D4
/
analyzer-d4-log
mirror of https://github.com/D4-project/analyzer-d4-log
2
0
Fork 0
Code Issues Releases Wiki Activity

chg: [grok] sshd groking test

nifi
Jean-Louis Huynen 2020-03-09 14:04:54 +01:00
parent df32553050
commit 593c6425b5
No known key found for this signature in database
GPG Key ID: 64799157F4BD6B93
2 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
logcompiler/sshd.go
View File

@ -26,7 +26,8 @@ type SSHDCompiler struct {
CompilerStruct
}
type groked struct {
// GrokedSSHD map JSON fields to Go struct
type GrokedSSHD struct {
SSHMessage string `json:"ssh_message"`
SyslogPid string `json:"syslog_pid"`
SyslogHostname string `json:"syslog_hostname"`
@ -36,7 +37,7 @@ type groked struct {
SshdInvalidUser string `json:"sshd_invalid_user"`
}
var m groked
var m GrokedSSHD
// Flush recomputes statistics and recompile HTML output
// TODO : review after refacto

4
logcompiler/sshd.txt Normal file
View File

@ -0,0 +1,4 @@
{"ssh_message":"Invalid user misp-project from 119.42.175.200","syslog_pid":"28367","syslog_hostname":"sigmund","syslog_timestamp":"Feb 27 06:52:08","sshd_client_ip":"119.42.175.200","syslog_program":"sshd","sshd_invalid_user":"misp-project"}
{"ssh_message":"Invalid user oracle from 49.212.211.207","syslog_pid":"28372","syslog_hostname":"sigmund","syslog_timestamp":"Feb 27 06:53:15","sshd_client_ip":"49.212.211.207","syslog_program":"sshd","sshd_invalid_user":"oracle"}
{"ssh_message":"Invalid user 2019 from 112.78.1.247","syslog_pid":"28381","syslog_hostname":"sigmund","syslog_timestamp":"Feb 27 06:53:57","sshd_client_ip":"112.78.1.247","syslog_program":"sshd","sshd_invalid_user":"2019"}
{"ssh_message":"Invalid user postgres from 217.182.194.95","syslog_pid":"28435","syslog_hostname":"sigmund","syslog_timestamp":"Feb 27 06:58:11","sshd_client_ip":"217.182.194.95","syslog_program":"sshd","sshd_invalid_user":"postgres"}