apereo-cas-audit-logs Log Parser by jusabatier

Name: apereo-cas-audit-logs
Author: jusabatier

Use Apereo CAS audit logs : https://apereo.github.io/cas/6.4.x/audits/Audits-File.html

Need to :

ativate cas.audit.slf4j.use-single-line=true in CAS configuration
add cas_audit.log generated file to CrowdSec acquisitions

Sample log4j config :

1[...]
2        <RollingFile name="auditlogfile" fileName="${baseDir}/cas_audit.log" append="true"
3                     filePattern="${baseDir}/cas_audit-%d{yyyy-MM-dd-HH}-%i.log">
4            <PatternLayout pattern="%d %p [%c] - %m%n"/>
5            <Policies>
6                <OnStartupTriggeringPolicy />
7                <SizeBasedTriggeringPolicy size="10 MB"/>
8                <TimeBasedTriggeringPolicy />
9            </Policies>
10        </RollingFile>
11
12        <CasAppender name="casAudit">
13            <AppenderRef ref="auditlogfile" />
14        </CasAppender>
15[...]
16        <AsyncLogger name="org.apereo.inspektr.audit.support" level="info" includeLocation="true" >
17            <AppenderRef ref="casAudit"/>
18        </AsyncLogger>
19[...]

1onsuccess: next_stage

2#debug: true

3filter: "evt.Parsed.program == 'cas'"

4name: jusabatier/apereo-cas-audit-logs

5description: "Parse apereo CAS Audits logs"

6pattern_syntax:

7# The IP grok pattern that ships with crowdsec is buggy and does not capture the last digit of an IP if it is the last thing it matches, and the last octet starts with a 2

8# https://github.com/crowdsecurity/crowdsec/issues/938

9 IPv4_WORKAROUND: (?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)

10 IP_WORKAROUND: (?:%{IPV6}|%{IPv4_WORKAROUND})

11 SECOND_WORKAROUND: '(?:[0-5]?[0-9]|60)?'

12 TIMESTAMP_WORKAROUND: '%{YEAR}-%{MONTHNUM}-%{MONTHDAY}[T ]%{HOUR}:?%{MINUTE}(?::?%{SECOND_WORKAROUND})?%{ISO8601_TIMEZONE}?'

13 CAS_AUTH_FAIL: '^%{TIMESTAMP_WORKAROUND:time}(?:,\d+)? %{LOGLEVEL:loglevel} \[%{DATA:threadname}\] - (.*)\|CAS\|(.*)\|AUTHENTICATION_FAILED\|%{USERNAME:cas_invalid_user}\|%{IP_WORKAROUND:cas_client_ip}\|(.*)$'

14nodes:

15 - grok:

16 name: "CAS_AUTH_FAIL"

17 apply_on: message

18 statics:

19 - meta: log_type

20 value: cas_failed-auth

21 - meta: target_user

22 expression: "evt.Parsed.cas_invalid_user"

23 - target: evt.StrTime

24 expression: evt.Parsed.time

25statics:

26 - meta: service

27 value: cas

28 - meta: source_ip

29 expression: "evt.Parsed.cas_client_ip"

Hub configuration

« apereo-cas-audit-logs »
v0.2 by jusabatier
Attack scenario

Hub configuration

« apereo-cas-audit-logs »v0.2 by jusabatierAttack scenario

« apereo-cas-audit-logs »
v0.2 by jusabatier
Attack scenario