1filter: "evt.Parsed.program startsWith 'zimbra'"
2onsuccess: next_stage
3#debug: true
4name: firewallservices/zimbra-logs
5description: "Parse zimbra authentication failures"
6nodes:
7  - grok:
8      pattern: '%{TIMESTAMP_ISO8601:time_local}:[0-9]+,.*%{WORD:proto}://%{HOSTNAME:server}:%{INT:port}/service/admin/soap/(AuthRequest)?\] \[.*oip=%{IP:src_ip}.*\] SoapEngine - handler exception: authentication failed for \[%{NGUSER:user}\]'
9      apply_on: message
10    statics:
11        - target: evt.StrTime
12          expression: evt.Parsed.time_local
13  - grok:
14      pattern: '%{TIMESTAMP_ISO8601:time_local}:[0-9]+,.*%{WORD:proto}://%{HOSTNAME:server}:%{INT:port}/service/admin/soap/(AuthRequest)?\] \[.*name=%{NGUSER:user}.*oip=%{IP:src_ip}.*\] SoapEngine - handler exception'
15      apply_on: message
16    statics:
17        - target: evt.StrTime
18          expression: evt.Parsed.time_local
19  - grok:
20      pattern: '%{TIMESTAMP_ISO8601:time_local}:[0-9]+,.*\[.*oip=%{IP:src_ip}.*\] imap - authentication failed for \[%{NGUSER:user}\]'
21      apply_on: message
22    statics:
23        - target: evt.StrTime
24          expression: evt.Parsed.time_local
25statics:
26  - meta: service
27    value: zimbra
28  - meta: log_type
29    value: zimbra_auth_fail
30  - meta: source_ip
31    expression: "evt.Parsed.src_ip"
32  - meta: user
33    expression: "evt.Parsed.user"
34