From ddc473b00c768cf719fdd660261c81fba2c3852a Mon Sep 17 00:00:00 2001
From: xulianh <xulianh@msn.com>
Date: Wed, 1 Jul 2026 00:21:31 +0000
Subject: [PATCH 1/2] feat(xray): add brute-force scenario and parser

---
 parsers/s01-parse/xulianh/xray-logs.md   | 44 ++++++++++++++++++++++++
 parsers/s01-parse/xulianh/xray-logs.yaml | 15 ++++++++
 scenarios/xulianh/tests/xray_sample.log  | 10 ++++++
 scenarios/xulianh/xray-brute-force.md    | 43 +++++++++++++++++++++++
 scenarios/xulianh/xray-brute-force.yaml  | 12 +++++++
 5 files changed, 124 insertions(+)
 create mode 100644 parsers/s01-parse/xulianh/xray-logs.md
 create mode 100644 parsers/s01-parse/xulianh/xray-logs.yaml
 create mode 100644 scenarios/xulianh/tests/xray_sample.log
 create mode 100644 scenarios/xulianh/xray-brute-force.md
 create mode 100644 scenarios/xulianh/xray-brute-force.yaml

diff --git a/parsers/s01-parse/xulianh/xray-logs.md b/parsers/s01-parse/xulianh/xray-logs.md
new file mode 100644
index 00000000000..0152f0f12fb
--- /dev/null
+++ b/parsers/s01-parse/xulianh/xray-logs.md
@@ -0,0 +1,44 @@
+---
+author: xulianh
+classification:
+  - AppSec
+  - Proxy
+tags:
+  - xray
+  - brute-force
+---
+
+# X-ray Log Parser
+
+## Description
+This parser is designed to extract relevant security events from X-ray proxy service logs. It specifically targets connection logs to identify connection states and source IP addresses.
+
+## Acquisition Configuration
+To allow this parser to process the logs, add the following configuration to your `/etc/crowdsec/acquis.d/xray.yaml` file:
+
+filenames:
+  - /var/log/xray/access.log
+labels:
+  type: xray
+
+## Extraction Logic
+
+The component utilizes Grok patterns to process the `message` field of incoming logs matching the `xray` program identifier.
+
+* **Target Variables:**
+  * `evt.Parsed.action`: Captures the connection outcome (e.g., `rejected`).
+  * `evt.Parsed.source_ip`: Isolates the originating IPv4/IPv6 address.
+
+### Architecture Flow
+
+    [Raw X-ray Log] --> [xulianh/xray-logs Parser] --> [Extracted Meta-fields]
+                                                              |
+                                                              v
+                                                 [Available for Scenarios]
+
+## Validation and Testing
+To validate the extraction logic against a local log file, utilize the CrowdSec CLI explain command:
+
+cscli explain --parser ./parsers/s01-parse/xulianh/xray-logs.yaml --log ./tests/xray_sample.log
+
+Ensure that the output explicitly shows the `action` and `source_ip` fields populated correctly.
diff --git a/parsers/s01-parse/xulianh/xray-logs.yaml b/parsers/s01-parse/xulianh/xray-logs.yaml
new file mode 100644
index 00000000000..c6bb514c305
--- /dev/null
+++ b/parsers/s01-parse/xulianh/xray-logs.yaml
@@ -0,0 +1,15 @@
+name: custom/xray-logs
+description: "Syntax analizer for x-ray's access recordsy"
+filter: "evt.Parsed.program == 'xray'"
+onsuccess: next_stage
+nodes:
+  - grok:
+      pattern: '^(?P<time>%{YEAR}/%{MONTHNUM}/%{MONTHDAY} %{HOUR}:%{MINUTE}:%{SECOND}\.%{INT:micro}) from %{IP:source_ip}:%{INT:source_port} %{WORD:action} %{GREEDYDATA:reason}'
+      apply_on: message
+statics:
+  - meta: source_ip
+    expression: "evt.Parsed.source_ip"
+  - meta: action
+    expression: "evt.Parsed.action"
+  - target: evt.StrTime
+    expression: "evt.Parsed.year + '-' + evt.Parsed.month + '-' + evt.Parsed.day + 'T' + evt.Parsed.hour + ':' + evt.Parsed.minute + ':' + evt.Parsed.second + 'Z'"
diff --git a/scenarios/xulianh/tests/xray_sample.log b/scenarios/xulianh/tests/xray_sample.log
new file mode 100644
index 00000000000..eb77d8ca83a
--- /dev/null
+++ b/scenarios/xulianh/tests/xray_sample.log
@@ -0,0 +1,10 @@
+2026/06/30 16:43:04.276617 from 85.118.98.191:61149 rejected  proxy/vless/encoding: invalid request user id: 8b85fdff-d127-5de3-916c-1511689c7478
+2026/06/30 16:43:33.058364 from 79.116.58.191:61280 rejected  proxy/vless/encoding: invalid request user id: 8b85fdff-d127-5de3-916c-1511689c7478
+2026/06/30 16:43:48.052766 from 79.116.58.191:61349 rejected  proxy/vless/encoding: invalid request user id: 8b85fdff-d127-5de3-916c-1511689c7478
+2026/06/30 16:44:05.318761 from 79.116.58.191:61418 rejected  proxy/vless/encoding: invalid request user id: 8b85fdff-d127-5de3-916c-1511689c7478
+2026/06/30 16:44:20.257918 from 79.116.58.191:61485 rejected  proxy/vless/encoding: invalid request user id: 8b85fdff-d127-5de3-916c-1511689c7478
+2026/06/30 16:46:58.723704 from 79.116.58.191:62159 rejected  proxy/vless/encoding: invalid request user id: 8b85fdff-d127-5de3-916c-1511689c7478
+2026/06/30 16:47:05.329968 from 79.116.58.191:62204 accepted tcp:www.gstatic.com:443 [direct]
+2026/06/30 16:47:20.308771 from 79.116.58.191:62264 accepted tcp:1.1.1.1:443 [direct]
+2026/06/30 16:47:50.543081 from 79.116.58.191:62385 accepted tcp:1.1.1.1:443 [direct]
+2026/06/30 16:48:19.021131 from 79.116.58.191:62504 accepted tcp:torrentclaw.com:443 [direct]
diff --git a/scenarios/xulianh/xray-brute-force.md b/scenarios/xulianh/xray-brute-force.md
new file mode 100644
index 00000000000..d99018d9279
--- /dev/null
+++ b/scenarios/xulianh/xray-brute-force.md
@@ -0,0 +1,43 @@
+~---
+author: xulianh
+classification:
+  - AppSec
+  - Proxy
+tags:
+  - xray
+  - brute-force
+---
+
+# X-ray Brute-Force Detection
+
+## Description
+This scenario is designed to detect brute-force authentication attempts or network scanning directed at an X-ray proxy service. It actively monitors connection attempts that the X-ray parser explicitly flags as `rejected`.
+
+## Detection Logic
+The scenario implements a leaky bucket algorithm to monitor the frequency of failed connection attempts per source IP address:
+
+* **Capacity:** 5 events.
+* **Leak Speed:** 20 seconds.
+* **Trigger:** If a single source IP address accumulates more than 5 rejected connection attempts within a 20-second rolling window, the bucket overflows, triggering a security alert.
+
+### Architecture Flow
+
+```text
+[Incoming Connection] --> [X-ray Service] --> [Log Entry (rejected)]
+                                                    |
+                                                    v
+[Alert Generated] <--- [Threshold Exceeded] <--- [CrowdSec Parser]
+```
+
+## Validation and Testing
+To ensure the scenario operates correctly before deploying to production, it can be tested using a sample log file containing simulated rejected connections.
+
+Run the following command using the CrowdSec CLI tool:
+
+```bash
+cscli explain --scenario ./scenarios/xulianh/xray-brute-force.yaml --log ./tests/xray_sample.log
+```
+### Verify that the output indicates the bucket successfully parsed the events and triggered an overflow after the 5th rejected attempt.
+
+You could generate your xray_sample.log directly from real events as follows:
+sudo tail -n 2 /var/log/xray/access.log > ./tests/xray_sample.log
diff --git a/scenarios/xulianh/xray-brute-force.yaml b/scenarios/xulianh/xray-brute-force.yaml
new file mode 100644
index 00000000000..a8a6ecdb561
--- /dev/null
+++ b/scenarios/xulianh/xray-brute-force.yaml
@@ -0,0 +1,12 @@
+type: leaky
+name: xulianh/xray-brute-force
+description: "Detect X-ray brute-force or scanning attempts"
+filter: evt.Parsed.action == 'rejected'
+groupby: evt.Parsed.source_ip
+leakspeed: 20s
+capacity: 5
+blackhole: 1m
+labels:
+  service: xray
+  type: brute-force
+  remediation: true

From 4bc69080ff2320eb658020d8037026bb0b8151a9 Mon Sep 17 00:00:00 2001
From: xulianh <xulianh@msn.com>
Date: Wed, 1 Jul 2026 20:50:01 +0000
Subject: [PATCH 2/2] feat(xray): add xray-logs parser and xray-brute-force
 scenario with hubtest flow verified

---
 .tests/xray-brute-force/config.yaml      |  14 +
 .tests/xray-brute-force/parser.assert    | 562 +++++++++++++++++++++++
 .tests/xray-brute-force/scenario.assert  |  55 +++
 .tests/xray-brute-force/xray_sample.log  |  15 +
 parsers/s01-parse/xulianh/xray-logs.md   |  75 ++-
 parsers/s01-parse/xulianh/xray-logs.yaml |  23 +-
 scenarios/xulianh/tests/xray_sample.log  |  10 -
 scenarios/xulianh/xray-brute-force.md    |  62 +--
 scenarios/xulianh/xray-brute-force.yaml  |   4 +-
 9 files changed, 744 insertions(+), 76 deletions(-)
 create mode 100644 .tests/xray-brute-force/config.yaml
 create mode 100644 .tests/xray-brute-force/parser.assert
 create mode 100644 .tests/xray-brute-force/scenario.assert
 create mode 100644 .tests/xray-brute-force/xray_sample.log
 delete mode 100644 scenarios/xulianh/tests/xray_sample.log

diff --git a/.tests/xray-brute-force/config.yaml b/.tests/xray-brute-force/config.yaml
new file mode 100644
index 00000000000..124408df421
--- /dev/null
+++ b/.tests/xray-brute-force/config.yaml
@@ -0,0 +1,14 @@
+name: xulianh/xray-brute-force-test
+description: "Integration test for X-ray brute-force detection providing full stage pipeline"
+scenarios:
+  - xulianh/xray-brute-force
+parsers:
+  # Crucial baseline ingestion parser to populate evt.Parsed.message
+  - crowdsecurity/non-syslog
+  - xulianh/xray-logs
+  # Timeline refinement component
+  - crowdsecurity/dateparse-enrich
+log_file: xray_sample.log
+log_type: xray
+labels:
+  program: xray
diff --git a/.tests/xray-brute-force/parser.assert b/.tests/xray-brute-force/parser.assert
new file mode 100644
index 00000000000..0722732578e
--- /dev/null
+++ b/.tests/xray-brute-force/parser.assert
@@ -0,0 +1,562 @@
+
+len(results) == 4
+len(results["s00-raw"]["crowdsecurity/non-syslog"]) == 15
+results["s00-raw"]["crowdsecurity/non-syslog"][0].Success == true
+results["s00-raw"]["crowdsecurity/non-syslog"][0].Evt.Parsed["message"] == "2026/06/30 16:43:00.000000 from 192.0.2.10:61149 rejected  proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000"
+results["s00-raw"]["crowdsecurity/non-syslog"][0].Evt.Whitelisted == false
+results["s00-raw"]["crowdsecurity/non-syslog"][1].Success == true
+results["s00-raw"]["crowdsecurity/non-syslog"][1].Evt.Parsed["message"] == "2026/06/30 16:43:01.000000 from 192.0.2.10:61150 rejected  proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000"
+results["s00-raw"]["crowdsecurity/non-syslog"][1].Evt.Whitelisted == false
+results["s00-raw"]["crowdsecurity/non-syslog"][2].Success == true
+results["s00-raw"]["crowdsecurity/non-syslog"][2].Evt.Parsed["message"] == "2026/06/30 16:43:01.500000 from 198.51.100.55:62204 accepted tcp:www.gstatic.com:443 [direct]"
+results["s00-raw"]["crowdsecurity/non-syslog"][2].Evt.Whitelisted == false
+results["s00-raw"]["crowdsecurity/non-syslog"][3].Success == true
+results["s00-raw"]["crowdsecurity/non-syslog"][3].Evt.Parsed["message"] == "2026/06/30 16:43:02.000000 from 192.0.2.10:61151 rejected  proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000"
+results["s00-raw"]["crowdsecurity/non-syslog"][3].Evt.Whitelisted == false
+results["s00-raw"]["crowdsecurity/non-syslog"][4].Success == true
+results["s00-raw"]["crowdsecurity/non-syslog"][4].Evt.Parsed["message"] == "2026/06/30 16:43:03.000000 from 192.0.2.10:61152 rejected  proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000"
+results["s00-raw"]["crowdsecurity/non-syslog"][4].Evt.Whitelisted == false
+results["s00-raw"]["crowdsecurity/non-syslog"][5].Success == true
+results["s00-raw"]["crowdsecurity/non-syslog"][5].Evt.Parsed["message"] == "2026/06/30 16:43:03.500000 from 192.0.2.10:62264 accepted tcp:1.1.1.1:443 [direct]"
+results["s00-raw"]["crowdsecurity/non-syslog"][5].Evt.Whitelisted == false
+results["s00-raw"]["crowdsecurity/non-syslog"][6].Success == true
+results["s00-raw"]["crowdsecurity/non-syslog"][6].Evt.Parsed["message"] == "2026/06/30 16:43:04.000000 from 192.0.2.10:61153 rejected  proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000"
+results["s00-raw"]["crowdsecurity/non-syslog"][6].Evt.Whitelisted == false
+results["s00-raw"]["crowdsecurity/non-syslog"][7].Success == true
+results["s00-raw"]["crowdsecurity/non-syslog"][7].Evt.Parsed["message"] == "2026/06/30 16:43:05.000000 from 192.0.2.10:61154 rejected  proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000"
+results["s00-raw"]["crowdsecurity/non-syslog"][7].Evt.Whitelisted == false
+results["s00-raw"]["crowdsecurity/non-syslog"][8].Success == true
+results["s00-raw"]["crowdsecurity/non-syslog"][8].Evt.Parsed["message"] == "2026/06/30 16:43:10.000000 from 192.0.2.20:61200 rejected  proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000"
+results["s00-raw"]["crowdsecurity/non-syslog"][8].Evt.Whitelisted == false
+results["s00-raw"]["crowdsecurity/non-syslog"][9].Success == true
+results["s00-raw"]["crowdsecurity/non-syslog"][9].Evt.Parsed["message"] == "2026/06/30 16:43:11.000000 from 192.0.2.20:61201 rejected  proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000"
+results["s00-raw"]["crowdsecurity/non-syslog"][9].Evt.Whitelisted == false
+results["s00-raw"]["crowdsecurity/non-syslog"][10].Success == true
+results["s00-raw"]["crowdsecurity/non-syslog"][10].Evt.Parsed["message"] == "2026/06/30 16:43:11.500000 from 198.51.100.60:62504 accepted tcp:torrentclaw.com:443 [direct]"
+results["s00-raw"]["crowdsecurity/non-syslog"][10].Evt.Whitelisted == false
+results["s00-raw"]["crowdsecurity/non-syslog"][11].Success == true
+results["s00-raw"]["crowdsecurity/non-syslog"][11].Evt.Parsed["message"] == "2026/06/30 16:43:12.000000 from 192.0.2.20:61202 rejected  proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000"
+results["s00-raw"]["crowdsecurity/non-syslog"][11].Evt.Whitelisted == false
+results["s00-raw"]["crowdsecurity/non-syslog"][12].Success == true
+results["s00-raw"]["crowdsecurity/non-syslog"][12].Evt.Parsed["message"] == "2026/06/30 16:43:13.000000 from 192.0.2.20:61203 rejected  proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000"
+results["s00-raw"]["crowdsecurity/non-syslog"][12].Evt.Whitelisted == false
+results["s00-raw"]["crowdsecurity/non-syslog"][13].Success == true
+results["s00-raw"]["crowdsecurity/non-syslog"][13].Evt.Parsed["message"] == "2026/06/30 16:43:14.000000 from 192.0.2.20:61204 rejected  proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000"
+results["s00-raw"]["crowdsecurity/non-syslog"][13].Evt.Whitelisted == false
+results["s00-raw"]["crowdsecurity/non-syslog"][14].Success == true
+results["s00-raw"]["crowdsecurity/non-syslog"][14].Evt.Parsed["message"] == "2026/06/30 16:43:15.000000 from 192.0.2.20:61205 rejected  proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000"
+results["s00-raw"]["crowdsecurity/non-syslog"][14].Evt.Whitelisted == false
+len(results["s01-parse"]["xulianh/xray-logs"]) == 15
+results["s01-parse"]["xulianh/xray-logs"][0].Success == true
+results["s01-parse"]["xulianh/xray-logs"][0].Evt.Parsed["action"] == "rejected"
+results["s01-parse"]["xulianh/xray-logs"][0].Evt.Parsed["day"] == "30"
+results["s01-parse"]["xulianh/xray-logs"][0].Evt.Parsed["hour"] == "16"
+results["s01-parse"]["xulianh/xray-logs"][0].Evt.Parsed["message"] == "2026/06/30 16:43:00.000000 from 192.0.2.10:61149 rejected  proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000"
+results["s01-parse"]["xulianh/xray-logs"][0].Evt.Parsed["micro"] == "000000"
+results["s01-parse"]["xulianh/xray-logs"][0].Evt.Parsed["minute"] == "43"
+results["s01-parse"]["xulianh/xray-logs"][0].Evt.Parsed["month"] == "06"
+results["s01-parse"]["xulianh/xray-logs"][0].Evt.Parsed["reason"] == " proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000"
+results["s01-parse"]["xulianh/xray-logs"][0].Evt.Parsed["second"] == "00"
+results["s01-parse"]["xulianh/xray-logs"][0].Evt.Parsed["source_ip"] == "192.0.2.10"
+results["s01-parse"]["xulianh/xray-logs"][0].Evt.Parsed["source_port"] == "61149"
+results["s01-parse"]["xulianh/xray-logs"][0].Evt.Parsed["year"] == "2026"
+results["s01-parse"]["xulianh/xray-logs"][0].Evt.Meta["action"] == "rejected"
+results["s01-parse"]["xulianh/xray-logs"][0].Evt.Meta["source_ip"] == "192.0.2.10"
+results["s01-parse"]["xulianh/xray-logs"][0].Evt.Whitelisted == false
+results["s01-parse"]["xulianh/xray-logs"][1].Success == true
+results["s01-parse"]["xulianh/xray-logs"][1].Evt.Parsed["action"] == "rejected"
+results["s01-parse"]["xulianh/xray-logs"][1].Evt.Parsed["day"] == "30"
+results["s01-parse"]["xulianh/xray-logs"][1].Evt.Parsed["hour"] == "16"
+results["s01-parse"]["xulianh/xray-logs"][1].Evt.Parsed["message"] == "2026/06/30 16:43:01.000000 from 192.0.2.10:61150 rejected  proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000"
+results["s01-parse"]["xulianh/xray-logs"][1].Evt.Parsed["micro"] == "000000"
+results["s01-parse"]["xulianh/xray-logs"][1].Evt.Parsed["minute"] == "43"
+results["s01-parse"]["xulianh/xray-logs"][1].Evt.Parsed["month"] == "06"
+results["s01-parse"]["xulianh/xray-logs"][1].Evt.Parsed["reason"] == " proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000"
+results["s01-parse"]["xulianh/xray-logs"][1].Evt.Parsed["second"] == "01"
+results["s01-parse"]["xulianh/xray-logs"][1].Evt.Parsed["source_ip"] == "192.0.2.10"
+results["s01-parse"]["xulianh/xray-logs"][1].Evt.Parsed["source_port"] == "61150"
+results["s01-parse"]["xulianh/xray-logs"][1].Evt.Parsed["year"] == "2026"
+results["s01-parse"]["xulianh/xray-logs"][1].Evt.Meta["action"] == "rejected"
+results["s01-parse"]["xulianh/xray-logs"][1].Evt.Meta["source_ip"] == "192.0.2.10"
+results["s01-parse"]["xulianh/xray-logs"][1].Evt.Whitelisted == false
+results["s01-parse"]["xulianh/xray-logs"][2].Success == true
+results["s01-parse"]["xulianh/xray-logs"][2].Evt.Parsed["action"] == "accepted"
+results["s01-parse"]["xulianh/xray-logs"][2].Evt.Parsed["day"] == "30"
+results["s01-parse"]["xulianh/xray-logs"][2].Evt.Parsed["hour"] == "16"
+results["s01-parse"]["xulianh/xray-logs"][2].Evt.Parsed["message"] == "2026/06/30 16:43:01.500000 from 198.51.100.55:62204 accepted tcp:www.gstatic.com:443 [direct]"
+results["s01-parse"]["xulianh/xray-logs"][2].Evt.Parsed["micro"] == "500000"
+results["s01-parse"]["xulianh/xray-logs"][2].Evt.Parsed["minute"] == "43"
+results["s01-parse"]["xulianh/xray-logs"][2].Evt.Parsed["month"] == "06"
+results["s01-parse"]["xulianh/xray-logs"][2].Evt.Parsed["reason"] == "tcp:www.gstatic.com:443 [direct]"
+results["s01-parse"]["xulianh/xray-logs"][2].Evt.Parsed["second"] == "01"
+results["s01-parse"]["xulianh/xray-logs"][2].Evt.Parsed["source_ip"] == "198.51.100.55"
+results["s01-parse"]["xulianh/xray-logs"][2].Evt.Parsed["source_port"] == "62204"
+results["s01-parse"]["xulianh/xray-logs"][2].Evt.Parsed["year"] == "2026"
+results["s01-parse"]["xulianh/xray-logs"][2].Evt.Meta["action"] == "accepted"
+results["s01-parse"]["xulianh/xray-logs"][2].Evt.Meta["source_ip"] == "198.51.100.55"
+results["s01-parse"]["xulianh/xray-logs"][2].Evt.Whitelisted == false
+results["s01-parse"]["xulianh/xray-logs"][3].Success == true
+results["s01-parse"]["xulianh/xray-logs"][3].Evt.Parsed["action"] == "rejected"
+results["s01-parse"]["xulianh/xray-logs"][3].Evt.Parsed["day"] == "30"
+results["s01-parse"]["xulianh/xray-logs"][3].Evt.Parsed["hour"] == "16"
+results["s01-parse"]["xulianh/xray-logs"][3].Evt.Parsed["message"] == "2026/06/30 16:43:02.000000 from 192.0.2.10:61151 rejected  proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000"
+results["s01-parse"]["xulianh/xray-logs"][3].Evt.Parsed["micro"] == "000000"
+results["s01-parse"]["xulianh/xray-logs"][3].Evt.Parsed["minute"] == "43"
+results["s01-parse"]["xulianh/xray-logs"][3].Evt.Parsed["month"] == "06"
+results["s01-parse"]["xulianh/xray-logs"][3].Evt.Parsed["reason"] == " proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000"
+results["s01-parse"]["xulianh/xray-logs"][3].Evt.Parsed["second"] == "02"
+results["s01-parse"]["xulianh/xray-logs"][3].Evt.Parsed["source_ip"] == "192.0.2.10"
+results["s01-parse"]["xulianh/xray-logs"][3].Evt.Parsed["source_port"] == "61151"
+results["s01-parse"]["xulianh/xray-logs"][3].Evt.Parsed["year"] == "2026"
+results["s01-parse"]["xulianh/xray-logs"][3].Evt.Meta["action"] == "rejected"
+results["s01-parse"]["xulianh/xray-logs"][3].Evt.Meta["source_ip"] == "192.0.2.10"
+results["s01-parse"]["xulianh/xray-logs"][3].Evt.Whitelisted == false
+results["s01-parse"]["xulianh/xray-logs"][4].Success == true
+results["s01-parse"]["xulianh/xray-logs"][4].Evt.Parsed["action"] == "rejected"
+results["s01-parse"]["xulianh/xray-logs"][4].Evt.Parsed["day"] == "30"
+results["s01-parse"]["xulianh/xray-logs"][4].Evt.Parsed["hour"] == "16"
+results["s01-parse"]["xulianh/xray-logs"][4].Evt.Parsed["message"] == "2026/06/30 16:43:03.000000 from 192.0.2.10:61152 rejected  proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000"
+results["s01-parse"]["xulianh/xray-logs"][4].Evt.Parsed["micro"] == "000000"
+results["s01-parse"]["xulianh/xray-logs"][4].Evt.Parsed["minute"] == "43"
+results["s01-parse"]["xulianh/xray-logs"][4].Evt.Parsed["month"] == "06"
+results["s01-parse"]["xulianh/xray-logs"][4].Evt.Parsed["reason"] == " proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000"
+results["s01-parse"]["xulianh/xray-logs"][4].Evt.Parsed["second"] == "03"
+results["s01-parse"]["xulianh/xray-logs"][4].Evt.Parsed["source_ip"] == "192.0.2.10"
+results["s01-parse"]["xulianh/xray-logs"][4].Evt.Parsed["source_port"] == "61152"
+results["s01-parse"]["xulianh/xray-logs"][4].Evt.Parsed["year"] == "2026"
+results["s01-parse"]["xulianh/xray-logs"][4].Evt.Meta["action"] == "rejected"
+results["s01-parse"]["xulianh/xray-logs"][4].Evt.Meta["source_ip"] == "192.0.2.10"
+results["s01-parse"]["xulianh/xray-logs"][4].Evt.Whitelisted == false
+results["s01-parse"]["xulianh/xray-logs"][5].Success == true
+results["s01-parse"]["xulianh/xray-logs"][5].Evt.Parsed["action"] == "accepted"
+results["s01-parse"]["xulianh/xray-logs"][5].Evt.Parsed["day"] == "30"
+results["s01-parse"]["xulianh/xray-logs"][5].Evt.Parsed["hour"] == "16"
+results["s01-parse"]["xulianh/xray-logs"][5].Evt.Parsed["message"] == "2026/06/30 16:43:03.500000 from 192.0.2.10:62264 accepted tcp:1.1.1.1:443 [direct]"
+results["s01-parse"]["xulianh/xray-logs"][5].Evt.Parsed["micro"] == "500000"
+results["s01-parse"]["xulianh/xray-logs"][5].Evt.Parsed["minute"] == "43"
+results["s01-parse"]["xulianh/xray-logs"][5].Evt.Parsed["month"] == "06"
+results["s01-parse"]["xulianh/xray-logs"][5].Evt.Parsed["reason"] == "tcp:1.1.1.1:443 [direct]"
+results["s01-parse"]["xulianh/xray-logs"][5].Evt.Parsed["second"] == "03"
+results["s01-parse"]["xulianh/xray-logs"][5].Evt.Parsed["source_ip"] == "192.0.2.10"
+results["s01-parse"]["xulianh/xray-logs"][5].Evt.Parsed["source_port"] == "62264"
+results["s01-parse"]["xulianh/xray-logs"][5].Evt.Parsed["year"] == "2026"
+results["s01-parse"]["xulianh/xray-logs"][5].Evt.Meta["action"] == "accepted"
+results["s01-parse"]["xulianh/xray-logs"][5].Evt.Meta["source_ip"] == "192.0.2.10"
+results["s01-parse"]["xulianh/xray-logs"][5].Evt.Whitelisted == false
+results["s01-parse"]["xulianh/xray-logs"][6].Success == true
+results["s01-parse"]["xulianh/xray-logs"][6].Evt.Parsed["action"] == "rejected"
+results["s01-parse"]["xulianh/xray-logs"][6].Evt.Parsed["day"] == "30"
+results["s01-parse"]["xulianh/xray-logs"][6].Evt.Parsed["hour"] == "16"
+results["s01-parse"]["xulianh/xray-logs"][6].Evt.Parsed["message"] == "2026/06/30 16:43:04.000000 from 192.0.2.10:61153 rejected  proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000"
+results["s01-parse"]["xulianh/xray-logs"][6].Evt.Parsed["micro"] == "000000"
+results["s01-parse"]["xulianh/xray-logs"][6].Evt.Parsed["minute"] == "43"
+results["s01-parse"]["xulianh/xray-logs"][6].Evt.Parsed["month"] == "06"
+results["s01-parse"]["xulianh/xray-logs"][6].Evt.Parsed["reason"] == " proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000"
+results["s01-parse"]["xulianh/xray-logs"][6].Evt.Parsed["second"] == "04"
+results["s01-parse"]["xulianh/xray-logs"][6].Evt.Parsed["source_ip"] == "192.0.2.10"
+results["s01-parse"]["xulianh/xray-logs"][6].Evt.Parsed["source_port"] == "61153"
+results["s01-parse"]["xulianh/xray-logs"][6].Evt.Parsed["year"] == "2026"
+results["s01-parse"]["xulianh/xray-logs"][6].Evt.Meta["action"] == "rejected"
+results["s01-parse"]["xulianh/xray-logs"][6].Evt.Meta["source_ip"] == "192.0.2.10"
+results["s01-parse"]["xulianh/xray-logs"][6].Evt.Whitelisted == false
+results["s01-parse"]["xulianh/xray-logs"][7].Success == true
+results["s01-parse"]["xulianh/xray-logs"][7].Evt.Parsed["action"] == "rejected"
+results["s01-parse"]["xulianh/xray-logs"][7].Evt.Parsed["day"] == "30"
+results["s01-parse"]["xulianh/xray-logs"][7].Evt.Parsed["hour"] == "16"
+results["s01-parse"]["xulianh/xray-logs"][7].Evt.Parsed["message"] == "2026/06/30 16:43:05.000000 from 192.0.2.10:61154 rejected  proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000"
+results["s01-parse"]["xulianh/xray-logs"][7].Evt.Parsed["micro"] == "000000"
+results["s01-parse"]["xulianh/xray-logs"][7].Evt.Parsed["minute"] == "43"
+results["s01-parse"]["xulianh/xray-logs"][7].Evt.Parsed["month"] == "06"
+results["s01-parse"]["xulianh/xray-logs"][7].Evt.Parsed["reason"] == " proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000"
+results["s01-parse"]["xulianh/xray-logs"][7].Evt.Parsed["second"] == "05"
+results["s01-parse"]["xulianh/xray-logs"][7].Evt.Parsed["source_ip"] == "192.0.2.10"
+results["s01-parse"]["xulianh/xray-logs"][7].Evt.Parsed["source_port"] == "61154"
+results["s01-parse"]["xulianh/xray-logs"][7].Evt.Parsed["year"] == "2026"
+results["s01-parse"]["xulianh/xray-logs"][7].Evt.Meta["action"] == "rejected"
+results["s01-parse"]["xulianh/xray-logs"][7].Evt.Meta["source_ip"] == "192.0.2.10"
+results["s01-parse"]["xulianh/xray-logs"][7].Evt.Whitelisted == false
+results["s01-parse"]["xulianh/xray-logs"][8].Success == true
+results["s01-parse"]["xulianh/xray-logs"][8].Evt.Parsed["action"] == "rejected"
+results["s01-parse"]["xulianh/xray-logs"][8].Evt.Parsed["day"] == "30"
+results["s01-parse"]["xulianh/xray-logs"][8].Evt.Parsed["hour"] == "16"
+results["s01-parse"]["xulianh/xray-logs"][8].Evt.Parsed["message"] == "2026/06/30 16:43:10.000000 from 192.0.2.20:61200 rejected  proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000"
+results["s01-parse"]["xulianh/xray-logs"][8].Evt.Parsed["micro"] == "000000"
+results["s01-parse"]["xulianh/xray-logs"][8].Evt.Parsed["minute"] == "43"
+results["s01-parse"]["xulianh/xray-logs"][8].Evt.Parsed["month"] == "06"
+results["s01-parse"]["xulianh/xray-logs"][8].Evt.Parsed["reason"] == " proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000"
+results["s01-parse"]["xulianh/xray-logs"][8].Evt.Parsed["second"] == "10"
+results["s01-parse"]["xulianh/xray-logs"][8].Evt.Parsed["source_ip"] == "192.0.2.20"
+results["s01-parse"]["xulianh/xray-logs"][8].Evt.Parsed["source_port"] == "61200"
+results["s01-parse"]["xulianh/xray-logs"][8].Evt.Parsed["year"] == "2026"
+results["s01-parse"]["xulianh/xray-logs"][8].Evt.Meta["action"] == "rejected"
+results["s01-parse"]["xulianh/xray-logs"][8].Evt.Meta["source_ip"] == "192.0.2.20"
+results["s01-parse"]["xulianh/xray-logs"][8].Evt.Whitelisted == false
+results["s01-parse"]["xulianh/xray-logs"][9].Success == true
+results["s01-parse"]["xulianh/xray-logs"][9].Evt.Parsed["action"] == "rejected"
+results["s01-parse"]["xulianh/xray-logs"][9].Evt.Parsed["day"] == "30"
+results["s01-parse"]["xulianh/xray-logs"][9].Evt.Parsed["hour"] == "16"
+results["s01-parse"]["xulianh/xray-logs"][9].Evt.Parsed["message"] == "2026/06/30 16:43:11.000000 from 192.0.2.20:61201 rejected  proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000"
+results["s01-parse"]["xulianh/xray-logs"][9].Evt.Parsed["micro"] == "000000"
+results["s01-parse"]["xulianh/xray-logs"][9].Evt.Parsed["minute"] == "43"
+results["s01-parse"]["xulianh/xray-logs"][9].Evt.Parsed["month"] == "06"
+results["s01-parse"]["xulianh/xray-logs"][9].Evt.Parsed["reason"] == " proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000"
+results["s01-parse"]["xulianh/xray-logs"][9].Evt.Parsed["second"] == "11"
+results["s01-parse"]["xulianh/xray-logs"][9].Evt.Parsed["source_ip"] == "192.0.2.20"
+results["s01-parse"]["xulianh/xray-logs"][9].Evt.Parsed["source_port"] == "61201"
+results["s01-parse"]["xulianh/xray-logs"][9].Evt.Parsed["year"] == "2026"
+results["s01-parse"]["xulianh/xray-logs"][9].Evt.Meta["action"] == "rejected"
+results["s01-parse"]["xulianh/xray-logs"][9].Evt.Meta["source_ip"] == "192.0.2.20"
+results["s01-parse"]["xulianh/xray-logs"][9].Evt.Whitelisted == false
+results["s01-parse"]["xulianh/xray-logs"][10].Success == true
+results["s01-parse"]["xulianh/xray-logs"][10].Evt.Parsed["action"] == "accepted"
+results["s01-parse"]["xulianh/xray-logs"][10].Evt.Parsed["day"] == "30"
+results["s01-parse"]["xulianh/xray-logs"][10].Evt.Parsed["hour"] == "16"
+results["s01-parse"]["xulianh/xray-logs"][10].Evt.Parsed["message"] == "2026/06/30 16:43:11.500000 from 198.51.100.60:62504 accepted tcp:torrentclaw.com:443 [direct]"
+results["s01-parse"]["xulianh/xray-logs"][10].Evt.Parsed["micro"] == "500000"
+results["s01-parse"]["xulianh/xray-logs"][10].Evt.Parsed["minute"] == "43"
+results["s01-parse"]["xulianh/xray-logs"][10].Evt.Parsed["month"] == "06"
+results["s01-parse"]["xulianh/xray-logs"][10].Evt.Parsed["reason"] == "tcp:torrentclaw.com:443 [direct]"
+results["s01-parse"]["xulianh/xray-logs"][10].Evt.Parsed["second"] == "11"
+results["s01-parse"]["xulianh/xray-logs"][10].Evt.Parsed["source_ip"] == "198.51.100.60"
+results["s01-parse"]["xulianh/xray-logs"][10].Evt.Parsed["source_port"] == "62504"
+results["s01-parse"]["xulianh/xray-logs"][10].Evt.Parsed["year"] == "2026"
+results["s01-parse"]["xulianh/xray-logs"][10].Evt.Meta["action"] == "accepted"
+results["s01-parse"]["xulianh/xray-logs"][10].Evt.Meta["source_ip"] == "198.51.100.60"
+results["s01-parse"]["xulianh/xray-logs"][10].Evt.Whitelisted == false
+results["s01-parse"]["xulianh/xray-logs"][11].Success == true
+results["s01-parse"]["xulianh/xray-logs"][11].Evt.Parsed["action"] == "rejected"
+results["s01-parse"]["xulianh/xray-logs"][11].Evt.Parsed["day"] == "30"
+results["s01-parse"]["xulianh/xray-logs"][11].Evt.Parsed["hour"] == "16"
+results["s01-parse"]["xulianh/xray-logs"][11].Evt.Parsed["message"] == "2026/06/30 16:43:12.000000 from 192.0.2.20:61202 rejected  proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000"
+results["s01-parse"]["xulianh/xray-logs"][11].Evt.Parsed["micro"] == "000000"
+results["s01-parse"]["xulianh/xray-logs"][11].Evt.Parsed["minute"] == "43"
+results["s01-parse"]["xulianh/xray-logs"][11].Evt.Parsed["month"] == "06"
+results["s01-parse"]["xulianh/xray-logs"][11].Evt.Parsed["reason"] == " proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000"
+results["s01-parse"]["xulianh/xray-logs"][11].Evt.Parsed["second"] == "12"
+results["s01-parse"]["xulianh/xray-logs"][11].Evt.Parsed["source_ip"] == "192.0.2.20"
+results["s01-parse"]["xulianh/xray-logs"][11].Evt.Parsed["source_port"] == "61202"
+results["s01-parse"]["xulianh/xray-logs"][11].Evt.Parsed["year"] == "2026"
+results["s01-parse"]["xulianh/xray-logs"][11].Evt.Meta["action"] == "rejected"
+results["s01-parse"]["xulianh/xray-logs"][11].Evt.Meta["source_ip"] == "192.0.2.20"
+results["s01-parse"]["xulianh/xray-logs"][11].Evt.Whitelisted == false
+results["s01-parse"]["xulianh/xray-logs"][12].Success == true
+results["s01-parse"]["xulianh/xray-logs"][12].Evt.Parsed["action"] == "rejected"
+results["s01-parse"]["xulianh/xray-logs"][12].Evt.Parsed["day"] == "30"
+results["s01-parse"]["xulianh/xray-logs"][12].Evt.Parsed["hour"] == "16"
+results["s01-parse"]["xulianh/xray-logs"][12].Evt.Parsed["message"] == "2026/06/30 16:43:13.000000 from 192.0.2.20:61203 rejected  proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000"
+results["s01-parse"]["xulianh/xray-logs"][12].Evt.Parsed["micro"] == "000000"
+results["s01-parse"]["xulianh/xray-logs"][12].Evt.Parsed["minute"] == "43"
+results["s01-parse"]["xulianh/xray-logs"][12].Evt.Parsed["month"] == "06"
+results["s01-parse"]["xulianh/xray-logs"][12].Evt.Parsed["reason"] == " proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000"
+results["s01-parse"]["xulianh/xray-logs"][12].Evt.Parsed["second"] == "13"
+results["s01-parse"]["xulianh/xray-logs"][12].Evt.Parsed["source_ip"] == "192.0.2.20"
+results["s01-parse"]["xulianh/xray-logs"][12].Evt.Parsed["source_port"] == "61203"
+results["s01-parse"]["xulianh/xray-logs"][12].Evt.Parsed["year"] == "2026"
+results["s01-parse"]["xulianh/xray-logs"][12].Evt.Meta["action"] == "rejected"
+results["s01-parse"]["xulianh/xray-logs"][12].Evt.Meta["source_ip"] == "192.0.2.20"
+results["s01-parse"]["xulianh/xray-logs"][12].Evt.Whitelisted == false
+results["s01-parse"]["xulianh/xray-logs"][13].Success == true
+results["s01-parse"]["xulianh/xray-logs"][13].Evt.Parsed["action"] == "rejected"
+results["s01-parse"]["xulianh/xray-logs"][13].Evt.Parsed["day"] == "30"
+results["s01-parse"]["xulianh/xray-logs"][13].Evt.Parsed["hour"] == "16"
+results["s01-parse"]["xulianh/xray-logs"][13].Evt.Parsed["message"] == "2026/06/30 16:43:14.000000 from 192.0.2.20:61204 rejected  proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000"
+results["s01-parse"]["xulianh/xray-logs"][13].Evt.Parsed["micro"] == "000000"
+results["s01-parse"]["xulianh/xray-logs"][13].Evt.Parsed["minute"] == "43"
+results["s01-parse"]["xulianh/xray-logs"][13].Evt.Parsed["month"] == "06"
+results["s01-parse"]["xulianh/xray-logs"][13].Evt.Parsed["reason"] == " proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000"
+results["s01-parse"]["xulianh/xray-logs"][13].Evt.Parsed["second"] == "14"
+results["s01-parse"]["xulianh/xray-logs"][13].Evt.Parsed["source_ip"] == "192.0.2.20"
+results["s01-parse"]["xulianh/xray-logs"][13].Evt.Parsed["source_port"] == "61204"
+results["s01-parse"]["xulianh/xray-logs"][13].Evt.Parsed["year"] == "2026"
+results["s01-parse"]["xulianh/xray-logs"][13].Evt.Meta["action"] == "rejected"
+results["s01-parse"]["xulianh/xray-logs"][13].Evt.Meta["source_ip"] == "192.0.2.20"
+results["s01-parse"]["xulianh/xray-logs"][13].Evt.Whitelisted == false
+results["s01-parse"]["xulianh/xray-logs"][14].Success == true
+results["s01-parse"]["xulianh/xray-logs"][14].Evt.Parsed["action"] == "rejected"
+results["s01-parse"]["xulianh/xray-logs"][14].Evt.Parsed["day"] == "30"
+results["s01-parse"]["xulianh/xray-logs"][14].Evt.Parsed["hour"] == "16"
+results["s01-parse"]["xulianh/xray-logs"][14].Evt.Parsed["message"] == "2026/06/30 16:43:15.000000 from 192.0.2.20:61205 rejected  proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000"
+results["s01-parse"]["xulianh/xray-logs"][14].Evt.Parsed["micro"] == "000000"
+results["s01-parse"]["xulianh/xray-logs"][14].Evt.Parsed["minute"] == "43"
+results["s01-parse"]["xulianh/xray-logs"][14].Evt.Parsed["month"] == "06"
+results["s01-parse"]["xulianh/xray-logs"][14].Evt.Parsed["reason"] == " proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000"
+results["s01-parse"]["xulianh/xray-logs"][14].Evt.Parsed["second"] == "15"
+results["s01-parse"]["xulianh/xray-logs"][14].Evt.Parsed["source_ip"] == "192.0.2.20"
+results["s01-parse"]["xulianh/xray-logs"][14].Evt.Parsed["source_port"] == "61205"
+results["s01-parse"]["xulianh/xray-logs"][14].Evt.Parsed["year"] == "2026"
+results["s01-parse"]["xulianh/xray-logs"][14].Evt.Meta["action"] == "rejected"
+results["s01-parse"]["xulianh/xray-logs"][14].Evt.Meta["source_ip"] == "192.0.2.20"
+results["s01-parse"]["xulianh/xray-logs"][14].Evt.Whitelisted == false
+len(results["s02-enrich"]["crowdsecurity/dateparse-enrich"]) == 15
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][0].Success == true
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][0].Evt.Parsed["action"] == "rejected"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][0].Evt.Parsed["day"] == "30"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][0].Evt.Parsed["hour"] == "16"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][0].Evt.Parsed["message"] == "2026/06/30 16:43:00.000000 from 192.0.2.10:61149 rejected  proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][0].Evt.Parsed["micro"] == "000000"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][0].Evt.Parsed["minute"] == "43"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][0].Evt.Parsed["month"] == "06"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][0].Evt.Parsed["reason"] == " proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][0].Evt.Parsed["second"] == "00"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][0].Evt.Parsed["source_ip"] == "192.0.2.10"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][0].Evt.Parsed["source_port"] == "61149"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][0].Evt.Parsed["year"] == "2026"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][0].Evt.Meta["action"] == "rejected"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][0].Evt.Meta["source_ip"] == "192.0.2.10"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][0].Evt.Meta["timestamp"] == "2026-06-30T16:43:00Z"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][0].Evt.Enriched["MarshaledTime"] == "2026-06-30T16:43:00Z"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][0].Evt.Whitelisted == false
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][1].Success == true
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][1].Evt.Parsed["action"] == "rejected"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][1].Evt.Parsed["day"] == "30"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][1].Evt.Parsed["hour"] == "16"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][1].Evt.Parsed["message"] == "2026/06/30 16:43:01.000000 from 192.0.2.10:61150 rejected  proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][1].Evt.Parsed["micro"] == "000000"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][1].Evt.Parsed["minute"] == "43"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][1].Evt.Parsed["month"] == "06"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][1].Evt.Parsed["reason"] == " proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][1].Evt.Parsed["second"] == "01"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][1].Evt.Parsed["source_ip"] == "192.0.2.10"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][1].Evt.Parsed["source_port"] == "61150"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][1].Evt.Parsed["year"] == "2026"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][1].Evt.Meta["action"] == "rejected"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][1].Evt.Meta["source_ip"] == "192.0.2.10"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][1].Evt.Meta["timestamp"] == "2026-06-30T16:43:01Z"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][1].Evt.Enriched["MarshaledTime"] == "2026-06-30T16:43:01Z"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][1].Evt.Whitelisted == false
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][2].Success == true
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][2].Evt.Parsed["action"] == "accepted"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][2].Evt.Parsed["day"] == "30"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][2].Evt.Parsed["hour"] == "16"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][2].Evt.Parsed["message"] == "2026/06/30 16:43:01.500000 from 198.51.100.55:62204 accepted tcp:www.gstatic.com:443 [direct]"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][2].Evt.Parsed["micro"] == "500000"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][2].Evt.Parsed["minute"] == "43"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][2].Evt.Parsed["month"] == "06"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][2].Evt.Parsed["reason"] == "tcp:www.gstatic.com:443 [direct]"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][2].Evt.Parsed["second"] == "01"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][2].Evt.Parsed["source_ip"] == "198.51.100.55"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][2].Evt.Parsed["source_port"] == "62204"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][2].Evt.Parsed["year"] == "2026"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][2].Evt.Meta["action"] == "accepted"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][2].Evt.Meta["source_ip"] == "198.51.100.55"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][2].Evt.Meta["timestamp"] == "2026-06-30T16:43:01Z"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][2].Evt.Enriched["MarshaledTime"] == "2026-06-30T16:43:01Z"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][2].Evt.Whitelisted == false
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][3].Success == true
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][3].Evt.Parsed["action"] == "rejected"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][3].Evt.Parsed["day"] == "30"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][3].Evt.Parsed["hour"] == "16"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][3].Evt.Parsed["message"] == "2026/06/30 16:43:02.000000 from 192.0.2.10:61151 rejected  proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][3].Evt.Parsed["micro"] == "000000"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][3].Evt.Parsed["minute"] == "43"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][3].Evt.Parsed["month"] == "06"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][3].Evt.Parsed["reason"] == " proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][3].Evt.Parsed["second"] == "02"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][3].Evt.Parsed["source_ip"] == "192.0.2.10"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][3].Evt.Parsed["source_port"] == "61151"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][3].Evt.Parsed["year"] == "2026"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][3].Evt.Meta["action"] == "rejected"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][3].Evt.Meta["source_ip"] == "192.0.2.10"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][3].Evt.Meta["timestamp"] == "2026-06-30T16:43:02Z"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][3].Evt.Enriched["MarshaledTime"] == "2026-06-30T16:43:02Z"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][3].Evt.Whitelisted == false
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][4].Success == true
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][4].Evt.Parsed["action"] == "rejected"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][4].Evt.Parsed["day"] == "30"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][4].Evt.Parsed["hour"] == "16"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][4].Evt.Parsed["message"] == "2026/06/30 16:43:03.000000 from 192.0.2.10:61152 rejected  proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][4].Evt.Parsed["micro"] == "000000"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][4].Evt.Parsed["minute"] == "43"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][4].Evt.Parsed["month"] == "06"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][4].Evt.Parsed["reason"] == " proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][4].Evt.Parsed["second"] == "03"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][4].Evt.Parsed["source_ip"] == "192.0.2.10"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][4].Evt.Parsed["source_port"] == "61152"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][4].Evt.Parsed["year"] == "2026"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][4].Evt.Meta["action"] == "rejected"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][4].Evt.Meta["source_ip"] == "192.0.2.10"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][4].Evt.Meta["timestamp"] == "2026-06-30T16:43:03Z"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][4].Evt.Enriched["MarshaledTime"] == "2026-06-30T16:43:03Z"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][4].Evt.Whitelisted == false
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][5].Success == true
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][5].Evt.Parsed["action"] == "accepted"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][5].Evt.Parsed["day"] == "30"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][5].Evt.Parsed["hour"] == "16"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][5].Evt.Parsed["message"] == "2026/06/30 16:43:03.500000 from 192.0.2.10:62264 accepted tcp:1.1.1.1:443 [direct]"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][5].Evt.Parsed["micro"] == "500000"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][5].Evt.Parsed["minute"] == "43"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][5].Evt.Parsed["month"] == "06"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][5].Evt.Parsed["reason"] == "tcp:1.1.1.1:443 [direct]"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][5].Evt.Parsed["second"] == "03"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][5].Evt.Parsed["source_ip"] == "192.0.2.10"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][5].Evt.Parsed["source_port"] == "62264"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][5].Evt.Parsed["year"] == "2026"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][5].Evt.Meta["action"] == "accepted"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][5].Evt.Meta["source_ip"] == "192.0.2.10"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][5].Evt.Meta["timestamp"] == "2026-06-30T16:43:03Z"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][5].Evt.Enriched["MarshaledTime"] == "2026-06-30T16:43:03Z"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][5].Evt.Whitelisted == false
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][6].Success == true
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][6].Evt.Parsed["action"] == "rejected"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][6].Evt.Parsed["day"] == "30"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][6].Evt.Parsed["hour"] == "16"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][6].Evt.Parsed["message"] == "2026/06/30 16:43:04.000000 from 192.0.2.10:61153 rejected  proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][6].Evt.Parsed["micro"] == "000000"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][6].Evt.Parsed["minute"] == "43"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][6].Evt.Parsed["month"] == "06"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][6].Evt.Parsed["reason"] == " proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][6].Evt.Parsed["second"] == "04"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][6].Evt.Parsed["source_ip"] == "192.0.2.10"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][6].Evt.Parsed["source_port"] == "61153"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][6].Evt.Parsed["year"] == "2026"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][6].Evt.Meta["action"] == "rejected"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][6].Evt.Meta["source_ip"] == "192.0.2.10"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][6].Evt.Meta["timestamp"] == "2026-06-30T16:43:04Z"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][6].Evt.Enriched["MarshaledTime"] == "2026-06-30T16:43:04Z"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][6].Evt.Whitelisted == false
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][7].Success == true
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][7].Evt.Parsed["action"] == "rejected"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][7].Evt.Parsed["day"] == "30"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][7].Evt.Parsed["hour"] == "16"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][7].Evt.Parsed["message"] == "2026/06/30 16:43:05.000000 from 192.0.2.10:61154 rejected  proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][7].Evt.Parsed["micro"] == "000000"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][7].Evt.Parsed["minute"] == "43"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][7].Evt.Parsed["month"] == "06"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][7].Evt.Parsed["reason"] == " proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][7].Evt.Parsed["second"] == "05"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][7].Evt.Parsed["source_ip"] == "192.0.2.10"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][7].Evt.Parsed["source_port"] == "61154"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][7].Evt.Parsed["year"] == "2026"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][7].Evt.Meta["action"] == "rejected"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][7].Evt.Meta["source_ip"] == "192.0.2.10"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][7].Evt.Meta["timestamp"] == "2026-06-30T16:43:05Z"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][7].Evt.Enriched["MarshaledTime"] == "2026-06-30T16:43:05Z"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][7].Evt.Whitelisted == false
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][8].Success == true
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][8].Evt.Parsed["action"] == "rejected"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][8].Evt.Parsed["day"] == "30"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][8].Evt.Parsed["hour"] == "16"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][8].Evt.Parsed["message"] == "2026/06/30 16:43:10.000000 from 192.0.2.20:61200 rejected  proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][8].Evt.Parsed["micro"] == "000000"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][8].Evt.Parsed["minute"] == "43"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][8].Evt.Parsed["month"] == "06"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][8].Evt.Parsed["reason"] == " proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][8].Evt.Parsed["second"] == "10"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][8].Evt.Parsed["source_ip"] == "192.0.2.20"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][8].Evt.Parsed["source_port"] == "61200"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][8].Evt.Parsed["year"] == "2026"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][8].Evt.Meta["action"] == "rejected"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][8].Evt.Meta["source_ip"] == "192.0.2.20"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][8].Evt.Meta["timestamp"] == "2026-06-30T16:43:10Z"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][8].Evt.Enriched["MarshaledTime"] == "2026-06-30T16:43:10Z"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][8].Evt.Whitelisted == false
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][9].Success == true
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][9].Evt.Parsed["action"] == "rejected"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][9].Evt.Parsed["day"] == "30"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][9].Evt.Parsed["hour"] == "16"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][9].Evt.Parsed["message"] == "2026/06/30 16:43:11.000000 from 192.0.2.20:61201 rejected  proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][9].Evt.Parsed["micro"] == "000000"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][9].Evt.Parsed["minute"] == "43"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][9].Evt.Parsed["month"] == "06"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][9].Evt.Parsed["reason"] == " proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][9].Evt.Parsed["second"] == "11"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][9].Evt.Parsed["source_ip"] == "192.0.2.20"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][9].Evt.Parsed["source_port"] == "61201"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][9].Evt.Parsed["year"] == "2026"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][9].Evt.Meta["action"] == "rejected"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][9].Evt.Meta["source_ip"] == "192.0.2.20"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][9].Evt.Meta["timestamp"] == "2026-06-30T16:43:11Z"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][9].Evt.Enriched["MarshaledTime"] == "2026-06-30T16:43:11Z"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][9].Evt.Whitelisted == false
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][10].Success == true
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][10].Evt.Parsed["action"] == "accepted"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][10].Evt.Parsed["day"] == "30"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][10].Evt.Parsed["hour"] == "16"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][10].Evt.Parsed["message"] == "2026/06/30 16:43:11.500000 from 198.51.100.60:62504 accepted tcp:torrentclaw.com:443 [direct]"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][10].Evt.Parsed["micro"] == "500000"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][10].Evt.Parsed["minute"] == "43"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][10].Evt.Parsed["month"] == "06"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][10].Evt.Parsed["reason"] == "tcp:torrentclaw.com:443 [direct]"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][10].Evt.Parsed["second"] == "11"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][10].Evt.Parsed["source_ip"] == "198.51.100.60"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][10].Evt.Parsed["source_port"] == "62504"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][10].Evt.Parsed["year"] == "2026"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][10].Evt.Meta["action"] == "accepted"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][10].Evt.Meta["source_ip"] == "198.51.100.60"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][10].Evt.Meta["timestamp"] == "2026-06-30T16:43:11Z"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][10].Evt.Enriched["MarshaledTime"] == "2026-06-30T16:43:11Z"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][10].Evt.Whitelisted == false
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][11].Success == true
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][11].Evt.Parsed["action"] == "rejected"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][11].Evt.Parsed["day"] == "30"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][11].Evt.Parsed["hour"] == "16"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][11].Evt.Parsed["message"] == "2026/06/30 16:43:12.000000 from 192.0.2.20:61202 rejected  proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][11].Evt.Parsed["micro"] == "000000"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][11].Evt.Parsed["minute"] == "43"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][11].Evt.Parsed["month"] == "06"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][11].Evt.Parsed["reason"] == " proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][11].Evt.Parsed["second"] == "12"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][11].Evt.Parsed["source_ip"] == "192.0.2.20"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][11].Evt.Parsed["source_port"] == "61202"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][11].Evt.Parsed["year"] == "2026"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][11].Evt.Meta["action"] == "rejected"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][11].Evt.Meta["source_ip"] == "192.0.2.20"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][11].Evt.Meta["timestamp"] == "2026-06-30T16:43:12Z"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][11].Evt.Enriched["MarshaledTime"] == "2026-06-30T16:43:12Z"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][11].Evt.Whitelisted == false
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][12].Success == true
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][12].Evt.Parsed["action"] == "rejected"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][12].Evt.Parsed["day"] == "30"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][12].Evt.Parsed["hour"] == "16"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][12].Evt.Parsed["message"] == "2026/06/30 16:43:13.000000 from 192.0.2.20:61203 rejected  proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][12].Evt.Parsed["micro"] == "000000"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][12].Evt.Parsed["minute"] == "43"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][12].Evt.Parsed["month"] == "06"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][12].Evt.Parsed["reason"] == " proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][12].Evt.Parsed["second"] == "13"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][12].Evt.Parsed["source_ip"] == "192.0.2.20"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][12].Evt.Parsed["source_port"] == "61203"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][12].Evt.Parsed["year"] == "2026"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][12].Evt.Meta["action"] == "rejected"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][12].Evt.Meta["source_ip"] == "192.0.2.20"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][12].Evt.Meta["timestamp"] == "2026-06-30T16:43:13Z"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][12].Evt.Enriched["MarshaledTime"] == "2026-06-30T16:43:13Z"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][12].Evt.Whitelisted == false
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][13].Success == true
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][13].Evt.Parsed["action"] == "rejected"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][13].Evt.Parsed["day"] == "30"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][13].Evt.Parsed["hour"] == "16"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][13].Evt.Parsed["message"] == "2026/06/30 16:43:14.000000 from 192.0.2.20:61204 rejected  proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][13].Evt.Parsed["micro"] == "000000"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][13].Evt.Parsed["minute"] == "43"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][13].Evt.Parsed["month"] == "06"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][13].Evt.Parsed["reason"] == " proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][13].Evt.Parsed["second"] == "14"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][13].Evt.Parsed["source_ip"] == "192.0.2.20"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][13].Evt.Parsed["source_port"] == "61204"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][13].Evt.Parsed["year"] == "2026"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][13].Evt.Meta["action"] == "rejected"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][13].Evt.Meta["source_ip"] == "192.0.2.20"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][13].Evt.Meta["timestamp"] == "2026-06-30T16:43:14Z"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][13].Evt.Enriched["MarshaledTime"] == "2026-06-30T16:43:14Z"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][13].Evt.Whitelisted == false
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][14].Success == true
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][14].Evt.Parsed["action"] == "rejected"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][14].Evt.Parsed["day"] == "30"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][14].Evt.Parsed["hour"] == "16"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][14].Evt.Parsed["message"] == "2026/06/30 16:43:15.000000 from 192.0.2.20:61205 rejected  proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][14].Evt.Parsed["micro"] == "000000"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][14].Evt.Parsed["minute"] == "43"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][14].Evt.Parsed["month"] == "06"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][14].Evt.Parsed["reason"] == " proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][14].Evt.Parsed["second"] == "15"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][14].Evt.Parsed["source_ip"] == "192.0.2.20"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][14].Evt.Parsed["source_port"] == "61205"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][14].Evt.Parsed["year"] == "2026"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][14].Evt.Meta["action"] == "rejected"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][14].Evt.Meta["source_ip"] == "192.0.2.20"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][14].Evt.Meta["timestamp"] == "2026-06-30T16:43:15Z"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][14].Evt.Enriched["MarshaledTime"] == "2026-06-30T16:43:15Z"
+results["s02-enrich"]["crowdsecurity/dateparse-enrich"][14].Evt.Whitelisted == false
+len(results["success"][""]) == 0
+
diff --git a/.tests/xray-brute-force/scenario.assert b/.tests/xray-brute-force/scenario.assert
new file mode 100644
index 00000000000..11b78345f22
--- /dev/null
+++ b/.tests/xray-brute-force/scenario.assert
@@ -0,0 +1,55 @@
+
+len(results) == 2
+"192.0.2.20" in results[0].Overflow.GetSources()
+results[0].Overflow.Sources["192.0.2.20"].IP == "192.0.2.20"
+results[0].Overflow.Sources["192.0.2.20"].Range == ""
+results[0].Overflow.Sources["192.0.2.20"].GetScope() == "Ip"
+results[0].Overflow.Sources["192.0.2.20"].GetValue() == "192.0.2.20"
+results[0].Overflow.Alert.Events[0].GetMeta("action") == "rejected"
+results[0].Overflow.Alert.Events[0].GetMeta("source_ip") == "192.0.2.20"
+results[0].Overflow.Alert.Events[0].GetMeta("timestamp") == "2026-06-30T16:43:10Z"
+results[0].Overflow.Alert.Events[1].GetMeta("action") == "rejected"
+results[0].Overflow.Alert.Events[1].GetMeta("source_ip") == "192.0.2.20"
+results[0].Overflow.Alert.Events[1].GetMeta("timestamp") == "2026-06-30T16:43:11Z"
+results[0].Overflow.Alert.Events[2].GetMeta("action") == "rejected"
+results[0].Overflow.Alert.Events[2].GetMeta("source_ip") == "192.0.2.20"
+results[0].Overflow.Alert.Events[2].GetMeta("timestamp") == "2026-06-30T16:43:12Z"
+results[0].Overflow.Alert.Events[3].GetMeta("action") == "rejected"
+results[0].Overflow.Alert.Events[3].GetMeta("source_ip") == "192.0.2.20"
+results[0].Overflow.Alert.Events[3].GetMeta("timestamp") == "2026-06-30T16:43:13Z"
+results[0].Overflow.Alert.Events[4].GetMeta("action") == "rejected"
+results[0].Overflow.Alert.Events[4].GetMeta("source_ip") == "192.0.2.20"
+results[0].Overflow.Alert.Events[4].GetMeta("timestamp") == "2026-06-30T16:43:14Z"
+results[0].Overflow.Alert.Events[5].GetMeta("action") == "rejected"
+results[0].Overflow.Alert.Events[5].GetMeta("source_ip") == "192.0.2.20"
+results[0].Overflow.Alert.Events[5].GetMeta("timestamp") == "2026-06-30T16:43:15Z"
+results[0].Overflow.Alert.GetScenario() == "xulianh/xray-brute-force"
+results[0].Overflow.Alert.Remediation == true
+results[0].Overflow.Alert.GetEventsCount() == 6
+"192.0.2.10" in results[1].Overflow.GetSources()
+results[1].Overflow.Sources["192.0.2.10"].IP == "192.0.2.10"
+results[1].Overflow.Sources["192.0.2.10"].Range == ""
+results[1].Overflow.Sources["192.0.2.10"].GetScope() == "Ip"
+results[1].Overflow.Sources["192.0.2.10"].GetValue() == "192.0.2.10"
+results[1].Overflow.Alert.Events[0].GetMeta("action") == "rejected"
+results[1].Overflow.Alert.Events[0].GetMeta("source_ip") == "192.0.2.10"
+results[1].Overflow.Alert.Events[0].GetMeta("timestamp") == "2026-06-30T16:43:00Z"
+results[1].Overflow.Alert.Events[1].GetMeta("action") == "rejected"
+results[1].Overflow.Alert.Events[1].GetMeta("source_ip") == "192.0.2.10"
+results[1].Overflow.Alert.Events[1].GetMeta("timestamp") == "2026-06-30T16:43:01Z"
+results[1].Overflow.Alert.Events[2].GetMeta("action") == "rejected"
+results[1].Overflow.Alert.Events[2].GetMeta("source_ip") == "192.0.2.10"
+results[1].Overflow.Alert.Events[2].GetMeta("timestamp") == "2026-06-30T16:43:02Z"
+results[1].Overflow.Alert.Events[3].GetMeta("action") == "rejected"
+results[1].Overflow.Alert.Events[3].GetMeta("source_ip") == "192.0.2.10"
+results[1].Overflow.Alert.Events[3].GetMeta("timestamp") == "2026-06-30T16:43:03Z"
+results[1].Overflow.Alert.Events[4].GetMeta("action") == "rejected"
+results[1].Overflow.Alert.Events[4].GetMeta("source_ip") == "192.0.2.10"
+results[1].Overflow.Alert.Events[4].GetMeta("timestamp") == "2026-06-30T16:43:04Z"
+results[1].Overflow.Alert.Events[5].GetMeta("action") == "rejected"
+results[1].Overflow.Alert.Events[5].GetMeta("source_ip") == "192.0.2.10"
+results[1].Overflow.Alert.Events[5].GetMeta("timestamp") == "2026-06-30T16:43:05Z"
+results[1].Overflow.Alert.GetScenario() == "xulianh/xray-brute-force"
+results[1].Overflow.Alert.Remediation == true
+results[1].Overflow.Alert.GetEventsCount() == 6
+
diff --git a/.tests/xray-brute-force/xray_sample.log b/.tests/xray-brute-force/xray_sample.log
new file mode 100644
index 00000000000..966594bf3b4
--- /dev/null
+++ b/.tests/xray-brute-force/xray_sample.log
@@ -0,0 +1,15 @@
+2026/06/30 16:43:00.000000 from 192.0.2.10:61149 rejected  proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000
+2026/06/30 16:43:01.000000 from 192.0.2.10:61150 rejected  proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000
+2026/06/30 16:43:01.500000 from 198.51.100.55:62204 accepted tcp:www.gstatic.com:443 [direct]
+2026/06/30 16:43:02.000000 from 192.0.2.10:61151 rejected  proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000
+2026/06/30 16:43:03.000000 from 192.0.2.10:61152 rejected  proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000
+2026/06/30 16:43:03.500000 from 192.0.2.10:62264 accepted tcp:1.1.1.1:443 [direct]
+2026/06/30 16:43:04.000000 from 192.0.2.10:61153 rejected  proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000
+2026/06/30 16:43:05.000000 from 192.0.2.10:61154 rejected  proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000
+2026/06/30 16:43:10.000000 from 192.0.2.20:61200 rejected  proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000
+2026/06/30 16:43:11.000000 from 192.0.2.20:61201 rejected  proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000
+2026/06/30 16:43:11.500000 from 198.51.100.60:62504 accepted tcp:torrentclaw.com:443 [direct]
+2026/06/30 16:43:12.000000 from 192.0.2.20:61202 rejected  proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000
+2026/06/30 16:43:13.000000 from 192.0.2.20:61203 rejected  proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000
+2026/06/30 16:43:14.000000 from 192.0.2.20:61204 rejected  proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000
+2026/06/30 16:43:15.000000 from 192.0.2.20:61205 rejected  proxy/vless/encoding: invalid request user id: 00000000-0000-0000-0000-000000000000
diff --git a/parsers/s01-parse/xulianh/xray-logs.md b/parsers/s01-parse/xulianh/xray-logs.md
index 0152f0f12fb..0cadd2b6b39 100644
--- a/parsers/s01-parse/xulianh/xray-logs.md
+++ b/parsers/s01-parse/xulianh/xray-logs.md
@@ -1,44 +1,71 @@
 ---
+
 author: xulianh
 classification:
-  - AppSec
-  - Proxy
+
+* AppSec
+* Proxy
 tags:
-  - xray
-  - brute-force
+* xray
+* brute-force
+
 ---
 
-# X-ray Log Parser
+# 🛡️ X-ray Log Parser
+
+## 📝 Description
+
+This parser is designed to extract relevant security events from X-ray proxy service logs. It targets incoming log strings to identify connection outcomes and safely isolate structural metadata such as source IP addresses and destination ports.
 
-## Description
-This parser is designed to extract relevant security events from X-ray proxy service logs. It specifically targets connection logs to identify connection states and source IP addresses.
+## ⚙️ Acquisition Configuration
 
-## Acquisition Configuration
-To allow this parser to process the logs, add the following configuration to your `/etc/crowdsec/acquis.d/xray.yaml` file:
+To allow this parser to ingest logs in a production environment, the following configuration must be provisioned in the acquisition file (e.g., `/etc/crowdsec/acquis.d/xray.yaml`):
 
 filenames:
-  - /var/log/xray/access.log
+
+* /var/log/xray/access.log
 labels:
-  type: xray
+type: xray
 
-## Extraction Logic
+## 🔍 Extraction Logic
 
-The component utilizes Grok patterns to process the `message` field of incoming logs matching the `xray` program identifier.
+The component utilizes optimized Grok patterns to process the `message` field of raw incoming lines matching the `xray` program identifier.
 
 * **Target Variables:**
-  * `evt.Parsed.action`: Captures the connection outcome (e.g., `rejected`).
-  * `evt.Parsed.source_ip`: Isolates the originating IPv4/IPv6 address.
+* `evt.Parsed.action`: Captures the connection state outcome (e.g., `rejected`, `accepted`).
+* `evt.Parsed.source_ip`: Isolates the originating IPv4 or IPv6 address.
+* `evt.Parsed.source_port`: Extracts the source ephemeral port for granular logging.
+
+
+* **Chronological Synchronization:**
+* The parser formats and concatenates raw time components (`year`, `month`, `day`, `hour`, `minute`, `second`) into the `evt.StrTime` variable. This allows the downstream `crowdsecurity/dateparse-enrich` component to shift the event clock from the current system time to the actual historical log timestamp, unlocking flawless forensic and time-machine execution.
+
+
+
+### 📊 Architecture Flow
+
+[Raw X-ray Log] --> [s00-raw (non-syslog Ingestion)] --> [s01-parse (xulianh/xray-logs)]
+│
+▼
+[Available for Scenarios] <── [s02-enrich (dateparse-enrich)] <── [Extracted Fields & StrTime]
+
+## 🧪 Validation and Testing
+
+To validate the extraction logic within an isolated development environment without risking production services, utilize the integrated `hubtest` framework rather than global binary commands.
+
+Run the ordinary simulation test using:
+
+cscli hubtest run xray-brute-force
+
+To inspect the synchronized step-by-step state transitions, Grok pattern matches, and variable updates (the strict equivalent to `cscli explain`), execute the detailed interactive diagnostic:
 
-### Architecture Flow
+cscli hubtest explain xray-brute-force --verbose
 
-    [Raw X-ray Log] --> [xulianh/xray-logs Parser] --> [Extracted Meta-fields]
-                                                              |
-                                                              v
-                                                 [Available for Scenarios]
+### 🔒 Verification and Best Practices
 
-## Validation and Testing
-To validate the extraction logic against a local log file, utilize the CrowdSec CLI explain command:
+A successful validation is achieved when all lines are labeled with a green success indicator (`🟢`), and the computed variables match the frozen signatures inside the local `parser.assert` file.
 
-cscli explain --parser ./parsers/s01-parse/xulianh/xray-logs.yaml --log ./tests/xray_sample.log
+Security Requirements for Test Vectors:
+When populating or updating the testing vector file `xray_sample.log` under `.tests/xray-brute-force/`, it is strictly forbidden to include real, un-anonymized operational production IP addresses. All network data must undergo an obfuscation process.
 
-Ensure that the output explicitly shows the `action` and `source_ip` fields populated correctly.
+It is mandatory to use standard documentation IP networks defined by RFC 5737 (such as `192.0.2.0/24` or `198.51.100.0/24`). This prevents the leakage of private server topology to public community repositories and ensures consistent, portable integration testing across continuous integration (CI) environments.
diff --git a/parsers/s01-parse/xulianh/xray-logs.yaml b/parsers/s01-parse/xulianh/xray-logs.yaml
index c6bb514c305..d828f5afd37 100644
--- a/parsers/s01-parse/xulianh/xray-logs.yaml
+++ b/parsers/s01-parse/xulianh/xray-logs.yaml
@@ -1,15 +1,16 @@
-name: custom/xray-logs
-description: "Syntax analizer for x-ray's access recordsy"
-filter: "evt.Parsed.program == 'xray'"
+name: xulianh/xray-logs
+description: "Syntactic analyzer for X-ray access records"
+#filter: "evt.Parsed.program == 'xray' || evt.Meta.program == 'xray'"
+filter: "evt.Line.Labels.type == 'xray'"
 onsuccess: next_stage
 nodes:
   - grok:
-      pattern: '^(?P<time>%{YEAR}/%{MONTHNUM}/%{MONTHDAY} %{HOUR}:%{MINUTE}:%{SECOND}\.%{INT:micro}) from %{IP:source_ip}:%{INT:source_port} %{WORD:action} %{GREEDYDATA:reason}'
+      pattern: '^(?P<time>%{YEAR:year}/%{MONTHNUM:month}/%{MONTHDAY:day} %{HOUR:hour}:%{MINUTE:minute}:%{INT:second}\.%{INT:micro}) from %{IP:source_ip}:%{INT:source_port} %{WORD:action} %{GREEDYDATA:reason}'
       apply_on: message
-statics:
-  - meta: source_ip
-    expression: "evt.Parsed.source_ip"
-  - meta: action
-    expression: "evt.Parsed.action"
-  - target: evt.StrTime
-    expression: "evt.Parsed.year + '-' + evt.Parsed.month + '-' + evt.Parsed.day + 'T' + evt.Parsed.hour + ':' + evt.Parsed.minute + ':' + evt.Parsed.second + 'Z'"
+    statics:
+      - meta: source_ip
+        expression: "evt.Parsed.source_ip"
+      - meta: action
+        expression: "evt.Parsed.action"
+      - target: evt.StrTime
+        expression: "evt.Parsed.year + '-' + evt.Parsed.month + '-' + evt.Parsed.day + 'T' + evt.Parsed.hour + ':' + evt.Parsed.minute + ':' + evt.Parsed.second + 'Z'"
diff --git a/scenarios/xulianh/tests/xray_sample.log b/scenarios/xulianh/tests/xray_sample.log
deleted file mode 100644
index eb77d8ca83a..00000000000
--- a/scenarios/xulianh/tests/xray_sample.log
+++ /dev/null
@@ -1,10 +0,0 @@
-2026/06/30 16:43:04.276617 from 85.118.98.191:61149 rejected  proxy/vless/encoding: invalid request user id: 8b85fdff-d127-5de3-916c-1511689c7478
-2026/06/30 16:43:33.058364 from 79.116.58.191:61280 rejected  proxy/vless/encoding: invalid request user id: 8b85fdff-d127-5de3-916c-1511689c7478
-2026/06/30 16:43:48.052766 from 79.116.58.191:61349 rejected  proxy/vless/encoding: invalid request user id: 8b85fdff-d127-5de3-916c-1511689c7478
-2026/06/30 16:44:05.318761 from 79.116.58.191:61418 rejected  proxy/vless/encoding: invalid request user id: 8b85fdff-d127-5de3-916c-1511689c7478
-2026/06/30 16:44:20.257918 from 79.116.58.191:61485 rejected  proxy/vless/encoding: invalid request user id: 8b85fdff-d127-5de3-916c-1511689c7478
-2026/06/30 16:46:58.723704 from 79.116.58.191:62159 rejected  proxy/vless/encoding: invalid request user id: 8b85fdff-d127-5de3-916c-1511689c7478
-2026/06/30 16:47:05.329968 from 79.116.58.191:62204 accepted tcp:www.gstatic.com:443 [direct]
-2026/06/30 16:47:20.308771 from 79.116.58.191:62264 accepted tcp:1.1.1.1:443 [direct]
-2026/06/30 16:47:50.543081 from 79.116.58.191:62385 accepted tcp:1.1.1.1:443 [direct]
-2026/06/30 16:48:19.021131 from 79.116.58.191:62504 accepted tcp:torrentclaw.com:443 [direct]
diff --git a/scenarios/xulianh/xray-brute-force.md b/scenarios/xulianh/xray-brute-force.md
index d99018d9279..23ff4fb8cc4 100644
--- a/scenarios/xulianh/xray-brute-force.md
+++ b/scenarios/xulianh/xray-brute-force.md
@@ -1,43 +1,47 @@
-~---
 author: xulianh
 classification:
-  - AppSec
-  - Proxy
+
+AppSec
+Proxy
 tags:
-  - xray
-  - brute-force
----
+xray
+brute-force
+
+🛡️ X-ray Brute-Force Detection
+📝 Description
+This scenario is designed to detect brute-force authentication attempts or port scanning targeting an X-ray proxy service. It actively monitors connection events that the X-ray parser explicitly classifies with a rejected action type.
 
-# X-ray Brute-Force Detection
+⚙️ Detection Logic
+The scenario implements a leaky bucket algorithm to control the frequency of failed access attempts per source IP address, handled in an isolated and concurrent manner:
 
-## Description
-This scenario is designed to detect brute-force authentication attempts or network scanning directed at an X-ray proxy service. It actively monitors connection attempts that the X-ray parser explicitly flags as `rejected`.
+Capacity: 5 events (the 6th event within the time window triggers the bucket overflow).
 
-## Detection Logic
-The scenario implements a leaky bucket algorithm to monitor the frequency of failed connection attempts per source IP address:
+Leak Speed: 20 seconds.
 
-* **Capacity:** 5 events.
-* **Leak Speed:** 20 seconds.
-* **Trigger:** If a single source IP address accumulates more than 5 rejected connection attempts within a 20-second rolling window, the bucket overflows, triggering a security alert.
+Trigger: If a single source IP address accumulates more than 5 rejected connection attempts within a 20-second sliding window, the bucket overflows, triggering a security alert and requesting a remediation decision (blocking).
 
-### Architecture Flow
+Resilience to Mixed Traffic: In accordance with best practices for signature design, the correlation logic discriminates concurrent malicious bursts without being affected by the presence of interleaved legitimate traffic (accepted). Successful connections from an IP do not clear or reset the failure counter for that same IP, neutralizing common signature evasion techniques via legitimate noise injection.
 
-```text
+📊 Architecture Flow
 [Incoming Connection] --> [X-ray Service] --> [Log Entry (rejected)]
-                                                    |
-                                                    v
-[Alert Generated] <--- [Threshold Exceeded] <--- [CrowdSec Parser]
-```
+|
+v
+[Alert / Decision] <--- [Bucket Overflowed] <--- [Scenario Engine]
+
+🧪 Validation and Testing
+To ensure the scenario operates correctly before distribution, the pipeline behavior must be validated using the integrated hubtest development framework on a controlled injection vector, isolating tests from the global server installation.
+
+The execution of the standard simulation is performed via the local test suite using the following command:
+cscli hubtest run xray-brute-force
+
+To interactively inspect the complete state transition tree and the line-by-line evaluation of syntactic expressions (equivalent to the explain command in a production environment), the detailed diagnostic directive is invoked:
+cscli hubtest explain xray-brute-force --verbose
 
-## Validation and Testing
-To ensure the scenario operates correctly before deploying to production, it can be tested using a sample log file containing simulated rejected connections.
+🔍 Verification and Best Practices
+The framework confirms simulation success when processing the lines generates the corresponding overflow alerts for the evaluated IP addresses, matching the signatures saved in local assertion files (parser.assert and scenario.assert).
 
-Run the following command using the CrowdSec CLI tool:
+Security Standards for Test Vector Generation:
 
-```bash
-cscli explain --scenario ./scenarios/xulianh/xray-brute-force.yaml --log ./tests/xray_sample.log
-```
-### Verify that the output indicates the bucket successfully parsed the events and triggered an overflow after the 5th rejected attempt.
+When building or updating the xray_sample.log simulation file located in the .tests/xray-brute-force/ path, it is strictly forbidden to include operational or private IP addresses extracted directly from production infrastructure. If real logs are captured from the service using filtering tools such as tail, a mandatory anonymization process must be performed before delivery.
 
-You could generate your xray_sample.log directly from real events as follows:
-sudo tail -n 2 /var/log/xray/access.log > ./tests/xray_sample.log
+It is recommended to replace nodes with address blocks reserved exclusively for documentation in accordance with RFC 5737 (such as the 192.0.2.0/24 or 198.51.100.0/24 networks). This ensures code portability in continuous integration (CI) environments and prevents unwanted leakage of server network topology into public community repositories.
diff --git a/scenarios/xulianh/xray-brute-force.yaml b/scenarios/xulianh/xray-brute-force.yaml
index a8a6ecdb561..215d11fe335 100644
--- a/scenarios/xulianh/xray-brute-force.yaml
+++ b/scenarios/xulianh/xray-brute-force.yaml
@@ -1,8 +1,8 @@
 type: leaky
 name: xulianh/xray-brute-force
 description: "Detect X-ray brute-force or scanning attempts"
-filter: evt.Parsed.action == 'rejected'
-groupby: evt.Parsed.source_ip
+filter: evt.Meta.action == 'rejected'
+groupby: evt.Meta.source_ip
 leakspeed: 20s
 capacity: 5
 blackhole: 1m