/home/ubuntu/crowdsec-v1.6.8/tests/hub/parsers/s00-raw/crowdsecurity/s00-unifi-firewall.yaml
name: crowdsecurity/udmp-firewall-raw
description: "Parse Ubiquiti UDMP firewall log lines in syslog format"
stage: s00-raw
filter: "evt.Parsed.program == ''" # Optionally refine this
pattern_syntax:
MAC: "[0-9a-f]{2}(:[0-9a-f]{2}){5}(,[0-9a-f]{2}(:[0-9a-f]{2}){5})*"
nodes:
- grok:
pattern: |
%{SYSLOGTIMESTAMP:log_ts} %{DATA:host} \[%{DATA:fw_rule}\] DESCR=\"%{DATA:fw_descr}\" IN=%{WORD:in_iface} OUT=%{WORD:out_iface} MAC=%{MAC:mac} SRC=%{IPV4:src_ip} DST=%{IPV4:dst_ip} LEN=%{INT:len1} TOS=%{DATA:tos} PREC=%{DATA:prec} TTL=%{INT:ttl} ID=%{INT:id} PROTO=%{WORD:proto} SPT=%{INT:src_port} DPT=%{INT:dst_port} LEN=%{INT:len2} MARK=%{DATA:mark}
apply_on: message
statics:
- meta: service
value: "udmp-firewall"
- target: evt.Time
expression: "evt.Parsed.log_ts"
- target: evt.Parsed.source_ip
expression: "evt.Parsed.src_ip"
- target: evt.Parsed.destination_ip
expression: "evt.Parsed.dst_ip"
- target: evt.Parsed.source_port
expression: "evt.Parsed.src_port"
- target: evt.Parsed.destination_port
expression: "evt.Parsed.dst_port"
- target: evt.Parsed.proto
expression: "evt.Parsed.proto"
- target: evt.StrTime
expression: evt.Parsed.log_ts
/home/ubuntu/crowdsec-v1.6.8/tests/hub/parsers/s00-raw/crowdsecurity/s00-unifi-firewall.yaml
name: crowdsecurity/udmp-firewall-raw
description: "Parse Ubiquiti UDMP firewall log lines in syslog format"
stage: s00-raw
filter: "evt.Parsed.program == ''" # Optionally refine this
pattern_syntax:
MAC: "[0-9a-f]{2}(:[0-9a-f]{2}){5}(,[0-9a-f]{2}(:[0-9a-f]{2}){5})*"
nodes:
- grok:
pattern: |
%{SYSLOGTIMESTAMP:log_ts} %{DATA:host} \[%{DATA:fw_rule}\] DESCR=\"%{DATA:fw_descr}\" IN=%{WORD:in_iface} OUT=%{WORD:out_iface} MAC=%{MAC:mac} SRC=%{IPV4:src_ip} DST=%{IPV4:dst_ip} LEN=%{INT:len1} TOS=%{DATA:tos} PREC=%{DATA:prec} TTL=%{INT:ttl} ID=%{INT:id} PROTO=%{WORD:proto} SPT=%{INT:src_port} DPT=%{INT:dst_port} LEN=%{INT:len2} MARK=%{DATA:mark}
apply_on: message
statics:
- meta: service
value: "udmp-firewall"
- target: evt.Time
expression: "evt.Parsed.log_ts"
- target: evt.Parsed.source_ip
expression: "evt.Parsed.src_ip"
- target: evt.Parsed.destination_ip
expression: "evt.Parsed.dst_ip"
- target: evt.Parsed.source_port
expression: "evt.Parsed.src_port"
- target: evt.Parsed.destination_port
expression: "evt.Parsed.dst_port"
- target: evt.Parsed.proto
expression: "evt.Parsed.proto"
- target: evt.StrTime
expression: evt.Parsed.log_ts