Add qBittorrent collection to hub.

* Implement a minimal parser that can detect login attempts on the WebUI

  * It detects timezone naive as well as timezone aware timestamps

* Implement a bruteforce scenario

.tests/qbittorrent-bf/config.yaml

@@ -0,0 +1,12 @@
+parsers:
+  - crowdsecurity/syslog-logs
+  - ./parsers/s01-parse/gilbsgilbs/qbittorrent-logs.yaml
+  - "crowdsecurity/dateparse-enrich"
+scenarios:
+  - ./scenarios/gilbsgilbs/qbittorrent-bf.yaml
+postoverflows:
+  - ""
+log_file: qbittorrent-logs.log
+log_type: qbittorrent
+labels: {}
+ignore_parsers: false

.tests/qbittorrent-bf/qbittorrent-logs.log

@@ -0,0 +1,7 @@
+(N) 2024-11-26T01:26:58 - WebAPI login success. IP: b942:70a6:a98a:de85:0733:bf28:33fb:fc71
+(W) 2024-11-26T13:37:02 - WebAPI login failure. Reason: invalid credentials, attempt count: 1, IP: a839:f70d:3ed9:bf86:119b:e579:acdd:dce8, username: user0
+(W) 2024-11-26T13:37:03 - WebAPI login failure. Reason: invalid credentials, attempt count: 2, IP: a839:f70d:3ed9:bf86:119b:e579:acdd:dce8, username: user0
+(W) 2024-11-26T13:37:04 - WebAPI login failure. Reason: invalid credentials, attempt count: 3, IP: a839:f70d:3ed9:bf86:119b:e579:acdd:dce8, username: user0
+(W) 2024-11-26T13:37:05 - WebAPI login failure. Reason: invalid credentials, attempt count: 4, IP: a839:f70d:3ed9:bf86:119b:e579:acdd:dce8, username: user0
+(W) 2024-11-26T13:37:06 - WebAPI login failure. Reason: invalid credentials, attempt count: 5, IP: a839:f70d:3ed9:bf86:119b:e579:acdd:dce8, username: user0
+(W) 2024-11-26T13:37:07 - WebAPI login failure. Reason: IP has been banned, IP: a839:f70d:3ed9:bf86:119b:e579:acdd:dce8, username: user0

.tests/qbittorrent-bf/scenario.assert

@@ -0,0 +1,51 @@
+len(results) == 1
+"a839:f70d:3ed9:bf86:119b:e579:acdd:dce8" in results[0].Overflow.GetSources()
+results[0].Overflow.Sources["a839:f70d:3ed9:bf86:119b:e579:acdd:dce8"].IP == "a839:f70d:3ed9:bf86:119b:e579:acdd:dce8"
+results[0].Overflow.Sources["a839:f70d:3ed9:bf86:119b:e579:acdd:dce8"].Range == ""
+results[0].Overflow.Sources["a839:f70d:3ed9:bf86:119b:e579:acdd:dce8"].GetScope() == "Ip"
+results[0].Overflow.Sources["a839:f70d:3ed9:bf86:119b:e579:acdd:dce8"].GetValue() == "a839:f70d:3ed9:bf86:119b:e579:acdd:dce8"
+results[0].Overflow.Alert.Events[0].GetMeta("datasource_path") == "qbittorrent-logs.log"
+results[0].Overflow.Alert.Events[0].GetMeta("datasource_type") == "file"
+results[0].Overflow.Alert.Events[0].GetMeta("log_type") == "qbittorrent_failed_auth"
+results[0].Overflow.Alert.Events[0].GetMeta("service") == "qbittorrent"
+results[0].Overflow.Alert.Events[0].GetMeta("source_ip") == "a839:f70d:3ed9:bf86:119b:e579:acdd:dce8"
+results[0].Overflow.Alert.Events[0].GetMeta("timestamp") == "2024-11-26T13:37:02Z"
+results[0].Overflow.Alert.Events[0].GetMeta("user") == "user0"
+results[0].Overflow.Alert.Events[1].GetMeta("datasource_path") == "qbittorrent-logs.log"
+results[0].Overflow.Alert.Events[1].GetMeta("datasource_type") == "file"
+results[0].Overflow.Alert.Events[1].GetMeta("log_type") == "qbittorrent_failed_auth"
+results[0].Overflow.Alert.Events[1].GetMeta("service") == "qbittorrent"
+results[0].Overflow.Alert.Events[1].GetMeta("source_ip") == "a839:f70d:3ed9:bf86:119b:e579:acdd:dce8"
+results[0].Overflow.Alert.Events[1].GetMeta("timestamp") == "2024-11-26T13:37:03Z"
+results[0].Overflow.Alert.Events[1].GetMeta("user") == "user0"
+results[0].Overflow.Alert.Events[2].GetMeta("datasource_path") == "qbittorrent-logs.log"
+results[0].Overflow.Alert.Events[2].GetMeta("datasource_type") == "file"
+results[0].Overflow.Alert.Events[2].GetMeta("log_type") == "qbittorrent_failed_auth"
+results[0].Overflow.Alert.Events[2].GetMeta("service") == "qbittorrent"
+results[0].Overflow.Alert.Events[2].GetMeta("source_ip") == "a839:f70d:3ed9:bf86:119b:e579:acdd:dce8"
+results[0].Overflow.Alert.Events[2].GetMeta("timestamp") == "2024-11-26T13:37:04Z"
+results[0].Overflow.Alert.Events[2].GetMeta("user") == "user0"
+results[0].Overflow.Alert.Events[3].GetMeta("datasource_path") == "qbittorrent-logs.log"
+results[0].Overflow.Alert.Events[3].GetMeta("datasource_type") == "file"
+results[0].Overflow.Alert.Events[3].GetMeta("log_type") == "qbittorrent_failed_auth"
+results[0].Overflow.Alert.Events[3].GetMeta("service") == "qbittorrent"
+results[0].Overflow.Alert.Events[3].GetMeta("source_ip") == "a839:f70d:3ed9:bf86:119b:e579:acdd:dce8"
+results[0].Overflow.Alert.Events[3].GetMeta("timestamp") == "2024-11-26T13:37:05Z"
+results[0].Overflow.Alert.Events[3].GetMeta("user") == "user0"
+results[0].Overflow.Alert.Events[4].GetMeta("datasource_path") == "qbittorrent-logs.log"
+results[0].Overflow.Alert.Events[4].GetMeta("datasource_type") == "file"
+results[0].Overflow.Alert.Events[4].GetMeta("log_type") == "qbittorrent_failed_auth"
+results[0].Overflow.Alert.Events[4].GetMeta("service") == "qbittorrent"
+results[0].Overflow.Alert.Events[4].GetMeta("source_ip") == "a839:f70d:3ed9:bf86:119b:e579:acdd:dce8"
+results[0].Overflow.Alert.Events[4].GetMeta("timestamp") == "2024-11-26T13:37:06Z"
+results[0].Overflow.Alert.Events[4].GetMeta("user") == "user0"
+results[0].Overflow.Alert.Events[5].GetMeta("datasource_path") == "qbittorrent-logs.log"
+results[0].Overflow.Alert.Events[5].GetMeta("datasource_type") == "file"
+results[0].Overflow.Alert.Events[5].GetMeta("log_type") == "qbittorrent_failed_auth"
+results[0].Overflow.Alert.Events[5].GetMeta("service") == "qbittorrent"
+results[0].Overflow.Alert.Events[5].GetMeta("source_ip") == "a839:f70d:3ed9:bf86:119b:e579:acdd:dce8"
+results[0].Overflow.Alert.Events[5].GetMeta("timestamp") == "2024-11-26T13:37:07Z"
+results[0].Overflow.Alert.Events[5].GetMeta("user") == "user0"
+results[0].Overflow.Alert.GetScenario() == "gilbsgilbs/qbittorrent-bf"
+results[0].Overflow.Alert.Remediation == true
+results[0].Overflow.Alert.GetEventsCount() == 6

.tests/qbittorrent-logs/config.yaml

@@ -0,0 +1,11 @@
+parsers:
+  - crowdsecurity/syslog-logs
+  - ./parsers/s01-parse/gilbsgilbs/qbittorrent-logs.yaml
+scenarios:
+  - ""
+postoverflows:
+  - ""
+log_file: qbittorrent-logs.log
+log_type: qbittorrent
+labels: {}
+ignore_parsers: false