sshesame-logs Log Parser by thespad | CrowdSec Hub

sshesame-logs

Log parser

By: thespad
Version: 0.2

Parse sshesame logs

Install with a top-level collection

1 collection include it

sudo cscli collections install thespad/sshesame

Installs 2 parsers and 1 scenario.

View SSHesame - Honeypot Protection →

Installation

sudo cscli parsers install thespad/sshesame-logs

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

parsers/s01-parse/thespad/sshesame-logs.yaml· 52 linesGitHub

1onsuccess: next_stage1
2filter: "evt.Parsed.program == 'sshesame'"2
3name: thespad/sshesame-logs
4description: "Parse sshesame logs"
5pattern_syntax:3
6  SSHESAME_TIMESTAMP: '%{DATE_X} %{TIME}'
7  SSHESAME_LOGIN_PASSWD: '%{SSHESAME_TIMESTAMP:timestamp} \[%{IP:source_ip}:\d+\] authentication for user "%{USERNAME:sshesame_user}" with password "%{GREEDYDATA:sshesame_password}" accepted'
8  SSHESAME_LOGIN_PUBKEY: '%{SSHESAME_TIMESTAMP:timestamp} \[%{IP:source_ip}:\d+\] authentication for user "%{USERNAME:sshesame_user}" with public key "%{GREEDYDATA:sshesame_pubkey}" accepted'
9  SSHESAME_CMD: '%{SSHESAME_TIMESTAMP:timestamp} \[%{IP:source_ip}:\d+\] \[channel \d+\] command "%{GREEDYDATA:sshesame_cmd}" requested'
10  SSHESAME_INPUT: '%{SSHESAME_TIMESTAMP:timestamp} \[%{IP:source_ip}:\d+\] \[channel \d+\] input: "%{GREEDYDATA:sshesame_input}"'
11nodes:4
12  - grok:5
13      name: "SSHESAME_LOGIN_PASSWD"
14      apply_on: message
15      statics:6
16        - meta: log_type
17          value: sshesame_login
18        - meta: target_user
19          expression: "evt.Parsed.sshesame_user"
20  - grok:5
21      name: "SSHESAME_LOGIN_PUBKEY"
22      apply_on: message
23      statics:6
24        - meta: log_type
25          value: sshesame_login
26        - meta: target_user
27          expression: "evt.Parsed.sshesame_user"
28  - grok:5
29      name: "SSHESAME_CMD"
30      apply_on: message
31      statics:6
32        - meta: log_type
33          value: sshesame_cmd
34  - grok:5
35      name: "SSHESAME_INPUT"
36      apply_on: message
37      statics:6
38        - meta: log_type
39          value: sshesame_input
40statics:

Installed on

Know where it runs

Documentation

sshesame parser

A parser for sshesame honeypot logs.

Acquisition template

Example acquisition for this collection :

1filenames:
2  - /var/log/sshesame.log
3labels:
4  type: sshesame