1filter: "evt.Line.Labels.type == 'unifi'"
2onsuccess: next_stage
3pattern_syntax:
4  ACTION: (D|R|A)
5  ZONE: (LAN|WAN|LOCAL|VPN|DMZ)
6  IFACE_OR_EMPTY: (?:[a-zA-Z]+[0-9]*|)
7  UNIFI_HOSTNAME: '(?:%{DATA:hostname},%{DATA:mac_address},%{DATA:firmware_version}|%{DATA:hostname})'
8  UNIFI_FIREWALL_PREFIX: '(?:\[WAN_%{ZONE:dst_zone}-%{ACTION:action}-%{INT:rule_id}\] ?)?'
9  SYSLOGBASE_UNIFI: '(?:%{SYSLOGTIMESTAMP:timestamp}|%{TIMESTAMP_ISO8601:timestamp8601}) %{UNIFI_HOSTNAME}(?: %{UNIFI_HOSTNAME})? %{UNIFI_FIREWALL_PREFIX}(?:%{SYSLOGPROG}:|)'
10  SYSLOGLINE_UNIFI: '%{SYSLOGBASE_UNIFI} %{GREEDYDATA:message}'
11name: crowdsecurity/unifi-logs
12nodes:
13  - grok:
14      pattern: "^%{SYSLOGLINE_UNIFI}"
15      apply_on: Line.Raw
16statics:
17  - parsed: program
18    expression: "evt.Parsed.program != '' ? evt.Parsed.program : evt.Parsed.action != '' ? 'kernel' : ''"
19  - meta: machine
20    expression: evt.Parsed.hostname
21  - parsed: "logsource"
22    value: "syslog"
23  - target: evt.StrTime
24    expression: evt.Parsed.timestamp
25  - target: evt.StrTime
26    expression: evt.Parsed.timestamp8601
27  - meta: datasource_path
28    expression: evt.Line.Src
29  - meta: datasource_type
30    expression: evt.Line.Module
31  - meta: action
32    expression: 'evt.Parsed.action == "" ? "" : evt.Parsed.action == "A" ? "accept" : (evt.Parsed.action == "D" ? "drop" : (evt.Parsed.action == "R" ? "reject" : "unknown"))'
33  - meta: log_type
34    expression: 'evt.Meta.action not in ["accept", "unknown"] ? "iptables_drop" : "iptables_event"'