-
Notifications
You must be signed in to change notification settings - Fork 162
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add Audiobookshelf collection (#1153)
* Add Audiobookshelf collection * enhance: Add tests and extend parser to support non json output also * enhance: Since we are parsing the application logs we can be more restrictive on failed attempts * chore: run index workflow manually --------- Co-authored-by: Laurence <[email protected]>
- Loading branch information
1 parent
be8d557
commit 238067b
Showing
14 changed files
with
470 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,4 @@ | ||
| {"timestamp":"2024-11-13 09:07:04.784","source":"Auth.js:888","message":"[Auth] Failed login attempt for username \"test\" from ip 192.168.1.1 (Invalid password)","levelName":"ERROR","level":4} | ||
| {"timestamp":"2024-11-13 09:07:05.896","source":"Auth.js:888","message":"[Auth] Failed login attempt for username \"Hfhh\" from ip 192.168.1.1 (User not found)","levelName":"ERROR","level":4} | ||
| {"timestamp":"2024-11-13 09:07:07.896","source":"Auth.js:888","message":"[Auth] Failed login attempt for username \"Hfhh\" from ip 192.168.1.1 (User not found)","levelName":"ERROR","level":4} | ||
| {"timestamp":"2024-11-13 09:07:10.784","source":"Auth.js:888","message":"[Auth] Failed login attempt for username \"test\" from ip 192.168.1.1 (Invalid password)","levelName":"ERROR","level":4} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,12 @@ | ||
| parsers: | ||
| - crowdsecurity/syslog-logs | ||
| - crowdsecurity/dateparse-enrich | ||
| - ./parsers/s01-parse/PlagueDoctor/audiobookshelf-logs.yaml | ||
| scenarios: | ||
| - ./scenarios/PlagueDoctor/audiobookshelf-bf.yaml | ||
| postoverflows: | ||
| - "" | ||
| log_file: audiobookshelf.log | ||
| log_type: audiobookshelf | ||
| ignore_parsers: true | ||
|
|
Empty file.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,37 @@ | ||
| len(results) == 1 | ||
| "192.168.1.1" in results[0].Overflow.GetSources() | ||
| results[0].Overflow.Sources["192.168.1.1"].IP == "192.168.1.1" | ||
| results[0].Overflow.Sources["192.168.1.1"].Range == "" | ||
| results[0].Overflow.Sources["192.168.1.1"].GetScope() == "Ip" | ||
| results[0].Overflow.Sources["192.168.1.1"].GetValue() == "192.168.1.1" | ||
| results[0].Overflow.Alert.Events[0].GetMeta("datasource_path") == "audiobookshelf.log" | ||
| results[0].Overflow.Alert.Events[0].GetMeta("datasource_type") == "file" | ||
| results[0].Overflow.Alert.Events[0].GetMeta("log_type") == "abs_failed_auth" | ||
| results[0].Overflow.Alert.Events[0].GetMeta("service") == "audiobookshelf" | ||
| results[0].Overflow.Alert.Events[0].GetMeta("source_ip") == "192.168.1.1" | ||
| results[0].Overflow.Alert.Events[0].GetMeta("timestamp") == "2024-11-13T09:07:04.784Z" | ||
| results[0].Overflow.Alert.Events[0].GetMeta("username") == "test" | ||
| results[0].Overflow.Alert.Events[1].GetMeta("datasource_path") == "audiobookshelf.log" | ||
| results[0].Overflow.Alert.Events[1].GetMeta("datasource_type") == "file" | ||
| results[0].Overflow.Alert.Events[1].GetMeta("log_type") == "abs_failed_auth" | ||
| results[0].Overflow.Alert.Events[1].GetMeta("service") == "audiobookshelf" | ||
| results[0].Overflow.Alert.Events[1].GetMeta("source_ip") == "192.168.1.1" | ||
| results[0].Overflow.Alert.Events[1].GetMeta("timestamp") == "2024-11-13T09:07:05.896Z" | ||
| results[0].Overflow.Alert.Events[1].GetMeta("username") == "Hfhh" | ||
| results[0].Overflow.Alert.Events[2].GetMeta("datasource_path") == "audiobookshelf.log" | ||
| results[0].Overflow.Alert.Events[2].GetMeta("datasource_type") == "file" | ||
| results[0].Overflow.Alert.Events[2].GetMeta("log_type") == "abs_failed_auth" | ||
| results[0].Overflow.Alert.Events[2].GetMeta("service") == "audiobookshelf" | ||
| results[0].Overflow.Alert.Events[2].GetMeta("source_ip") == "192.168.1.1" | ||
| results[0].Overflow.Alert.Events[2].GetMeta("timestamp") == "2024-11-13T09:07:07.896Z" | ||
| results[0].Overflow.Alert.Events[2].GetMeta("username") == "Hfhh" | ||
| results[0].Overflow.Alert.Events[3].GetMeta("datasource_path") == "audiobookshelf.log" | ||
| results[0].Overflow.Alert.Events[3].GetMeta("datasource_type") == "file" | ||
| results[0].Overflow.Alert.Events[3].GetMeta("log_type") == "abs_failed_auth" | ||
| results[0].Overflow.Alert.Events[3].GetMeta("service") == "audiobookshelf" | ||
| results[0].Overflow.Alert.Events[3].GetMeta("source_ip") == "192.168.1.1" | ||
| results[0].Overflow.Alert.Events[3].GetMeta("timestamp") == "2024-11-13T09:07:10.784Z" | ||
| results[0].Overflow.Alert.Events[3].GetMeta("username") == "test" | ||
| results[0].Overflow.Alert.GetScenario() == "PlagueDoctor/audiobookshelf-bf" | ||
| results[0].Overflow.Alert.Remediation == true | ||
| results[0].Overflow.Alert.GetEventsCount() == 4 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,7 @@ | ||
| {"timestamp":"2024-11-13 11:03:31.784","source":"Auth.js:888","message":"[Auth] Failed login attempt for username \"test\" from ip 192.168.1.1 (Invalid password)","levelName":"ERROR","level":4} | ||
| {"timestamp":"2024-11-13 09:07:05.896","source":"Auth.js:888","message":"[Auth] Failed login attempt for username \"Hfhh\" from ip 192.168.1.1 (User not found)","levelName":"ERROR","level":4} | ||
| {"timestamp":"2024-11-13 09:07:17.741","source":"Auth.js:888","message":"[Auth] Failed login attempt for username \"Hfhh\" from ip 192.168.1.1 (User not found)","levelName":"ERROR","level":4} | ||
| {"timestamp":"2024-11-13 11:03:31.784","source":"Auth.js:888","message":"[Auth] Failed login attempt for username \"test\" from ip 192.168.1.1 (Invalid password)","levelName":"ERROR","level":4} | ||
| [2024-11-13 09:54:35.882] ERROR: [Auth] Failed login attempt for username "fooobar" from ip ::1 (User not found) (Auth.js:888) | ||
| [2024-10-20 17:48:07.192] INFO: [Auth] User "test" logged in from ip 192.168.1.1 | ||
| {"timestamp":"2024-11-13 11:03:31.784","source":"Auth.js:888","message":"[Auth] User \"test\" logged in from ip 192.168.1.1","levelName":"INFO","level":1} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,10 @@ | ||
| parsers: | ||
| - crowdsecurity/syslog-logs | ||
| - crowdsecurity/dateparse-enrich | ||
| - ./parsers/s01-parse/PlagueDoctor/audiobookshelf-logs.yaml | ||
| scenarios: | ||
| - "" | ||
| postoverflows: | ||
| - "" | ||
| log_file: audiobookshelf.log | ||
| log_type: audiobookshelf |
Oops, something went wrong.