committing changes in /etc made by "-bash"
Package changes:
This commit is contained in:
33
crowdsec/hub/parsers/s02-enrich/crowdsecurity/http-logs.yaml
Normal file
33
crowdsec/hub/parsers/s02-enrich/crowdsecurity/http-logs.yaml
Normal file
@@ -0,0 +1,33 @@
|
||||
filter: "evt.Meta.service == 'http' && evt.Meta.log_type in ['http_access-log', 'http_error-log']"
|
||||
description: "Parse more Specifically HTTP logs, such as HTTP Code, HTTP path, HTTP args and if its a static ressource"
|
||||
name: crowdsecurity/http-logs
|
||||
pattern_syntax:
|
||||
DIR: "^.*/"
|
||||
FILE: "[^/].*?"
|
||||
EXT: "\\.[^.]*$|$"
|
||||
nodes:
|
||||
- statics:
|
||||
- parsed: "impact_completion"
|
||||
# the value of a field can as well be determined as the result of an expression
|
||||
expression: "evt.Meta.http_status in ['404', '403', '502'] ? 'false' : 'true'"
|
||||
- target: evt.Parsed.static_ressource
|
||||
value: 'false'
|
||||
# let's split the path?query if possible
|
||||
- grok:
|
||||
pattern: "^%{GREEDYDATA:request}\\?%{GREEDYDATA:http_args}$"
|
||||
apply_on: request
|
||||
# this is another node, with its own pattern_syntax
|
||||
- #debug: true
|
||||
grok:
|
||||
pattern: "%{DIR:file_dir}(%{FILE:file_frag}%{EXT:file_ext})?"
|
||||
apply_on: request
|
||||
statics:
|
||||
- meta: http_path
|
||||
expression: "evt.Parsed.http_path"
|
||||
# meta af
|
||||
- meta: http_args_len
|
||||
expression: "len(evt.Parsed.http_args)"
|
||||
- parsed: file_name
|
||||
expression: evt.Parsed.file_frag + evt.Parsed.file_ext
|
||||
- parsed: static_ressource
|
||||
expression: "Upper(evt.Parsed.file_ext) in ['.JPG', '.CSS', '.JS', '.JPEG', '.PNG', '.SVG', '.MAP', '.ICO', '.OTF', '.GIF', '.MP3', '.MP4', '.WOFF', '.WOFF2', '.TTF', '.OTF', '.EOT', '.WEBP', '.WAV', '.GZ', '.BROTLI', '.BVR', '.TS', '.BMP'] ? 'true' : 'false'"
|
||||
Reference in New Issue
Block a user