zimbra-logs Log Parser by firewallservices | CrowdSec Hub

zimbra-logs

Log parser

By: firewallservices
Version: 0.1

Parse zimbra authentication failures

Install with a top-level collection

1 collection include it

sudo cscli collections install firewallservices/zimbra

Installs 1 parser and 1 scenario.

View Zimbra - Bruteforce Protection →

Installation

sudo cscli parsers install firewallservices/zimbra-logs

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

parsers/s01-parse/firewallservices/zimbra-logs.yaml· 33 linesGitHub

1filter: "evt.Parsed.program startsWith 'zimbra'"1
2onsuccess: next_stage2
3#debug: true
4name: firewallservices/zimbra-logs
5description: "Parse zimbra authentication failures"
6nodes:3
7  - grok:4
8      pattern: '%{TIMESTAMP_ISO8601:time_local}:[0-9]+,.*%{WORD:proto}://%{HOSTNAME:server}:%{INT:port}/service/admin/soap/(AuthRequest)?\] \[.*oip=%{IP:src_ip}.*\] SoapEngine - handler exception: authentication failed for \[%{NGUSER:user}\]'
9      apply_on: message
10    statics:5
11        - target: evt.StrTime
12          expression: evt.Parsed.time_local
13  - grok:4
14      pattern: '%{TIMESTAMP_ISO8601:time_local}:[0-9]+,.*%{WORD:proto}://%{HOSTNAME:server}:%{INT:port}/service/admin/soap/(AuthRequest)?\] \[.*name=%{NGUSER:user}.*oip=%{IP:src_ip}.*\] SoapEngine - handler exception'
15      apply_on: message
16    statics:5
17        - target: evt.StrTime
18          expression: evt.Parsed.time_local
19  - grok:4
20      pattern: '%{TIMESTAMP_ISO8601:time_local}:[0-9]+,.*\[.*oip=%{IP:src_ip}.*\] imap - authentication failed for \[%{NGUSER:user}\]'
21      apply_on: message
22    statics:5
23        - target: evt.StrTime
24          expression: evt.Parsed.time_local
25statics:
26  - meta: service
27    value: zimbra
28  - meta: log_type
29    value: zimbra_auth_fail
30  - meta: source_ip
31    expression: "evt.Parsed.src_ip"
32  - meta: user
33    expression: "evt.Parsed.user"

Installed on

Know where it runs

Documentation

Zimbra failed authentication parser. To use it, you should add an acquisition like

1---
2filenames:
3  - /opt/zimbra/log/mailbox.log
4labels:
5  type: zimbra

Note that if you run Zimbra on several servers :

Acquisition should be done on the mailbox servers
You should set zimbraMailTrustedIP to the list of IP of your Zimbra proxy to ensure the original client IP will appear in the logs. For example:

1zmprov mcf +zimbraMailTrustedIP 10.30.1.13