Comments (2)
Hello @ririsoft ,
If i understand correctly the issue, you would prefer to groupby
ip:port
instead of only ip
?
Cheers.
from hub.
Hello @AlteredCoder ,
Grouping by ip
is totally fine. I would prefer a grouping by "evt.Meta.source_ip + '/' + %HOST%
.
But looking further into this I believe the issue is on my side, sorry.
Indeed I have a custom apache log parsing:
#/etc/crowdsec/config/parsers/s01-parse/apache2-logs.yaml
#Apache access logs
#debug: true
filter: "evt.Parsed.program startsWith 'apache2'"
onsuccess: next_stage
name: crowdsecurity/apache2-logs
description: "Parse Apache2 access and error logs"
#log line can be prefixed by a target_fqdn
grok:
#pattern: '(%{IPORHOST:target_fqdn} )?%{COMMONAPACHELOG} %{QS:referrer} %{QS:agent}'
pattern: '(%{URIHOST:target_fqdn} )?%{COMMONAPACHELOG} %{POSINT} %{POSINT} %{QS:referrer} %{QS:agent}'
apply_on: message
# these ones apply for both grok patterns
statics:
- meta: log_type
value: http_access-log
- target: evt.StrTime
expression: evt.Parsed.timestamp
- meta: service
value: http
- meta: source_ip
expression: evt.Parsed.clientip
- meta: http_status
expression: evt.Parsed.response
- meta: http_path
expression: evt.Parsed.request
I needed to have this to catch the port part with the IP, which is not caugh by the partern %{IPORHOST:target_fqdn}
used by crowdsec by default. However my pattern aggregate the IP and PORT together in the target fqdn which is a mistake. I am going to replace it with something else like %{IPORHOST:target_fqdn}(?::%{POSINT:port})?
.
I am closing this, since this is due to my personal settings. I am really sorry for the false issue :(
from hub.
Related Issues (20)
- [http-logs] Should check for HTTP verb?
- ssh-bf are not detected when AllowUsers are defined HOT 1
- [nextcloud-whitelist] Not fully working with HAProxy because of http_verb HOT 1
- http-probing - Nextcloud false positive HOT 2
- [hub-linter] Prevent WAN IPs in tests
- [endlessh] Add endlessh-go compatbility to parser HOT 1
- Update modsecurity.yaml to expect 'client:' OR 'remote:' in APACHEERRORPREFIX2: HOT 7
- babbar !? HOT 2
- Jellyfin parser not working HOT 2
- Extend Odoo collection
- Incorrect regular expression in crowdsecurity/exim-logs HOT 2
- Add http_referer to the http_base.yaml context HOT 3
- [UnmarshalJSON] check if line startsWith `{` HOT 1
- crowdsecurity/nginx-proxy-manager-logs parser failure HOT 2
- Vaultwarden parser doesn't handle time zones HOT 2
- Personal Git repo support? HOT 2
- False positive http-crawl-non_statics with Nextcloud Deck mobile app HOT 7
- Whitelist Good Actors - WP Rocket HOT 1
- Caddy Log Parser : client ip is not parsed HOT 1
- New version of OWASP CRS breaks the Modsecurity parser HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from hub.