cscli parsers install crowdsecurity/unifi-cefThis parser specifically handles CEF logs from Ubiquiti UniFi Network devices, filtering by vendor and product to ensure it only processes relevant logs.
The parser extracts Unifi-specific CEF extension fields that contain valuable metadata about network events, device information, and security alerts from UniFi devices.
It uses comprehensive grok patterns that parse the entire CEF extension message in the expected field order, ensuring compatibility with the Go grok implementation.
The parser uses a single configuration with two grok patterns, each optimized for different types of Unifi CEF events with pattern-specific statics:
UNIFI_ADMIN_PATTERN): Handles administrative actions like logins and system accessUNIFI_SECURITY_PATTERN): Handles security alerts and intrusion preventionPattern matches logs like:
UNIFIcategory=System UNIFIsubCategory=Admin UNIFIhost=Unifi Dream Machine UNIFIaccessMethod=web UNIFIadmin=Secure Admin src=192.168.1.100 UNIFIutcTime=2025-09-04T08:32:58.445Z msg=...Admin pattern extracts and sets:
admin_user - Admin user who performed the actionaccess_method - How access was performed (web, API, etc.)timestamp - UTC timestamp of the eventPattern matches logs like:
proto=TCP src=10.0.0.100 spt=54587 dst=192.168.0.233 dpt=443 UNIFIcategory=Security UNIFIsubCategory=Intrusion Prevention UNIFIhost=Express 7 UNIFIdeviceMac=84:78:48:80:0d:86 UNIFIdeviceName=Express 7 UNIFIdeviceModel=UX7 UNIFIdeviceIp=192.168.0.1 UNIFIdeviceVersion=4.3.9 UNIFIrisk=medium UNIFIipsSessionId=54725290909450 UNIFIipsSignature=ET DROP Dshield Block Listed Source group 1 UNIFIipsSignatureId=2402000 UNIFIutcTime=2025-08-30T17:53:21.915Z msg=A network intrusion attempt has been detected and blocked.Security pattern extracts and sets:
device_name, device_model, device_mac, device_ip - Device informationprotocol, source_port, destination_ip, destination_port - Network detailsrisk_level, ips_signature, ips_signature_id, ips_session_id - Threat informationThe parser automatically filters for logs where:
cef_device_vendor equals "Ubiquiti"cef_device_product equals "UniFi Network"This ensures the parser only processes actual Unifi CEF logs and doesn't interfere with other CEF sources.
The parser extracts the following Unifi-specific fields into metadata:
device_name - Name of the Unifi devicedevice_model - Model of the device (e.g., UX7, USG)device_mac - MAC address of the devicedevice_version - Firmware versionhost - Hostname of the devicesource_ip - Source IP addressprotocol - Network protocol (TCP, UDP, etc.)source_port - Source portdestination_port - Destination portcategory - Event category (System, Security, etc.)subcategory - Event subcategoryrisk_level - Risk level (high, medium, low)event_severity - CEF severity leveladmin_user - Admin user who performed actionaccess_method - How access was performed (web, API, etc.)ips_signature - IPS signature that triggeredips_signature_id - IPS signature IDips_session_id - IPS session identifierThis parser should be used after the cef-logs parser in the s00-raw stage. It will automatically filter and enrich Unifi CEF logs with structured metadata for use in scenarios and correlation rules.
1onsuccess: next_stage2filter: "evt.Parsed.cef_device_vendor == 'Ubiquiti' && evt.Parsed.cef_device_product == 'UniFi Network'"3name: crowdsecurity/unifi-cef4description: "Parse Unifi CEF logs"5pattern_syntax:6 UNIFI_ADMIN_PATTERN: 'UNIFIcategory=(%{DATA:unifi_category}) UNIFIsubCategory=(%{DATA:unifi_subcategory}) UNIFIhost=(%{DATA:unifi_host}) UNIFIaccessMethod=(%{DATA:unifi_access_method}) UNIFIadmin=(%{DATA:unifi_admin}) src=(%{IP:src_ip}) UNIFIutcTime=(%{DATA:unifi_utc_time}) msg=(%{DATA:msg})'7 UNIFI_SECURITY_PATTERN: 'proto=(%{WORD:protocol}) src=(%{IP:src_ip}) spt=(%{INT:src_port}) dst=(%{IP:dst_ip}) dpt=(%{INT:dst_port}) UNIFIcategory=(%{DATA:unifi_category}) UNIFIsubCategory=(%{DATA:unifi_subcategory}) UNIFIhost=(%{DATA:unifi_host}) UNIFIdeviceMac=(%{DATA:unifi_device_mac}) UNIFIdeviceName=(%{DATA:unifi_device_name}) UNIFIdeviceModel=(%{DATA:unifi_device_model}) UNIFIdeviceIp=(%{IP:unifi_device_ip}) UNIFIdeviceVersion=(%{DATA:unifi_device_version}) UNIFIrisk=(%{DATA:unifi_risk}) UNIFIipsSessionId=(%{DATA:unifi_ips_session_id}) UNIFIipsSignature=(%{DATA:unifi_ips_signature}) UNIFIipsSignatureId=(%{DATA:unifi_ips_signature_id}) UNIFIutcTime=(%{DATA:unifi_utc_time}) msg=(%{DATA:msg})'8nodes:9 - grok:10 pattern: '%{UNIFI_ADMIN_PATTERN}'11 apply_on: message12 statics:13 - meta: service14 value: unifi15 - meta: vendor16 expression: evt.Parsed.cef_device_vendor17 - meta: product18 expression: evt.Parsed.cef_device_product19 - meta: device_version20 expression: evt.Parsed.cef_device_version21 - meta: source_ip22 expression: evt.Parsed.src_ip23 - meta: admin_user24 expression: evt.Parsed.unifi_admin25 - meta: category26 expression: evt.Parsed.unifi_category27 - meta: subcategory28 expression: evt.Parsed.unifi_subcategory29 - meta: access_method30 expression: evt.Parsed.unifi_access_method31 - meta: host32 expression: evt.Parsed.unifi_host33 - meta: event_severity34 expression: evt.Parsed.cef_severity35 - meta: event_signature_id36 expression: evt.Parsed.cef_signature_id37 - meta: message38 expression: evt.Parsed.msg39 - target: evt.StrTime40 expression: evt.Parsed.unifi_utc_time41 - grok:42 pattern: '%{UNIFI_SECURITY_PATTERN}'43 apply_on: message44 statics:45 - meta: service46 value: unifi47 - meta: vendor48 expression: evt.Parsed.cef_device_vendor49 - meta: product50 expression: evt.Parsed.cef_device_product51 - meta: device_version52 expression: evt.Parsed.cef_device_version53 - meta: source_ip54 expression: evt.Parsed.src_ip55 - meta: device_name56 expression: evt.Parsed.unifi_device_name57 - meta: device_model58 expression: evt.Parsed.unifi_device_model59 - meta: device_mac60 expression: evt.Parsed.unifi_device_mac61 - meta: device_ip62 expression: evt.Parsed.unifi_device_ip63 - meta: category64 expression: evt.Parsed.unifi_category65 - meta: subcategory66 expression: evt.Parsed.unifi_subcategory67 - meta: host68 expression: evt.Parsed.unifi_host69 - meta: risk_level70 expression: evt.Parsed.unifi_risk71 - meta: ips_signature72 expression: evt.Parsed.unifi_ips_signature73 - meta: ips_signature_id74 expression: evt.Parsed.unifi_ips_signature_id75 - meta: ips_session_id76 expression: evt.Parsed.unifi_ips_session_id77 - meta: event_severity78 expression: evt.Parsed.cef_severity79 - meta: event_signature_id80 expression: evt.Parsed.cef_signature_id81 - meta: protocol82 expression: evt.Parsed.protocol83 - meta: source_port84 expression: evt.Parsed.src_port85 - meta: destination_ip86 expression: evt.Parsed.dst_ip87 - meta: destination_port88 expression: evt.Parsed.dst_port89 - meta: message90 expression: evt.Parsed.msg91 - target: evt.StrTime92 expression: evt.Parsed.unifi_utc_time93