.Parsed.message, "dest_port")59 - target: evt.Parsed.proto60 expression: JsonExtract(evt.Parsed.message, "proto")61 - target: evt.Meta.suricata_alert_signature_id62 expression: JsonExtract(evt.Parsed.message, "alert.signature_id")63 - target: evt.Parsed.suricata_alert_signature_rev64 expression: JsonExtract(evt.Parsed.message, "alert.rev")65 - target: evt.Parsed.suricata_alert_signature66 expression: JsonExtract(evt.Parsed.message, "alert.signature")67 - target: evt.Meta.suricata_rule_severity68 expression: JsonExtract(evt.Parsed.message, "alert.severity")697071