apereo-cas-audit-logs

1onsuccess: next_stage1
2#debug: true
3filter: "evt.Parsed.program == 'cas'"2
4name: jusabatier/apereo-cas-audit-logs
5description: "Parse apereo CAS Audits logs"
6pattern_syntax:3
7# The IP grok pattern that ships with crowdsec is buggy and does not capture the last digit of an IP if it is the last thing it matches, and the last octet starts with a 2
8# https://github.com/crowdsecurity/crowdsec/issues/938
9  IPv4_WORKAROUND: (?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)
10  IP_WORKAROUND: (?:%{IPV6}|%{IPv4_WORKAROUND})
11  SECOND_WORKAROUND: '(?:[0-5]?[0-9]|60)?'
12  TIMESTAMP_WORKAROUND: '%{YEAR}-%{MONTHNUM}-%{MONTHDAY}[T ]%{HOUR}:?%{MINUTE}(?::?%{SECOND_WORKAROUND})?%{ISO8601_TIMEZONE}?'
13  CAS_AUTH_FAIL: '^%{TIMESTAMP_WORKAROUND:time}(?:,\d+)? %{LOGLEVEL:loglevel} \[%{DATA:threadname}\] - (.*)\|CAS\|(.*)\|AUTHENTICATION_FAILED\|%{USERNAME:cas_invalid_user}\|%{IP_WORKAROUND:cas_client_ip}\|(.*)$'
14  # CAS v7: <timestamp|user|details|AUTHENTICATION_FAILED|client_ip|server_ip|>
15  CAS_V7_AUTH_FAIL: '^%{TIMESTAMP_WORKAROUND:time}(?:,\d+)? %{LOGLEVEL:loglevel} \[%{DATA:threadname}\] - <[^|]+\|%{USERNAME:cas_invalid_user}\|[^|]+\|AUTHENTICATION_FAILED\|%{IP_WORKAROUND:cas_client_ip}\|'
16nodes:4
17  - grok: 5
18      name: "CAS_AUTH_FAIL"
19      apply_on: message
20      statics:6
21        - meta: log_type
22          value: cas_failed-auth
23        - meta: target_user
24          expression: "evt.Parsed.cas_invalid_user"
25        - target: evt.StrTime
26          expression: evt.Parsed.time
27  - grok:5
28      name: "CAS_V7_AUTH_FAIL"
29      apply_on: message
30      statics:6
31        - meta: log_type
32          value: cas_failed-auth
33        - meta: target_user
34          expression: "evt.Parsed.cas_invalid_user"
35        - target: evt.StrTime
36          expression: evt.Parsed.time
37statics:
38    - meta: service
39      value: cas
40    - meta: source_ip