1onsuccess: next_stage
2filter: "evt.Parsed.program == 'fireflyiii'"
3name: vspaziani/fireflyiii
4description: "Parse fireflyiii logs"
5pattern_syntax:
6 FIREFLYIII_CUSTOMDATE: '%{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{HOUR}:%{MINUTE}:%{SECOND}'
7
8 FIREFLYIII_BADPASSWORD: '\[%{FIREFLYIII_CUSTOMDATE:event_timestamp}\].*Login failed. Attempt for user "%{EMAILADDRESS:user}" failed. \(%{IP:source_ip}.*'
9
10 FIREFLYIII_BADUSER: '\[%{FIREFLYIII_CUSTOMDATE:event_timestamp}\].*AUDIT: User is trying to login using "%{EMAILADDRESS:user}" \(%{IP:source_ip}.*'
11
12 FIREFLYIII_BADMFA: '\[%{FIREFLYIII_CUSTOMDATE:event_timestamp}\].*AUDIT: MFA failure count is set to %{NUMBER:mfa_fail_count}. \(%{IP:source_ip} \(%{EMAILADDRESS:user}.*'
13
14nodes:
15 - grok:
16 name: "FIREFLYIII_BADPASSWORD"
17 apply_on: message
18 statics:
19 - meta: log_type
20 value: fireflyiii_bad_password
21 - grok:
22 name: "FIREFLYIII_BADUSER"
23 apply_on: message
24 statics:
25 - meta: log_type
26 value: fireflyiii_bad_user
27 - grok:
28 name: "FIREFLYIII_BADMFA"
29 apply_on: message
30 statics:
31 - meta: log_type
32 value: fireflyiii_bad_mfa
33 - meta: mfa_count
34 expression: evt.Parsed.mfa_fail_count
35statics:
36 - meta: service
37 value: fireflyiii
38 - meta: username
39 expression: evt.Parsed.user
40 - meta: source_ip
41 expression: "evt.Parsed.source_ip"
42 - target: evt.StrTimeFormat
43 value: "2006-01-02 15:04:05"
44 - target: evt.StrTime
45 expression: evt.Parsed.event_timestamp
46
