diff --git a/.tests/exim-logs/exim-logs.log b/.tests/exim-logs/exim-logs.log index 3c1969c7b41..8fa6ef1e21a 100644 --- a/.tests/exim-logs/exim-logs.log +++ b/.tests/exim-logs/exim-logs.log @@ -10,3 +10,4 @@ 2023-05-30 06:10:12 login authenticator failed for no-helo.example.org [192.0.2.11]:5432: 535 Incorrect authentication data (set_id=user) 2023-05-30 06:10:13.345 login authenticator failed for millis.example.org [192.0.2.12]:5432: 535 Incorrect authentication data (set_id=user) 2023-05-30 06:10:14 login authenticator failed for no-port.example.org [192.0.2.13]: 535 Incorrect authentication data (set_id=user) +2023-05-30 06:10:15 login authenticator failed for (U8kjDR) [192.0.2.14]: 535 Incorrect authentication data diff --git a/.tests/exim-logs/parser.assert b/.tests/exim-logs/parser.assert index e361d30dd4a..e0315c2d58d 100644 --- a/.tests/exim-logs/parser.assert +++ b/.tests/exim-logs/parser.assert @@ -1,5 +1,5 @@ len(results) == 4 -len(results["s00-raw"]["crowdsecurity/non-syslog"]) == 12 +len(results["s00-raw"]["crowdsecurity/non-syslog"]) == 13 results["s00-raw"]["crowdsecurity/non-syslog"][0].Success == true results["s00-raw"]["crowdsecurity/non-syslog"][0].Evt.Parsed["message"] == "2022-06-29 16:04:19 dovecot_login authenticator failed for ([1.2.3.5]) [1.2.3.4]:55379: 535 Incorrect authentication data (set_id=abuse@test.com)" results["s00-raw"]["crowdsecurity/non-syslog"][0].Evt.Parsed["program"] == "exim" @@ -60,7 +60,12 @@ results["s00-raw"]["crowdsecurity/non-syslog"][11].Evt.Parsed["message"] == "202 results["s00-raw"]["crowdsecurity/non-syslog"][11].Evt.Parsed["program"] == "exim" results["s00-raw"]["crowdsecurity/non-syslog"][11].Evt.Meta["datasource_path"] == "exim-logs.log" results["s00-raw"]["crowdsecurity/non-syslog"][11].Evt.Meta["datasource_type"] == "file" -len(results["s00-raw"]["crowdsecurity/syslog-logs"]) == 12 +results["s00-raw"]["crowdsecurity/non-syslog"][12].Success == true +results["s00-raw"]["crowdsecurity/non-syslog"][12].Evt.Parsed["message"] == "2023-05-30 06:10:15 login authenticator failed for (U8kjDR) [192.0.2.14]: 535 Incorrect authentication data" +results["s00-raw"]["crowdsecurity/non-syslog"][12].Evt.Parsed["program"] == "exim" +results["s00-raw"]["crowdsecurity/non-syslog"][12].Evt.Meta["datasource_path"] == "exim-logs.log" +results["s00-raw"]["crowdsecurity/non-syslog"][12].Evt.Meta["datasource_type"] == "file" +len(results["s00-raw"]["crowdsecurity/syslog-logs"]) == 13 results["s00-raw"]["crowdsecurity/syslog-logs"][0].Success == false results["s00-raw"]["crowdsecurity/syslog-logs"][1].Success == false results["s00-raw"]["crowdsecurity/syslog-logs"][2].Success == false @@ -73,7 +78,8 @@ results["s00-raw"]["crowdsecurity/syslog-logs"][8].Success == false results["s00-raw"]["crowdsecurity/syslog-logs"][9].Success == false results["s00-raw"]["crowdsecurity/syslog-logs"][10].Success == false results["s00-raw"]["crowdsecurity/syslog-logs"][11].Success == false -len(results["s01-parse"]["crowdsecurity/exim-logs"]) == 12 +results["s00-raw"]["crowdsecurity/syslog-logs"][12].Success == false +len(results["s01-parse"]["crowdsecurity/exim-logs"]) == 13 results["s01-parse"]["crowdsecurity/exim-logs"][0].Success == true results["s01-parse"]["crowdsecurity/exim-logs"][0].Evt.Parsed["source_helo"] == "[1.2.3.5]" results["s01-parse"]["crowdsecurity/exim-logs"][0].Evt.Parsed["target_user"] == "abuse@test.com" @@ -285,7 +291,24 @@ results["s01-parse"]["crowdsecurity/exim-logs"][11].Evt.Meta["source_dns"] == "n results["s01-parse"]["crowdsecurity/exim-logs"][11].Evt.Meta["source_ip"] == "192.0.2.13" results["s01-parse"]["crowdsecurity/exim-logs"][11].Evt.Meta["username"] == "user" results["s01-parse"]["crowdsecurity/exim-logs"][11].Evt.Meta["datasource_path"] == "exim-logs.log" -len(results["s02-enrich"]["crowdsecurity/dateparse-enrich"]) == 12 +results["s01-parse"]["crowdsecurity/exim-logs"][12].Success == true +results["s01-parse"]["crowdsecurity/exim-logs"][12].Evt.Parsed["message"] == "2023-05-30 06:10:15 login authenticator failed for (U8kjDR) [192.0.2.14]: 535 Incorrect authentication data" +results["s01-parse"]["crowdsecurity/exim-logs"][12].Evt.Parsed["program"] == "exim" +results["s01-parse"]["crowdsecurity/exim-logs"][12].Evt.Parsed["date"] == "2023-05-30 06:10:15" +results["s01-parse"]["crowdsecurity/exim-logs"][12].Evt.Parsed["exim_auth"] == "login" +results["s01-parse"]["crowdsecurity/exim-logs"][12].Evt.Parsed["exim_year"] == "2023" +results["s01-parse"]["crowdsecurity/exim-logs"][12].Evt.Parsed["exim_month"] == "05" +results["s01-parse"]["crowdsecurity/exim-logs"][12].Evt.Parsed["exim_day"] == "30" +results["s01-parse"]["crowdsecurity/exim-logs"][12].Evt.Parsed["exim_time"] == "06:10:15" +results["s01-parse"]["crowdsecurity/exim-logs"][12].Evt.Parsed["source_helo"] == "U8kjDR" +results["s01-parse"]["crowdsecurity/exim-logs"][12].Evt.Parsed["source_ip"] == "192.0.2.14" +results["s01-parse"]["crowdsecurity/exim-logs"][12].Evt.Meta["log_type"] == "exim_failed_auth" +results["s01-parse"]["crowdsecurity/exim-logs"][12].Evt.Meta["service"] == "exim" +results["s01-parse"]["crowdsecurity/exim-logs"][12].Evt.Meta["source_helo"] == "U8kjDR" +results["s01-parse"]["crowdsecurity/exim-logs"][12].Evt.Meta["source_ip"] == "192.0.2.14" +results["s01-parse"]["crowdsecurity/exim-logs"][12].Evt.Meta["datasource_path"] == "exim-logs.log" +results["s01-parse"]["crowdsecurity/exim-logs"][12].Evt.Meta["datasource_type"] == "file" +len(results["s02-enrich"]["crowdsecurity/dateparse-enrich"]) == 13 results["s02-enrich"]["crowdsecurity/dateparse-enrich"][0].Success == true results["s02-enrich"]["crowdsecurity/dateparse-enrich"][0].Evt.Parsed["source_ip"] == "1.2.3.4" results["s02-enrich"]["crowdsecurity/dateparse-enrich"][0].Evt.Parsed["source_port"] == "55379" @@ -521,4 +544,19 @@ results["s02-enrich"]["crowdsecurity/dateparse-enrich"][11].Evt.Meta["timestamp" results["s02-enrich"]["crowdsecurity/dateparse-enrich"][11].Evt.Meta["username"] == "user" results["s02-enrich"]["crowdsecurity/dateparse-enrich"][11].Evt.Meta["datasource_path"] == "exim-logs.log" results["s02-enrich"]["crowdsecurity/dateparse-enrich"][11].Evt.Enriched["MarshaledTime"] == "2023-05-30T06:10:14Z" +results["s02-enrich"]["crowdsecurity/dateparse-enrich"][12].Success == true +results["s02-enrich"]["crowdsecurity/dateparse-enrich"][12].Evt.Parsed["message"] == "2023-05-30 06:10:15 login authenticator failed for (U8kjDR) [192.0.2.14]: 535 Incorrect authentication data" +results["s02-enrich"]["crowdsecurity/dateparse-enrich"][12].Evt.Parsed["program"] == "exim" +results["s02-enrich"]["crowdsecurity/dateparse-enrich"][12].Evt.Parsed["date"] == "2023-05-30 06:10:15" +results["s02-enrich"]["crowdsecurity/dateparse-enrich"][12].Evt.Parsed["exim_auth"] == "login" +results["s02-enrich"]["crowdsecurity/dateparse-enrich"][12].Evt.Parsed["source_helo"] == "U8kjDR" +results["s02-enrich"]["crowdsecurity/dateparse-enrich"][12].Evt.Parsed["source_ip"] == "192.0.2.14" +results["s02-enrich"]["crowdsecurity/dateparse-enrich"][12].Evt.Meta["log_type"] == "exim_failed_auth" +results["s02-enrich"]["crowdsecurity/dateparse-enrich"][12].Evt.Meta["service"] == "exim" +results["s02-enrich"]["crowdsecurity/dateparse-enrich"][12].Evt.Meta["source_helo"] == "U8kjDR" +results["s02-enrich"]["crowdsecurity/dateparse-enrich"][12].Evt.Meta["source_ip"] == "192.0.2.14" +results["s02-enrich"]["crowdsecurity/dateparse-enrich"][12].Evt.Meta["timestamp"] == "2023-05-30T06:10:15Z" +results["s02-enrich"]["crowdsecurity/dateparse-enrich"][12].Evt.Meta["datasource_path"] == "exim-logs.log" +results["s02-enrich"]["crowdsecurity/dateparse-enrich"][12].Evt.Meta["datasource_type"] == "file" +results["s02-enrich"]["crowdsecurity/dateparse-enrich"][12].Evt.Enriched["MarshaledTime"] == "2023-05-30T06:10:15Z" len(results["success"][""]) == 0 diff --git a/parsers/s01-parse/crowdsecurity/exim-logs.yaml b/parsers/s01-parse/crowdsecurity/exim-logs.yaml index 05528d236e3..e1a98644297 100644 --- a/parsers/s01-parse/crowdsecurity/exim-logs.yaml +++ b/parsers/s01-parse/crowdsecurity/exim-logs.yaml @@ -13,7 +13,7 @@ pattern_syntax: EXIM_SOURCE_TLS: 'H=%{EXIM_SOURCE}(?::%{POSINT:source_port})? (:?X=%{NOTSPACE:tls_cipher} CV=(:?yes|no) )?' nodes: - grok: - pattern: '%{EXIM_OPT_DATE}%{EXIM_AUTH:exim_auth} authenticator failed for %{EXIM_SOURCE}:(?:%{POSINT:source_port}:)? 535 Incorrect authentication data \(set_id=%{NO_END_PAR:target_user}\)' + pattern: '%{EXIM_OPT_DATE}%{EXIM_AUTH:exim_auth} authenticator failed for %{EXIM_SOURCE}:(?:%{POSINT:source_port}:)? 535 Incorrect authentication data(?: \(set_id=%{NO_END_PAR:target_user}\))?' apply_on: message statics: - meta: log_type