unifi-logs
Log parser
- Version
- 0.2
Install with a top-level collection
1 collection include itsudo cscli collections install crowdsecurity/unifiInstalls 5 parsers and 2 scenarios.
View UniFi →Installation
sudo cscli parsers install crowdsecurity/unifi-logsThen reload CrowdSec: sudo systemctl reload crowdsec
Sign in to see which of your engines run it →Configuration
Hover a line or a note to see what each field does.
filter: "evt.Line.Labels.type == 'unifi'"onsuccess: next_stagepattern_syntax:ACTION: (D|R|A)ZONE: (LAN|WAN|LOCAL|VPN|DMZ)IFACE_OR_EMPTY: (?:[a-zA-Z]+[0-9]*|)UNIFI_HOSTNAME: '(?:%{DATA:hostname},%{DATA:mac_address},%{DATA:firmware_version}|%{DATA:hostname})'UNIFI_FIREWALL_PREFIX: '(?:\[WAN_%{ZONE:dst_zone}-%{ACTION:action}-%{INT:rule_id}\] ?)?'SYSLOGBASE_UNIFI: '(?:%{SYSLOGTIMESTAMP:timestamp}|%{TIMESTAMP_ISO8601:timestamp8601}) %{UNIFI_HOSTNAME}(?: %{UNIFI_HOSTNAME})? %{UNIFI_FIREWALL_PREFIX}(?:%{SYSLOGPROG}:|)'SYSLOGLINE_UNIFI: '%{SYSLOGBASE_UNIFI} %{GREEDYDATA:message}'name: crowdsecurity/unifi-logsnodes:- grok:pattern: "^%{SYSLOGLINE_UNIFI}"apply_on: Line.Rawstatics:- parsed: programexpression: "evt.Parsed.program != '' ? evt.Parsed.program : evt.Parsed.action != '' ? 'kernel' : ''"- meta: machineexpression: evt.Parsed.hostname- parsed: "logsource"value: "syslog"- target: evt.StrTimeexpression: evt.Parsed.timestamp- target: evt.StrTimeexpression: evt.Parsed.timestamp8601- meta: datasource_pathexpression: evt.Line.Src- meta: datasource_typeexpression: evt.Line.Module- meta: actionexpression: 'evt.Parsed.action == "" ? "" : evt.Parsed.action == "A" ? "accept" : (evt.Parsed.action == "D" ? "drop" : (evt.Parsed.action == "R" ? "reject" : "unknown"))'- meta: log_typeexpression: 'evt.Meta.action not in ["accept", "unknown"] ? "iptables_drop" : "iptables_event"'
Installed on
Know where it runs
Sign in to see the Security Engines that run this log parser, the version they run and whether it was modified locally.
Documentation
Unifi syslog parser
This is a parser for syslog logs received from an Unifi device.
Those logs are sligthly non-conformant to the syslog standard, hence the need for a custom parser.
Example configuration
As crowdsec does not run easily directly on an UDM, you'll likely want to setup syslog export on your UDM, and use the following acquisition config:
1source: syslog2listen_addr: 0.0.0.03listen_port: 42424labels:5 type: unifi