cscli parsers install plague-doctor/sharry-logsA parser that will search for unauthorized access to Sharry.
Example acquisition for this collection:
1---2filenames:3 - /var/log/sharry/*.log4labels:5 type: sharry
1onsuccess: next_stage2#debug: true3filter: "Upper(evt.Parsed.program) == 'SHARRY'"4name: plague-doctor/sharry-logs5description: "Parse Sharry logs"6pattern_syntax:7 SHARRY_DATE: "%{YEAR}\\.%{MONTHNUM2}\\.%{MONTHDAY} %{TIME}:%{INT}"8 SHARRY_THREAD: "\\[%{DATA:thread}\\]"9 SHARRY_LEVEL: "\\[%{LOGLEVEL:level}\\s*\\]"10 SHARRY_CLASS: "%{JAVACLASS:class}:%{INT:line}"11nodes:12 - grok:13 pattern: "^%{SHARRY_DATE:timestamp} %{SHARRY_THREAD} %{SHARRY_LEVEL} %{SHARRY_CLASS} - Authentication attempt failure for username %{USERNAME:username} from ip %{IP:source_ip}"14 apply_on: message15 statics:16 - meta: log_type17 value: sharry_failed_auth18statics:19 - meta: service20 value: sharry21 - meta: source_ip22 expression: "evt.Parsed.source_ip"23 - target: evt.StrTimeFormat24 value: "2006.01.02 15:04:05:0000 -0700"25 - target: evt.StrTime26 expression: evt.Parsed.timestamp + " +0000"27 - meta: username28 expression: "evt.Parsed.username"29