A collection to defend MongoDB against common attacks:

• MongoDB parser
• MongoDB brute-force & enumeration detection

MongoDB version 4.4 or higher is required.

Acquisition template

Example acquisition for a docker container:

1---
2source: docker
3container_name:
4 - my_container_name
5labels:
6  type: mongodb

or for a log file:

1---
2filenames:
3 - /var/log/mongodb/mongodb.log
4labels:
5  type: mongodb

Depending on your installation method, paths to log files might change.