cscli parsers install crowdsecurity/tcpdump-logsA parser for tcpdump logs.
To make this parser relevant, you should have add tcpdump command that log tcp scan :
An example:
1cat <<EOF > /etc/systemd/system/tcpdump.service2[Unit]3Description=TCPDUMP45[Service]6Type=simple7User=root8ExecStart=/bin/sh -c 'tcpdump -l -n -i eth0 "tcp[tcpflags] & (tcp-syn) != 0" >> /var/log/tcpdump.out'9Restart=on-failure1011[Install]12WantedBy=multi-user.target13EOF1415systemctl daemon-reload16systemctl enable tcpdump.service17service tcpdump start
1onsuccess: next_stage2filter: "evt.Parsed.program == 'tcpdump'"3name: crowdsecurity/tcpdump-logs4#debug: true5description: "Parse tcpdump raw logs"6grok:7 name: "TCPDUMP_OUTPUT"8 apply_on: message9statics:10 - meta: service11 value: tcp12 - meta: log_type13 value: tcp_syn14 - meta: source_ip15 expression: "evt.Parsed.source_ip"16 - meta: dest_ip17 expression: "evt.Parsed.dest_ip"18 - meta: dest_port19 expression: "evt.Parsed.dest_port"20 - parsed: "new_connection"21 expression: "evt.Parsed.tcpflags contains 'S' ? 'true' : 'false'"