Skip to content

Commit

Permalink
Merge branch 'crowdsecurity:master' into master
Browse files Browse the repository at this point in the history
  • Loading branch information
@GNU-Plus-Windows-User
GNU-Plus-Windows-User authored Sep 26, 2023
2 parents 6df2690 + 8b1a500 commit d3e33da
Show file tree
Hide file tree
Showing 16 changed files with 652 additions and 430 deletions.
69 changes: 57 additions & 12 deletions .index.json
View file

Large diffs are not rendered by default.

3 changes: 2 additions & 1 deletion .tests/immich-logs/immich-logs.log
View file
Original file line number Diff line number Diff line change
@@ -1,3 +1,4 @@
[Nest] 7 - 08/02/2023, 7:32:47 PM WARN [AuthService] Failed login attempt for user [email protected] from ip address 192.168.0.254
[Nest] 7 - 08/02/2023, 7:34:03 PM WARN [AuthService] Failed login attempt for user [email protected] from ip address 176.172.44.211
[Nest] 7 - 08/02/2023, 7:34:03 WARN [AuthService] Failed login attempt for user [email protected] from ip address 176.172.44.212
[Nest] 7 - 08/02/2023, 7:34:03 WARN [AuthService] Failed login attempt for user [email protected] from ip address 176.172.44.212
\x1b[33m[Nest] 6 - \x1b[39m08/04/2023, 8:47:38 PM \x1b[33m WARN\x1b[39m \x1b[38;5;3m[AuthService] \x1b[39m\x1b[33mFailed login attempt for user [email protected] from ip address 176.171.169.54\x1b
62 changes: 47 additions & 15 deletions .tests/immich-logs/parser.assert
View file
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
len(results) == 4
len(results["s00-raw"]["crowdsecurity/non-syslog"]) == 3
len(results["s00-raw"]["crowdsecurity/non-syslog"]) == 4
results["s00-raw"]["crowdsecurity/non-syslog"][0].Success == true
results["s00-raw"]["crowdsecurity/non-syslog"][0].Evt.Parsed["message"] == "[Nest] 7 - 08/02/2023, 7:32:47 PM WARN [AuthService] Failed login attempt for user [email protected] from ip address 192.168.0.254"
results["s00-raw"]["crowdsecurity/non-syslog"][0].Evt.Parsed["program"] == "immich"
Expand All @@ -15,88 +15,120 @@ results["s00-raw"]["crowdsecurity/non-syslog"][2].Evt.Parsed["message"] == "[Nes
results["s00-raw"]["crowdsecurity/non-syslog"][2].Evt.Parsed["program"] == "immich"
results["s00-raw"]["crowdsecurity/non-syslog"][2].Evt.Meta["datasource_path"] == "immich-logs.log"
results["s00-raw"]["crowdsecurity/non-syslog"][2].Evt.Meta["datasource_type"] == "file"
len(results["s00-raw"]["crowdsecurity/syslog-logs"]) == 3
results["s00-raw"]["crowdsecurity/non-syslog"][3].Success == true
results["s00-raw"]["crowdsecurity/non-syslog"][3].Evt.Parsed["program"] == "immich"
results["s00-raw"]["crowdsecurity/non-syslog"][3].Evt.Parsed["message"] == "\\x1b[33m[Nest] 6 - \\x1b[39m08/04/2023, 8:47:38 PM \\x1b[33m WARN\\x1b[39m \\x1b[38;5;3m[AuthService] \\x1b[39m\\x1b[33mFailed login attempt for user [email protected] from ip address 176.171.169.54\\x1b"
results["s00-raw"]["crowdsecurity/non-syslog"][3].Evt.Meta["datasource_path"] == "immich-logs.log"
results["s00-raw"]["crowdsecurity/non-syslog"][3].Evt.Meta["datasource_type"] == "file"
len(results["s00-raw"]["crowdsecurity/syslog-logs"]) == 4
results["s00-raw"]["crowdsecurity/syslog-logs"][0].Success == false
results["s00-raw"]["crowdsecurity/syslog-logs"][1].Success == false
results["s00-raw"]["crowdsecurity/syslog-logs"][2].Success == false
len(results["s01-parse"]["gauth-fr/immich-logs"]) == 3
results["s00-raw"]["crowdsecurity/syslog-logs"][3].Success == false
len(results["s01-parse"]["gauth-fr/immich-logs"]) == 4
results["s01-parse"]["gauth-fr/immich-logs"][0].Success == true
results["s01-parse"]["gauth-fr/immich-logs"][0].Evt.Parsed["source_ip"] == "192.168.0.254"
results["s01-parse"]["gauth-fr/immich-logs"][0].Evt.Parsed["timestamp"] == "08/02/2023, 7:32:47 PM"
results["s01-parse"]["gauth-fr/immich-logs"][0].Evt.Parsed["username"] == "[email protected]"
results["s01-parse"]["gauth-fr/immich-logs"][0].Evt.Parsed["message"] == "[Nest] 7 - 08/02/2023, 7:32:47 PM WARN [AuthService] Failed login attempt for user [email protected] from ip address 192.168.0.254"
results["s01-parse"]["gauth-fr/immich-logs"][0].Evt.Parsed["program"] == "immich"
results["s01-parse"]["gauth-fr/immich-logs"][0].Evt.Parsed["source_ip"] == "192.168.0.254"
results["s01-parse"]["gauth-fr/immich-logs"][0].Evt.Meta["datasource_path"] == "immich-logs.log"
results["s01-parse"]["gauth-fr/immich-logs"][0].Evt.Meta["datasource_type"] == "file"
results["s01-parse"]["gauth-fr/immich-logs"][0].Evt.Meta["log_type"] == "immich_failed_auth"
results["s01-parse"]["gauth-fr/immich-logs"][0].Evt.Meta["service"] == "immich"
results["s01-parse"]["gauth-fr/immich-logs"][0].Evt.Meta["source_ip"] == "192.168.0.254"
results["s01-parse"]["gauth-fr/immich-logs"][0].Evt.Meta["user"] == "[email protected]"
results["s01-parse"]["gauth-fr/immich-logs"][0].Evt.Meta["datasource_path"] == "immich-logs.log"
results["s01-parse"]["gauth-fr/immich-logs"][1].Success == true
results["s01-parse"]["gauth-fr/immich-logs"][1].Evt.Parsed["source_ip"] == "176.172.44.211"
results["s01-parse"]["gauth-fr/immich-logs"][1].Evt.Parsed["timestamp"] == "08/02/2023, 7:34:03 PM"
results["s01-parse"]["gauth-fr/immich-logs"][1].Evt.Parsed["username"] == "[email protected]"
results["s01-parse"]["gauth-fr/immich-logs"][1].Evt.Parsed["message"] == "[Nest] 7 - 08/02/2023, 7:34:03 PM WARN [AuthService] Failed login attempt for user [email protected] from ip address 176.172.44.211"
results["s01-parse"]["gauth-fr/immich-logs"][1].Evt.Parsed["program"] == "immich"
results["s01-parse"]["gauth-fr/immich-logs"][1].Evt.Meta["datasource_type"] == "file"
results["s01-parse"]["gauth-fr/immich-logs"][1].Evt.Meta["log_type"] == "immich_failed_auth"
results["s01-parse"]["gauth-fr/immich-logs"][1].Evt.Meta["service"] == "immich"
results["s01-parse"]["gauth-fr/immich-logs"][1].Evt.Meta["source_ip"] == "176.172.44.211"
results["s01-parse"]["gauth-fr/immich-logs"][1].Evt.Meta["user"] == "[email protected]"
results["s01-parse"]["gauth-fr/immich-logs"][1].Evt.Meta["datasource_path"] == "immich-logs.log"
results["s01-parse"]["gauth-fr/immich-logs"][1].Evt.Meta["datasource_type"] == "file"
results["s01-parse"]["gauth-fr/immich-logs"][1].Evt.Meta["log_type"] == "immich_failed_auth"
results["s01-parse"]["gauth-fr/immich-logs"][1].Evt.Meta["service"] == "immich"
results["s01-parse"]["gauth-fr/immich-logs"][2].Success == true
results["s01-parse"]["gauth-fr/immich-logs"][2].Evt.Parsed["program"] == "immich"
results["s01-parse"]["gauth-fr/immich-logs"][2].Evt.Parsed["source_ip"] == "176.172.44.212"
results["s01-parse"]["gauth-fr/immich-logs"][2].Evt.Parsed["timestamp"] == "08/02/2023, 7:34:03"
results["s01-parse"]["gauth-fr/immich-logs"][2].Evt.Parsed["username"] == "[email protected]"
results["s01-parse"]["gauth-fr/immich-logs"][2].Evt.Parsed["message"] == "[Nest] 7 - 08/02/2023, 7:34:03 WARN [AuthService] Failed login attempt for user [email protected] from ip address 176.172.44.212"
results["s01-parse"]["gauth-fr/immich-logs"][2].Evt.Parsed["program"] == "immich"
results["s01-parse"]["gauth-fr/immich-logs"][2].Evt.Meta["datasource_path"] == "immich-logs.log"
results["s01-parse"]["gauth-fr/immich-logs"][2].Evt.Meta["datasource_type"] == "file"
results["s01-parse"]["gauth-fr/immich-logs"][2].Evt.Meta["log_type"] == "immich_failed_auth"
results["s01-parse"]["gauth-fr/immich-logs"][2].Evt.Meta["service"] == "immich"
results["s01-parse"]["gauth-fr/immich-logs"][2].Evt.Meta["source_ip"] == "176.172.44.212"
results["s01-parse"]["gauth-fr/immich-logs"][2].Evt.Meta["user"] == "[email protected]"
len(results["s02-enrich"]["crowdsecurity/dateparse-enrich"]) == 3
results["s01-parse"]["gauth-fr/immich-logs"][3].Success == true
results["s01-parse"]["gauth-fr/immich-logs"][3].Evt.Parsed["username"] == "[email protected]"
results["s01-parse"]["gauth-fr/immich-logs"][3].Evt.Parsed["message"] == "\\x1b[33m[Nest] 6 - \\x1b[39m08/04/2023, 8:47:38 PM \\x1b[33m WARN\\x1b[39m \\x1b[38;5;3m[AuthService] \\x1b[39m\\x1b[33mFailed login attempt for user [email protected] from ip address 176.171.169.54\\x1b"
results["s01-parse"]["gauth-fr/immich-logs"][3].Evt.Parsed["program"] == "immich"
results["s01-parse"]["gauth-fr/immich-logs"][3].Evt.Parsed["source_ip"] == "176.171.169.54"
results["s01-parse"]["gauth-fr/immich-logs"][3].Evt.Parsed["timestamp"] == "08/04/2023, 8:47:38 PM"
results["s01-parse"]["gauth-fr/immich-logs"][3].Evt.Meta["datasource_path"] == "immich-logs.log"
results["s01-parse"]["gauth-fr/immich-logs"][3].Evt.Meta["datasource_type"] == "file"
results["s01-parse"]["gauth-fr/immich-logs"][3].Evt.Meta["log_type"] == "immich_failed_auth"
results["s01-parse"]["gauth-fr/immich-logs"][3].Evt.Meta["service"] == "immich"
results["s01-parse"]["gauth-fr/immich-logs"][3].Evt.Meta["source_ip"] == "176.171.169.54"
results["s01-parse"]["gauth-fr/immich-logs"][3].Evt.Meta["user"] == "[email protected]"
len(results["s02-enrich"]["crowdsecurity/dateparse-enrich"]) == 4
results["s02-enrich"]["crowdsecurity/dateparse-enrich"][0].Success == true
results["s02-enrich"]["crowdsecurity/dateparse-enrich"][0].Evt.Parsed["message"] == "[Nest] 7 - 08/02/2023, 7:32:47 PM WARN [AuthService] Failed login attempt for user [email protected] from ip address 192.168.0.254"
results["s02-enrich"]["crowdsecurity/dateparse-enrich"][0].Evt.Parsed["program"] == "immich"
results["s02-enrich"]["crowdsecurity/dateparse-enrich"][0].Evt.Parsed["source_ip"] == "192.168.0.254"
results["s02-enrich"]["crowdsecurity/dateparse-enrich"][0].Evt.Parsed["timestamp"] == "08/02/2023, 7:32:47 PM"
results["s02-enrich"]["crowdsecurity/dateparse-enrich"][0].Evt.Parsed["username"] == "[email protected]"
results["s02-enrich"]["crowdsecurity/dateparse-enrich"][0].Evt.Meta["user"] == "[email protected]"
results["s02-enrich"]["crowdsecurity/dateparse-enrich"][0].Evt.Meta["datasource_path"] == "immich-logs.log"
results["s02-enrich"]["crowdsecurity/dateparse-enrich"][0].Evt.Meta["datasource_type"] == "file"
results["s02-enrich"]["crowdsecurity/dateparse-enrich"][0].Evt.Meta["log_type"] == "immich_failed_auth"
results["s02-enrich"]["crowdsecurity/dateparse-enrich"][0].Evt.Meta["service"] == "immich"
results["s02-enrich"]["crowdsecurity/dateparse-enrich"][0].Evt.Meta["source_ip"] == "192.168.0.254"
results["s02-enrich"]["crowdsecurity/dateparse-enrich"][0].Evt.Meta["timestamp"] == "2023-08-02T19:32:47Z"
results["s02-enrich"]["crowdsecurity/dateparse-enrich"][0].Evt.Meta["user"] == "[email protected]"
results["s02-enrich"]["crowdsecurity/dateparse-enrich"][0].Evt.Enriched["MarshaledTime"] == "2023-08-02T19:32:47Z"
results["s02-enrich"]["crowdsecurity/dateparse-enrich"][1].Success == true
results["s02-enrich"]["crowdsecurity/dateparse-enrich"][1].Evt.Parsed["message"] == "[Nest] 7 - 08/02/2023, 7:34:03 PM WARN [AuthService] Failed login attempt for user [email protected] from ip address 176.172.44.211"
results["s02-enrich"]["crowdsecurity/dateparse-enrich"][1].Evt.Parsed["program"] == "immich"
results["s02-enrich"]["crowdsecurity/dateparse-enrich"][1].Evt.Parsed["source_ip"] == "176.172.44.211"
results["s02-enrich"]["crowdsecurity/dateparse-enrich"][1].Evt.Parsed["timestamp"] == "08/02/2023, 7:34:03 PM"
results["s02-enrich"]["crowdsecurity/dateparse-enrich"][1].Evt.Parsed["username"] == "[email protected]"
results["s02-enrich"]["crowdsecurity/dateparse-enrich"][1].Evt.Meta["datasource_path"] == "immich-logs.log"
results["s02-enrich"]["crowdsecurity/dateparse-enrich"][1].Evt.Meta["datasource_type"] == "file"
results["s02-enrich"]["crowdsecurity/dateparse-enrich"][1].Evt.Meta["log_type"] == "immich_failed_auth"
results["s02-enrich"]["crowdsecurity/dateparse-enrich"][1].Evt.Meta["service"] == "immich"
results["s02-enrich"]["crowdsecurity/dateparse-enrich"][1].Evt.Meta["source_ip"] == "176.172.44.211"
results["s02-enrich"]["crowdsecurity/dateparse-enrich"][1].Evt.Meta["timestamp"] == "2023-08-02T19:34:03Z"
results["s02-enrich"]["crowdsecurity/dateparse-enrich"][1].Evt.Meta["user"] == "[email protected]"
results["s02-enrich"]["crowdsecurity/dateparse-enrich"][1].Evt.Meta["datasource_path"] == "immich-logs.log"
results["s02-enrich"]["crowdsecurity/dateparse-enrich"][1].Evt.Enriched["MarshaledTime"] == "2023-08-02T19:34:03Z"
results["s02-enrich"]["crowdsecurity/dateparse-enrich"][2].Success == true
results["s02-enrich"]["crowdsecurity/dateparse-enrich"][2].Evt.Parsed["message"] == "[Nest] 7 - 08/02/2023, 7:34:03 WARN [AuthService] Failed login attempt for user [email protected] from ip address 176.172.44.212"
results["s02-enrich"]["crowdsecurity/dateparse-enrich"][2].Evt.Parsed["program"] == "immich"
results["s02-enrich"]["crowdsecurity/dateparse-enrich"][2].Evt.Parsed["source_ip"] == "176.172.44.212"
results["s02-enrich"]["crowdsecurity/dateparse-enrich"][2].Evt.Parsed["timestamp"] == "08/02/2023, 7:34:03"
results["s02-enrich"]["crowdsecurity/dateparse-enrich"][2].Evt.Parsed["username"] == "[email protected]"
results["s02-enrich"]["crowdsecurity/dateparse-enrich"][2].Evt.Meta["timestamp"] == "2023-08-02T07:34:03Z"
results["s02-enrich"]["crowdsecurity/dateparse-enrich"][2].Evt.Parsed["message"] == "[Nest] 7 - 08/02/2023, 7:34:03 WARN [AuthService] Failed login attempt for user [email protected] from ip address 176.172.44.212"
results["s02-enrich"]["crowdsecurity/dateparse-enrich"][2].Evt.Parsed["program"] == "immich"
results["s02-enrich"]["crowdsecurity/dateparse-enrich"][2].Evt.Meta["user"] == "[email protected]"
results["s02-enrich"]["crowdsecurity/dateparse-enrich"][2].Evt.Meta["datasource_path"] == "immich-logs.log"
results["s02-enrich"]["crowdsecurity/dateparse-enrich"][2].Evt.Meta["datasource_type"] == "file"
results["s02-enrich"]["crowdsecurity/dateparse-enrich"][2].Evt.Meta["log_type"] == "immich_failed_auth"
results["s02-enrich"]["crowdsecurity/dateparse-enrich"][2].Evt.Meta["service"] == "immich"
results["s02-enrich"]["crowdsecurity/dateparse-enrich"][2].Evt.Meta["source_ip"] == "176.172.44.212"
results["s02-enrich"]["crowdsecurity/dateparse-enrich"][2].Evt.Meta["timestamp"] == "2023-08-02T07:34:03Z"
results["s02-enrich"]["crowdsecurity/dateparse-enrich"][2].Evt.Enriched["MarshaledTime"] == "2023-08-02T07:34:03Z"
results["s02-enrich"]["crowdsecurity/dateparse-enrich"][3].Success == true
results["s02-enrich"]["crowdsecurity/dateparse-enrich"][3].Evt.Parsed["program"] == "immich"
results["s02-enrich"]["crowdsecurity/dateparse-enrich"][3].Evt.Parsed["source_ip"] == "176.171.169.54"
results["s02-enrich"]["crowdsecurity/dateparse-enrich"][3].Evt.Parsed["timestamp"] == "08/04/2023, 8:47:38 PM"
results["s02-enrich"]["crowdsecurity/dateparse-enrich"][3].Evt.Parsed["username"] == "[email protected]"
results["s02-enrich"]["crowdsecurity/dateparse-enrich"][3].Evt.Parsed["message"] == "\\x1b[33m[Nest] 6 - \\x1b[39m08/04/2023, 8:47:38 PM \\x1b[33m WARN\\x1b[39m \\x1b[38;5;3m[AuthService] \\x1b[39m\\x1b[33mFailed login attempt for user [email protected] from ip address 176.171.169.54\\x1b"
results["s02-enrich"]["crowdsecurity/dateparse-enrich"][3].Evt.Meta["service"] == "immich"
results["s02-enrich"]["crowdsecurity/dateparse-enrich"][3].Evt.Meta["source_ip"] == "176.171.169.54"
results["s02-enrich"]["crowdsecurity/dateparse-enrich"][3].Evt.Meta["timestamp"] == "2023-08-04T20:47:38Z"
results["s02-enrich"]["crowdsecurity/dateparse-enrich"][3].Evt.Meta["user"] == "[email protected]"
results["s02-enrich"]["crowdsecurity/dateparse-enrich"][3].Evt.Meta["datasource_path"] == "immich-logs.log"
results["s02-enrich"]["crowdsecurity/dateparse-enrich"][3].Evt.Meta["datasource_type"] == "file"
results["s02-enrich"]["crowdsecurity/dateparse-enrich"][3].Evt.Meta["log_type"] == "immich_failed_auth"
results["s02-enrich"]["crowdsecurity/dateparse-enrich"][3].Evt.Enriched["MarshaledTime"] == "2023-08-04T20:47:38Z"
len(results["success"][""]) == 0
Loading

0 comments on commit d3e33da

Please sign in to comment.