cscli parsers install firewallservices/lemonldap-ngParses Lemonldap::NG logs and detects failed authentication. Only working if using an LDAP or AD authentication backend for now.
1filter: "evt.Parsed.program in ['LLNG','lemonldap-ng']"2name: firewall-services/lemonldap-ng-logs3description: "Parse Lemonldap::NG logs"4onsuccess: next_stage5#debug: true6nodes:7 - grok:8 pattern: (\[warn\]|Lemonldap::NG :) %{USERNAME:user} was not found in LDAP directory \(%{IP:src_ip}\)9 apply_on: message10 - grok:11 pattern: (\[warn\]|Lemonldap::NG :) Bad password for %{USERNAME:user} \(%{IP:src_ip}\)12 apply_on: message13statics:14 - meta: service15 value: llng16 - meta: user17 expression: "evt.Parsed.user"18 - meta: log_type19 value: llng_auth_fail20 - meta: source_ip21 expression: "evt.Parsed.src_ip"22