cscli parsers install crowdsecurity/teleport-logsA parser for teleport json logs
1name: crowdsecurity/teleport-logs2description: "Parse teleport logs"3filter: "evt.Parsed.program == 'teleport' && UnmarshalJSON(evt.Parsed.message, evt.Unmarshaled, 'teleport') in ['', nil]"4#debug: true5onsuccess: next_stage6statics:7 - meta: service8 value: teleport9 - meta: sub_type10 expression: evt.Unmarshaled.teleport.event11 - meta: success12 expression: "evt.Unmarshaled.teleport.success ? 'true' : 'false'"13## Set for impossible travel scenario14 - meta: log_type15 expression: "evt.Unmarshaled.teleport.success ? 'auth_success' : 'auth_failed'"16##Converting a bool with sprintf is very slow, so we use a ternary expression17 - target: evt.StrTime18 expression: evt.Unmarshaled.teleport.time19 - meta: user20 expression: evt.Unmarshaled.teleport.user21 - meta: source_ip22 expression: Split(evt.Unmarshaled.teleport["addr.remote"], ':')[0]23 - meta: http_user_agent24 expression: evt.Unmarshaled.teleport["user_agent"]