cscli parsers install firewallservices/pf-logsParses the packet filter logs which are generated by pfSense and OPNsense and other FreeBSD and OpenBSD systems.
1# For more information see2# https://github.com/opnsense/ports/blob/master/opnsense/filterlog/files/description.txt3# and4# https://docs.netgate.com/pfsense/en/latest/monitoring/logs/raw-filter-format.html5filter: "evt.Parsed.program == 'filterlog' or evt.Parsed.message matches '^filterlog:'"6name: firewallservices/pf-logs7description: "Parse packet filter logs"8format: 2.09pattern_syntax:10 # WORD including special characters11 PF_WORD: '%{USERNAME}'1213 # rulenr, subrulenr, anchorname, label | "0", interface, reason, action, dir14 PF_BASE: '%{INT:rule},(%{INT:sub_rule})?,(%{WORD:anchorname})?,(%{DATA:tracker}| 0),%{PF_WORD:iface},%{WORD:reason},%{WORD:action},%{WORD:direction}'1516 # tos, ecn, ttl, id, offset, flags, protonum, protoname, length, src, dst17 PF_IPV4_DATA: '%{BASE16NUM:ip4_tos},(%{INT:ip4_ecn})?,%{INT:ip4_ttl},%{INT:ip4_id},%{INT:ip4_offset},%{WORD:ip4_flags},%{INT:ip4_proto_id},%{WORD:ip4_proto}'18 # class, flow, hoplimit, protoname, protonum19 PF_IPV6_DATA: '%{BASE16NUM:ip6_class},%{BASE16NUM:ip6_flow_label},%{INT:ip6_hop_limit},%{WORD:ip6_proto},%{INT:ip6_proto_id}'20 # ipversion, ..., length, src, dst21 PF_IP: '%{INT:ip_ver},(%{PF_IPV4_DATA}|%{PF_IPV6_DATA}),%{INT:length},%{IP:src_ip},%{IP:dst_ip}'2223 # srcport, dstport, datalen24 PF_UDP_DATA: '%{POSINT:src_port},%{POSINT:dst_port},%{INT:data_length}'25 # srcport, dstport, datalen, flags, seq, ack, window, urg, options26 PF_TCP_DATA: '%{WORD:tcp_flags},%{INT:sequence_number},(?:%{INT:ack_number})?,%{INT:tcp_window},(%{DATA:urg_data})?,%{GREEDYDATA:tcp_options}'27 # both protocols start with the same three values28 PF_PROTOCOL: '%{PF_UDP_DATA}(,%{PF_TCP_DATA})?'29grok:30 pattern: "%{PF_BASE},%{PF_IP},%{PF_PROTOCOL}"31 apply_on: message32statics:33 - meta: log_type34 value: pf35---36filter: "evt.Meta.log_type == 'pf' and evt.Parsed.action == 'block'"37name: firewallservices/pf-logs-drop38description: "Identify dropped packets"39onsuccess: next_stage40statics:41 - meta: service42 expression: "Lower(evt.Parsed.ip4_proto != '' ? evt.Parsed.ip4_proto : evt.Parsed.ip6_proto)"43 - meta: log_type44 value: pf_drop45 - meta: source_ip46 expression: "evt.Parsed.src_ip"47 - meta: rulenr48 expression: "evt.Parsed.rule"49 - meta: ruleid50 expression: "evt.Parsed.tracker"51 - meta: iface52 expression: "evt.Parsed.iface"53