cscli parsers install fulljackz/proxmox-logsA simple parser for Proxmox VE Web interface. Proxmox VE is listening on port 8006/tcp and write ssh fails into syslog
1Jan 4 17:34:08 hypervisor pvedaemon[3663339]: authentication failure; rhost=::ffff:172.21.10.2 user=toor@pam msg=no such user ('toor@pam')2Jan 4 17:34:22 hypervisor pvedaemon[3483744]: authentication failure; rhost=::ffff:172.21.10.2 user=root@pam msg=Authentication failure
In the first string, the user does not exist. In the second user exists but auth fail.
1Jan 4 17:34:27 hypervisor pvedaemon[2891825]: <root@pam> successful auth for user 'root@pam'
1line: Jan 4 17:34:08 hypervisor pvedaemon[3663339]: authentication failure; rhost=::ffff:172.21.10.2 user=toor@pam msg=no such user ('toor@pam')2 โ s00-raw3 | โ ๐ข crowdsecurity/syslog-logs (first_parser)4 โ s01-parse5 | โ ๐ข fulljackz/proxmox-logs (+8)6 โ-------- parser success ๐ข7 โ Scenarios8 โ ๐ข fulljackz/proxmox-bf910line: Jan 4 17:34:01 hypervisor pvedaemon[3663339]: authentication failure; rhost=::ffff:172.21.10.2 user=toor@pam msg=no such user ('toor@pam')11 โ s00-raw12 | โ ๐ข crowdsecurity/syslog-logs (first_parser)13 โ s01-parse14 | โ ๐ข fulljackz/proxmox-logs (+8)15 โ-------- parser success ๐ข16 โ Scenarios17 โ ๐ข fulljackz/proxmox-bf1819line: Jan 4 17:34:08 hypervisor pvedaemon[3663339]: authentication failure; rhost=::ffff:172.21.10.2 user=toor@pam msg=no such user ('toor@pam')20 โ s00-raw21 | โ ๐ข crowdsecurity/syslog-logs (first_parser)22 โ s01-parse23 | โ ๐ข fulljackz/proxmox-logs (+8)24 โ-------- parser success ๐ข25 โ Scenarios26 โ ๐ข fulljackz/proxmox-bf2728line: Jan 4 17:34:07 hypervisor pvedaemon[3483744]: authentication failure; rhost=::ffff:172.21.10.2 user=root@pam msg=Authentication failure29 โ s00-raw30 | โ ๐ข crowdsecurity/syslog-logs (first_parser)31 โ s01-parse32 | โ ๐ข fulljackz/proxmox-logs (+8)33 โ-------- parser success ๐ข34 โ Scenarios35 โ ๐ข fulljackz/proxmox-bf3637line: Jan 4 17:34:08 hypervisor pvedaemon[2891825]: <root@pam> successful auth for user 'root@pam'38 โ s00-raw39 | โ ๐ข crowdsecurity/syslog-logs (first_parser)40 โ s01-parse41 | โ ๐ด fulljackz/proxmox-logs42 โ-------- parser failure ๐ด4344line: Jan 4 17:34:08 hypervisor pvedaemon[3663339]: authentication failure; rhost=::ffff:172.21.10.2 user=toor@pam msg=no such user ('toor@pam')45 โ s00-raw46 | โ ๐ข crowdsecurity/syslog-logs (first_parser)47 โ s01-parse48 | โ ๐ข fulljackz/proxmox-logs (+8)49 โ-------- parser success ๐ข50 โ Scenarios51 โ ๐ข fulljackz/proxmox-bf5253line: Jan 4 17:34:11 hypervisor pvedaemon[2891825]: <root@pam> successful auth for user 'root@pam'54 โ s00-raw55 | โ ๐ข crowdsecurity/syslog-logs (first_parser)56 โ s01-parse57 | โ ๐ด fulljackz/proxmox-logs58 โ-------- parser failure ๐ด5960line: Jan 4 17:34:12 hypervisor pvedaemon[3483744]: authentication failure; rhost=::ffff:172.21.10.2 user=root@pam msg=Authentication failure61 โ s00-raw62 | โ ๐ข crowdsecurity/syslog-logs (first_parser)63 โ s01-parse64 | โ ๐ข fulljackz/proxmox-logs (+8)65 โ-------- parser success ๐ข66 โ Scenarios67 โ ๐ข fulljackz/proxmox-bf6869line: Jan 4 17:34:13 hypervisor pvedaemon[2891825]: <root@pam> successful auth for user 'root@pam'70 โ s00-raw71 | โ ๐ข crowdsecurity/syslog-logs (first_parser)72 โ s01-parse73 | โ ๐ด fulljackz/proxmox-logs74 โ-------- parser failure ๐ด7576line: Jan 4 17:34:02 hypervisor pvedaemon[3483744]: authentication failure; rhost=::ffff:172.21.10.2 user=root@pam msg=Authentication failure77 โ s00-raw78 | โ ๐ข crowdsecurity/syslog-logs (first_parser)79 โ s01-parse80 | โ ๐ข fulljackz/proxmox-logs (+8)81 โ-------- parser success ๐ข82 โ Scenarios83 โ ๐ข fulljackz/proxmox-bf8485line: Jan 4 17:34:03 hypervisor pvedaemon[2891825]: <root@pam> successful auth for user 'root@pam'86 โ s00-raw87 | โ ๐ข crowdsecurity/syslog-logs (first_parser)88 โ s01-parse89 | โ ๐ด fulljackz/proxmox-logs90 โ-------- parser failure ๐ด
1#debug: true2name: fulljackz/proxmox-logs3description: "Parse proxmox logs for bruteforce attempts"4filter: "evt.Parsed.program == 'pvedaemon'"5onsuccess: next_stage6pattern_syntax:7 PVE_AUTH_FAIL: 'authentication failure; rhost=%{IP:client_ip} user=%{USERNAME:source_user}@%{WORD:realm} msg='8nodes:9 - grok:10 name: "PVE_AUTH_FAIL"11 apply_on: message12 statics:13 - meta: log_type14 value: pve_failed-auth15 - meta: source_user16 expression: "evt.Parsed.source_user"17statics:18 - meta: service19 value: pvedaemon20 - meta: source_ip21 expression: "evt.Parsed.client_ip"22