cscli parsers install fulljackz/pureftpd-logsA simple parser for Pureftpd.
1Jan 7 14:19:35 ftpcdr pure-ftpd: (?@172.21.10.2) [WARNING] Authentication failed for user [root]2Jan 7 14:19:36 ftpcdr pure-ftpd: (?@172.21.10.2) [WARNING] Authentication failed for user [root]
1Jan 7 14:20:06 ftpcdr pure-ftpd: (?@172.21.10.2) [INFO] user@test.com is now logged in
1line: Jan 7 14:20:01 ftpcdr pure-ftpd: (?@172.21.10.2) [WARNING] Authentication failed for user [root]2 ├ s00-raw3 | └ 🟢 crowdsecurity/syslog-logs (first_parser)4 ├ s01-parse5 | └ 🟢 fulljackz/pureftpd-logs (+6)6 ├-------- parser success 🟢7 ├ Scenarios8 └ 🟢 fulljackz/pureftpd-bf910line: Jan 7 14:20:06 ftpcdr pure-ftpd: (?@172.21.10.2) [INFO] user@test.com is now logged in11 ├ s00-raw12 | └ 🟢 crowdsecurity/syslog-logs (first_parser)13 ├ s01-parse14 | └ 🔴 fulljackz/pureftpd-logs15 └-------- parser failure 🔴1617line: Jan 7 14:19:31 ftpcdr pure-ftpd: (?@172.21.10.2) [WARNING] Authentication failed for user [root]18 ├ s00-raw19 | └ 🟢 crowdsecurity/syslog-logs (first_parser)20 ├ s01-parse21 | └ 🟢 fulljackz/pureftpd-logs (+6)22 ├-------- parser success 🟢23 ├ Scenarios24 └ 🟢 fulljackz/pureftpd-bf
1#debug: true2name: fulljackz/pureftpd-logs3description: "Parse pureftpd logs for bruteforce attempts"4filter: "evt.Parsed.program == 'pure-ftpd'"5onsuccess: next_stage6pattern_syntax:7 PFTPD_AUTH_FAIL: '\(?@%{IP:client_ip}\) \[WARNING\] Authentication failed for user \[%{WORD:user}\]'8nodes:9 - grok:10 name: "PFTPD_AUTH_FAIL"11 apply_on: message12 statics:13 - meta: log_type14 value: pftpd_failed-auth15 - meta: source_user16 expression: "evt.Parsed.user"17statics:18 - meta: service19 value: pureftpd20 - meta: source_ip21 expression: "evt.Parsed.client_ip"22