Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Added a parser, scenario, and collection for Foundry VTT servers #1054

Draft
wants to merge 4 commits into
base: master
Choose a base branch
from
Draft

Added a parser, scenario, and collection for Foundry VTT servers #1054

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
d7d541f
added foundryvtt collection and tests
eastcw Jun 12, 2024
05aafe6
Merge branch 'crowdsecurity:master' into foundryvtt
eastcw Jun 12, 2024
ca9d0c2
changed parser to use UnmarshalJSON & cleared up review points
eastcw Jun 24, 2024
5f53125
added back missing service meta
eastcw Jun 24, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 13 additions & 0 deletions .tests/foundryvtt-bf/config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
parsers:
- crowdsecurity/syslog-logs
- crowdsecurity/dateparse-enrich
- ./parsers/s01-parse/eastcw/foundryvtt-logs.yaml
scenarios:
- ./scenarios/eastcw/foundryvtt-bf.yaml
postoverflows:
- ""
log_file: foundryvtt-bf.log
log_type: foundryvtt
labels: {}
ignore_parsers: true
override_statics: []
8 changes: 8 additions & 0 deletions .tests/foundryvtt-bf/foundryvtt-bf.log
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
{"ip":"192.168.1.165","level":"warn","message":"Administrator authentication failed for session 51d183ff8c3b547a6a1883df; invalid password","status":403,"timestamp":"2024-06-10 10:29:21"}
{"ip":"192.168.1.165","level":"warn","message":"User authentication failed for user Gamemaster; invalid password","session":"51d183ff8c3b547a6a1883df","status":401,"timestamp":"2024-06-10 10:29:56"}
{"ip":"::ffff:192.168.1.114","level":"warn","message":"User authentication failed for user Gamemaster; invalid password","session":"cac2d280a26a838e96e4aaef","status":401,"timestamp":"2024-06-10 21:12:53"}
{"ip":"::ffff:192.168.1.114","level":"warn","message":"User authentication failed for user Gamemaster; invalid password","session":"cac2d280a26a838e96e4aaef","status":401,"timestamp":"2024-06-10 21:12:54"}
{"ip":"::ffff:192.168.1.114","level":"warn","message":"User authentication failed for user Gamemaster; invalid password","session":"cac2d280a26a838e96e4aaef","status":401,"timestamp":"2024-06-10 21:12:54"}
{"ip":"::ffff:192.168.1.114","level":"warn","message":"Administrator authentication failed for session cac2d280a26a838e96e4aaef; invalid password","status":403,"timestamp":"2024-06-10 21:12:59"}
{"ip":"::ffff:192.168.1.114","level":"warn","message":"Administrator authentication failed for session cac2d280a26a838e96e4aaef; invalid password","status":403,"timestamp":"2024-06-10 21:13:00"}
{"ip":"::ffff:192.168.1.114","level":"warn","message":"Administrator authentication failed for session cac2d280a26a838e96e4aaef; invalid password","status":403,"timestamp":"2024-06-10 21:13:00"}
Empty file added .tests/foundryvtt-bf/parser.assert
View file
Open in desktop
Empty file.
57 changes: 57 additions & 0 deletions .tests/foundryvtt-bf/scenario.assert
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,57 @@
len(results) == 1
"::ffff:192.168.1.114" in results[0].Overflow.GetSources()
results[0].Overflow.Sources["::ffff:192.168.1.114"].IP == "::ffff:192.168.1.114"
results[0].Overflow.Sources["::ffff:192.168.1.114"].Range == ""
results[0].Overflow.Sources["::ffff:192.168.1.114"].GetScope() == "Ip"
results[0].Overflow.Sources["::ffff:192.168.1.114"].GetValue() == "::ffff:192.168.1.114"
results[0].Overflow.Alert.Events[0].GetMeta("datasource_path") == "foundryvtt-bf.log"
results[0].Overflow.Alert.Events[0].GetMeta("datasource_type") == "file"
results[0].Overflow.Alert.Events[0].GetMeta("level") == "warn"
results[0].Overflow.Alert.Events[0].GetMeta("log_type") == "foundryvtt_failed_game_auth"
results[0].Overflow.Alert.Events[0].GetMeta("message") == "User authentication failed for user Gamemaster; invalid password"
results[0].Overflow.Alert.Events[0].GetMeta("source_ip") == "::ffff:192.168.1.114"
results[0].Overflow.Alert.Events[0].GetMeta("status") == "401.000000"
results[0].Overflow.Alert.Events[0].GetMeta("timestamp") == "2024-06-10T21:12:53Z"
results[0].Overflow.Alert.Events[1].GetMeta("datasource_path") == "foundryvtt-bf.log"
results[0].Overflow.Alert.Events[1].GetMeta("datasource_type") == "file"
results[0].Overflow.Alert.Events[1].GetMeta("level") == "warn"
results[0].Overflow.Alert.Events[1].GetMeta("log_type") == "foundryvtt_failed_game_auth"
results[0].Overflow.Alert.Events[1].GetMeta("message") == "User authentication failed for user Gamemaster; invalid password"
results[0].Overflow.Alert.Events[1].GetMeta("source_ip") == "::ffff:192.168.1.114"
results[0].Overflow.Alert.Events[1].GetMeta("status") == "401.000000"
results[0].Overflow.Alert.Events[1].GetMeta("timestamp") == "2024-06-10T21:12:54Z"
results[0].Overflow.Alert.Events[2].GetMeta("datasource_path") == "foundryvtt-bf.log"
results[0].Overflow.Alert.Events[2].GetMeta("datasource_type") == "file"
results[0].Overflow.Alert.Events[2].GetMeta("level") == "warn"
results[0].Overflow.Alert.Events[2].GetMeta("log_type") == "foundryvtt_failed_game_auth"
results[0].Overflow.Alert.Events[2].GetMeta("message") == "User authentication failed for user Gamemaster; invalid password"
results[0].Overflow.Alert.Events[2].GetMeta("source_ip") == "::ffff:192.168.1.114"
results[0].Overflow.Alert.Events[2].GetMeta("status") == "401.000000"
results[0].Overflow.Alert.Events[2].GetMeta("timestamp") == "2024-06-10T21:12:54Z"
results[0].Overflow.Alert.Events[3].GetMeta("datasource_path") == "foundryvtt-bf.log"
results[0].Overflow.Alert.Events[3].GetMeta("datasource_type") == "file"
results[0].Overflow.Alert.Events[3].GetMeta("level") == "warn"
results[0].Overflow.Alert.Events[3].GetMeta("log_type") == "foundryvtt_failed_game_auth"
results[0].Overflow.Alert.Events[3].GetMeta("message") == "Administrator authentication failed for session cac2d280a26a838e96e4aaef; invalid password"
results[0].Overflow.Alert.Events[3].GetMeta("source_ip") == "::ffff:192.168.1.114"
results[0].Overflow.Alert.Events[3].GetMeta("status") == "403.000000"
results[0].Overflow.Alert.Events[3].GetMeta("timestamp") == "2024-06-10T21:12:59Z"
results[0].Overflow.Alert.Events[4].GetMeta("datasource_path") == "foundryvtt-bf.log"
results[0].Overflow.Alert.Events[4].GetMeta("datasource_type") == "file"
results[0].Overflow.Alert.Events[4].GetMeta("level") == "warn"
results[0].Overflow.Alert.Events[4].GetMeta("log_type") == "foundryvtt_failed_game_auth"
results[0].Overflow.Alert.Events[4].GetMeta("message") == "Administrator authentication failed for session cac2d280a26a838e96e4aaef; invalid password"
results[0].Overflow.Alert.Events[4].GetMeta("source_ip") == "::ffff:192.168.1.114"
results[0].Overflow.Alert.Events[4].GetMeta("status") == "403.000000"
results[0].Overflow.Alert.Events[4].GetMeta("timestamp") == "2024-06-10T21:13:00Z"
results[0].Overflow.Alert.Events[5].GetMeta("datasource_path") == "foundryvtt-bf.log"
results[0].Overflow.Alert.Events[5].GetMeta("datasource_type") == "file"
results[0].Overflow.Alert.Events[5].GetMeta("level") == "warn"
results[0].Overflow.Alert.Events[5].GetMeta("log_type") == "foundryvtt_failed_game_auth"
results[0].Overflow.Alert.Events[5].GetMeta("message") == "Administrator authentication failed for session cac2d280a26a838e96e4aaef; invalid password"
results[0].Overflow.Alert.Events[5].GetMeta("source_ip") == "::ffff:192.168.1.114"
results[0].Overflow.Alert.Events[5].GetMeta("status") == "403.000000"
results[0].Overflow.Alert.Events[5].GetMeta("timestamp") == "2024-06-10T21:13:00Z"
results[0].Overflow.Alert.GetScenario() == "eastcw/foundryvtt_fast_bf"
results[0].Overflow.Alert.Remediation == true
results[0].Overflow.Alert.GetEventsCount() == 6
13 changes: 13 additions & 0 deletions .tests/foundryvtt-logs/config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
parsers:
- crowdsecurity/syslog-logs
- crowdsecurity/dateparse-enrich
- ./parsers/s01-parse/eastcw/foundryvtt-logs.yaml
scenarios:
- ""
postoverflows:
- ""
log_file: foundryvtt-logs.log
log_type: foundryvtt
labels: {}
ignore_parsers: false
override_statics: []
8 changes: 8 additions & 0 deletions .tests/foundryvtt-logs/foundryvtt-logs.log
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
{"ip":"192.168.1.165","level":"warn","message":"Administrator authentication failed for session 51d183ff8c3b547a6a1883df; invalid password","status":403,"timestamp":"2024-06-10 10:29:21"}
{"ip":"192.168.1.165","level":"warn","message":"User authentication failed for user Gamemaster; invalid password","session":"51d183ff8c3b547a6a1883df","status":401,"timestamp":"2024-06-10 10:29:56"}
{"ip":"::ffff:192.168.1.114","level":"warn","message":"User authentication failed for user Gamemaster; invalid password","session":"cac2d280a26a838e96e4aaef","status":401,"timestamp":"2024-06-10 21:12:53"}
{"ip":"::ffff:192.168.1.114","level":"warn","message":"User authentication failed for user Gamemaster; invalid password","session":"cac2d280a26a838e96e4aaef","status":401,"timestamp":"2024-06-10 21:12:54"}
{"ip":"::ffff:192.168.1.114","level":"warn","message":"User authentication failed for user Gamemaster; invalid password","session":"cac2d280a26a838e96e4aaef","status":401,"timestamp":"2024-06-10 21:12:54"}
{"ip":"::ffff:192.168.1.114","level":"warn","message":"Administrator authentication failed for session cac2d280a26a838e96e4aaef; invalid password","status":403,"timestamp":"2024-06-10 21:12:59"}
{"ip":"::ffff:192.168.1.114","level":"warn","message":"Administrator authentication failed for session cac2d280a26a838e96e4aaef; invalid password","status":403,"timestamp":"2024-06-10 21:13:00"}
{"ip":"::ffff:192.168.1.114","level":"warn","message":"Administrator authentication failed for session cac2d280a26a838e96e4aaef; invalid password","status":403,"timestamp":"2024-06-10 21:13:00"}
Loading