Skip to content

Commit e6c537a

Browse files
PintjesBPintjesB
committed
Unifi logs V0.5
1 parent b922a9b commit e6c537a

File tree

8 files changed

+142
-0
lines changed

8 files changed

+142
-0
lines changed

‎.tests/unifi-logs-s01/config.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
parsers:
2+
- crowdsecurity/unifi-logs
3+
- ./parsers/s01-parse/PintjesB/unifi-logs.yaml
4+
scenarios:
5+
- "./scenarios/s01-parse/PintjesB/unifi-firewall-hits.yaml"
6+
postoverflows:
7+
- ""
8+
log_file: s01-unifi-v1.log
9+
log_type: unifi

‎.tests/unifi-logs-s01/parser.assert‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
len(results) == 3
2+
results["s00-raw"]["crowdsecurity/unifi-logs"][0].Success == true
3+
results["s00-raw"]["crowdsecurity/unifi-logs"][0].Evt.Parsed["logsource"] == "syslog"
4+
results["s00-raw"]["crowdsecurity/unifi-logs"][0].Evt.Parsed["timestamp"] == "Jun 13 23:29:15"
5+
results["s00-raw"]["crowdsecurity/unifi-logs"][0].Evt.Meta["machine"] == "UDMP-DTC"
6+
results["s00-raw"]["crowdsecurity/unifi-logs"][1].Success == true
7+
results["s00-raw"]["crowdsecurity/unifi-logs"][1].Evt.Parsed["logsource"] == "syslog"
8+
results["s00-raw"]["crowdsecurity/unifi-logs"][1].Evt.Parsed["timestamp"] == "Feb 8 18:19:31"
9+
results["s00-raw"]["crowdsecurity/unifi-logs"][1].Evt.Meta["machine"] == "Unifi-Dream-Machine"
10+
results["s01-parse"]["PintjesB/unifi-logs"][0].Success == true
11+
results["s01-parse"]["PintjesB/unifi-logs"][0].Evt.Parsed["action"] == "D"
12+
results["s01-parse"]["PintjesB/unifi-logs"][0].Evt.Parsed["dst_ip"] == "192.168.1.25"
13+
results["s01-parse"]["PintjesB/unifi-logs"][0].Evt.Parsed["dst_port"] == "54329"
14+
results["s01-parse"]["PintjesB/unifi-logs"][0].Evt.Parsed["dst_zone"] == "LOCAL"
15+
results["s01-parse"]["PintjesB/unifi-logs"][0].Evt.Parsed["fw_descr"] == "[WAN_LOCAL]Block All Traffic"
16+
results["s01-parse"]["PintjesB/unifi-logs"][0].Evt.Parsed["if_in"] == "eth8"
17+
results["s01-parse"]["PintjesB/unifi-logs"][0].Evt.Parsed["logsource"] == "syslog"
18+
results["s01-parse"]["PintjesB/unifi-logs"][0].Evt.Parsed["mac"] == "74:ac:b9:1c:62:e5:00:17:10:2b:31:a9:08:00"
19+
results["s01-parse"]["PintjesB/unifi-logs"][0].Evt.Parsed["proto"] == "UDP"
20+
results["s01-parse"]["PintjesB/unifi-logs"][0].Evt.Parsed["remainder"] == "LEN=102 MARK=1a0000"
21+
results["s01-parse"]["PintjesB/unifi-logs"][0].Evt.Parsed["rule_id"] == "2147483647"
22+
results["s01-parse"]["PintjesB/unifi-logs"][0].Evt.Parsed["skip2"] == "122 TOS=00 PREC=0x00 TTL=49 ID=45366 DF"
23+
results["s01-parse"]["PintjesB/unifi-logs"][0].Evt.Parsed["source_ip"] == "3.3.3.3"
24+
results["s01-parse"]["PintjesB/unifi-logs"][0].Evt.Parsed["src_port"] == "38451"
25+
results["s01-parse"]["PintjesB/unifi-logs"][0].Evt.Parsed["timestamp"] == "Jun 13 23:29:15"
26+
results["s01-parse"]["PintjesB/unifi-logs"][0].Evt.Meta["log_type"] == "firewall_block_rule_hit"
27+
results["s01-parse"]["PintjesB/unifi-logs"][0].Evt.Meta["machine"] == "UDMP-DTC"
28+
results["s01-parse"]["PintjesB/unifi-logs"][0].Evt.Meta["source_ip"] == "3.3.3.3"
29+
results["s01-parse"]["PintjesB/unifi-logs"][1].Success == true
30+
results["s01-parse"]["PintjesB/unifi-logs"][1].Evt.Parsed["action"] == "D"
31+
results["s01-parse"]["PintjesB/unifi-logs"][1].Evt.Parsed["dst_ip"] == "10.10.10.10"
32+
results["s01-parse"]["PintjesB/unifi-logs"][1].Evt.Parsed["dst_port"] == "29552"
33+
results["s01-parse"]["PintjesB/unifi-logs"][1].Evt.Parsed["dst_zone"] == "LOCAL"
34+
results["s01-parse"]["PintjesB/unifi-logs"][1].Evt.Parsed["fw_descr"] == "[WAN_LOCAL]Drop All Other Traf"
35+
results["s01-parse"]["PintjesB/unifi-logs"][1].Evt.Parsed["if_in"] == "eth4"
36+
results["s01-parse"]["PintjesB/unifi-logs"][1].Evt.Parsed["logsource"] == "syslog"
37+
results["s01-parse"]["PintjesB/unifi-logs"][1].Evt.Parsed["mac"] == "fake-mac-address"
38+
results["s01-parse"]["PintjesB/unifi-logs"][1].Evt.Parsed["proto"] == "TCP"
39+
results["s01-parse"]["PintjesB/unifi-logs"][1].Evt.Parsed["remainder"] == "SEQ=2451790175 ACK=0 WINDOW=1024 SYN URGP=0 MARK=1a0000"
40+
results["s01-parse"]["PintjesB/unifi-logs"][1].Evt.Parsed["rule_id"] == "2147483647"
41+
results["s01-parse"]["PintjesB/unifi-logs"][1].Evt.Parsed["skip2"] == "40 TOS=00 PREC=0x00 TTL=239 ID=13706"
42+
results["s01-parse"]["PintjesB/unifi-logs"][1].Evt.Parsed["source_ip"] == "72.60.20.10"
43+
results["s01-parse"]["PintjesB/unifi-logs"][1].Evt.Parsed["src_port"] == "45584"
44+
results["s01-parse"]["PintjesB/unifi-logs"][1].Evt.Parsed["timestamp"] == "Feb 8 18:19:31"
45+
results["s01-parse"]["PintjesB/unifi-logs"][1].Evt.Meta["log_type"] == "firewall_block_rule_hit"
46+
results["s01-parse"]["PintjesB/unifi-logs"][1].Evt.Meta["machine"] == "Unifi-Dream-Machine"
47+
results["s01-parse"]["PintjesB/unifi-logs"][1].Evt.Meta["source_ip"] == "72.60.20.10"

‎.tests/unifi-logs-s01/s01-unifi-v1.log‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
Jun 13 23:29:15 UDMP-DTC [WAN_LOCAL-D-2147483647] DESCR="[WAN_LOCAL]Block All Traffic" IN=eth8 OUT= MAC=74:ac:b9:1c:62:e5:00:17:10:2b:31:a9:08:00 SRC=3.3.3.3 DST=192.168.1.25 LEN=122 TOS=00 PREC=0x00 TTL=49 ID=45366 DF PROTO=UDP SPT=38451 DPT=54329 LEN=102 MARK=1a0000
2+
Feb 8 18:19:31 Unifi-Dream-Machine [WAN_LOCAL-D-2147483647] DESCR="[WAN_LOCAL]Drop All Other Traf" IN=eth4 OUT= MAC=fake-mac-address SRC=72.60.20.10 DST=10.10.10.10 LEN=40 TOS=00 PREC=0x00 TTL=239 ID=13706 PROTO=TCP SPT=45584 DPT=29552 SEQ=2451790175 ACK=0 WINDOW=1024 SYN URGP=0 MARK=1a0000
3+
Jun 13 23:29:15 UDMP-DTC [WAN_LOCAL-A-2147483647] DESCR="[WAN_LOCAL]Block All Traffic" IN=eth8 OUT= MAC=74:ac:b9:1c:62:e5:00:17:10:2b:31:a9:08:00 SRC=1.1.1.1 DST=20.20.20.20 LEN=122 TOS=00 PREC=0x00 TTL=49 ID=45366 DF PROTO=UDP SPT=38451 DPT=54329 LEN=102 MARK=1a0000

‎.tests/unifi-logs-s01/scenario.assert‎

Whitespace-only changes.

‎parsers/s01-parse/PintjesB/unifi-logs.md‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
Parsing of Unifi firewall logs
2+
3+
Example acquisition for this collection:
4+
```yaml
5+
---
6+
filenames:
7+
- /syslog-server/unifi-firewall.log
8+
labels:
9+
type: unifi
10+
```
11+
12+
TODO:
13+
- [x] Firewall WAN rule hits
14+
- [ ] Firewall IPS logs
15+
- [ ] Firewall IDS logs
16+
- [ ] Firewall auth logs (?)

‎parsers/s01-parse/PintjesB/unifi-logs.yaml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
name: PintjesB/unifi-logs
2+
description: "Parse Unifi firewall logs"
3+
onsuccess: next_stage
4+
pattern_syntax:
5+
ACTION: (D|R)
6+
ZONE: (LAN|WAN|LOCAL|VPN|DMZ)
7+
IFACE_OR_EMPTY: (?:[a-zA-Z]+[0-9]*|)
8+
nodes:
9+
- grok:
10+
pattern: '^\[WAN_%{ZONE:dst_zone}-%{ACTION:action}-%{INT:rule_id}\] DESCR="%{DATA:fw_descr}" IN=%{IFACE_OR_EMPTY:if_in} OUT=%{IFACE_OR_EMPTY:if_out} MAC=%{DATA:mac} SRC=%{IP:source_ip} DST=%{IP:dst_ip} LEN=%{DATA:skip2} PROTO=%{WORD:proto} SPT=%{INT:src_port} DPT=%{INT:dst_port} %{GREEDYDATA:remainder}'
11+
apply_on: message
12+
statics:
13+
- meta: log_type
14+
value: firewall_block_rule_hit
15+
16+
statics:
17+
- meta: action
18+
expression: 'evt.Parsed.action == "A" ? "accept" : (evt.Parsed.action == "D" ? "drop" : (evt.Parsed.action == "R" ? "reject" : "unknown"))'
19+
# - meta: source_zone
20+
# expression: "evt.Parsed.src_zone"
21+
# - meta: destination_zone
22+
# expression: "evt.Parsed.dst_zone"
23+
- meta: source_ip
24+
expression: "evt.Parsed.source_ip"
25+
- meta: destination_ip
26+
expression: "evt.Parsed.dst_ip"
27+
# - meta: source_port
28+
# expression: "evt.Parsed.src_port"
29+
# - meta: destination_port
30+
# expression: "evt.Parsed.dst_port"
31+
- meta: protocol
32+
expression: "evt.Parsed.proto"
33+
# - meta: rule_id
34+
# expression: "evt.Parsed.rule_id"

‎scenarios/PintjesB/unifi-logs/unifi-firewall-hits.md‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
Scenario to trigger when a certain IP has hit too many block/reject firewall rules.
2+
3+
(over 15 hits, 10 seconds between each hit)
4+
5+
TODO:
6+
- [x] Firewall WAN rule hits
7+
- [ ] Firewall IPS logs
8+
- [ ] Firewall IDS logs
9+
- [ ] Firewall auth logs (?)

‎scenarios/PintjesB/unifi-logs/unifi-firewall-hits.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
type: leaky
2+
name: PintjesB/unifi-firewall-hits
3+
description: "Detect repeated firewall rule hits on Unifi"
4+
filter: "evt.Meta.log_type == 'firewall_block_rule_hit'
5+
groupby: evt.Meta.source_ip
6+
capacity: 15
7+
leakspeed: 10s
8+
blackhole: 1m
9+
labels:
10+
remediation: true
11+
classification:
12+
- attack.T1046
13+
- attack.T1595.002
14+
- attack.T1595
15+
- attack.TA0001
16+
- attack.T1190
17+
- attack.1133
18+
- attack.T1562
19+
- attack.TA0011
20+
- attack.T1071
21+
behavior: "tcp:scan"
22+
label: "Unifi rule hit"
23+
spoofable: 3
24+
confidence: 1

0 commit comments

Comments
 (0)