Skip to content

Commit 54a78bf

Browse files
LaurenceJJonesLaurenceJJones
authored
Remove WAN ips from pages that cause CAPI signals (#729)
* Update protocol.md * enhance: Remove as much WAN ips from items that may cause CAPI signals
1 parent 33f922a commit 54a78bf

File tree

44 files changed

+275
-275
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

44 files changed

+275
-275
lines changed

‎crowdsec-docs/docs/appsec/hooks.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -102,7 +102,7 @@ inband_rules:
102102
- crowdsecurity/base-config
103103
- crowdsecurity/vpatch-*
104104
pre_eval:
105-
- filter: IsInBand == true && req.RemoteAddr == "42.42.42.42"
105+
- filter: IsInBand == true && req.RemoteAddr == "192.168.1.1"
106106
apply:
107107
- RemoveInBandRuleByName("my_rule")
108108
```
@@ -188,13 +188,13 @@ inband_rules:
188188
- crowdsecurity/base-config
189189
- crowdsecurity/vpatch-*
190190
post_eval:
191-
- filter: IsInBand == true && req.RemoteAddr == "42.42.42.42"
191+
- filter: IsInBand == true && req.RemoteAddr == "192.168.1.1"
192192
apply:
193193
- CancelAlert()
194194
- CancelEvent()
195195
- filter: |
196196
any( evt.Appsec.MatchedRules, #.name == "crowdsecurity/vpatch-env-access") and
197-
req.RemoteAddr = "42.42.42.42"
197+
req.RemoteAddr = "192.168.1.1"
198198
apply:
199199
- SetRemediation("allow")
200200
- filter: evt.Appsec.MatchedRules.GetURI() contains "/foobar/"

‎crowdsec-docs/docs/appsec/protocol.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ All requests forwarded by the remediation component must be sent via a `GET` req
4141

4242
For this example:
4343

44-
- A `POST` HTTP request has been made by the IP `1.2.3.4` to a website on `example.com`.
44+
- A `POST` HTTP request has been made by the IP `192.168.1.1` to a website on `example.com`.
4545
- The Application Security Component listen on `http://localhost:4241/`.
4646

4747
<details>
@@ -71,7 +71,7 @@ username=admin' OR '1'='1' -- &password=password
7171
```
7272
POST / HTTP/1.1
7373
Host: localhost:4241
74-
X-Crowdsec-Appsec-ip: 1.2.3.4
74+
X-Crowdsec-Appsec-ip: 192.168.1.1
7575
X-Crowdsec-Appsec-Uri: /login
7676
X-Crowdsec-Appsec-Host: example.com
7777
X-Crowdsec-Appsec-Verb: POST

‎crowdsec-docs/docs/appsec/quickstart/nginxopenresty.mdx‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -160,7 +160,7 @@ Please keep this key since you will not be able to retrieve it!
160160
2. Emit a legitimate request to the AppSec Component:
161161

162162
```bash
163-
curl -X POST localhost:7422/ -i -H 'x-crowdsec-appsec-uri: /test' -H 'x-crowdsec-appsec-ip: 42.42.42.42' -H 'x-crowdsec-appsec-host: foobar.com' -H 'x-crowdsec-appsec-verb: POST' -H 'x-crowdsec-appsec-api-key: this_is_a_bad_password'
163+
curl -X POST localhost:7422/ -i -H 'x-crowdsec-appsec-uri: /test' -H 'x-crowdsec-appsec-ip: 192.168.1.1' -H 'x-crowdsec-appsec-host: foobar.com' -H 'x-crowdsec-appsec-verb: POST' -H 'x-crowdsec-appsec-api-key: this_is_a_bad_password'
164164
```
165165

166166
Which will give us an answer such as:
@@ -181,7 +181,7 @@ We're trying to access a `.env` file, a [common way to get access to some creden
181181
:::
182182

183183
```bash
184-
curl -X POST localhost:7422/ -i -H 'x-crowdsec-appsec-uri: /.env' -H 'x-crowdsec-appsec-ip: 42.42.42.42' -H 'x-crowdsec-appsec-host: foobar.com' -H 'x-crowdsec-appsec-verb: POST' -H 'x-crowdsec-appsec-api-key: this_is_a_bad_password'
184+
curl -X POST localhost:7422/ -i -H 'x-crowdsec-appsec-uri: /.env' -H 'x-crowdsec-appsec-ip: 192.168.1.1' -H 'x-crowdsec-appsec-host: foobar.com' -H 'x-crowdsec-appsec-verb: POST' -H 'x-crowdsec-appsec-api-key: this_is_a_bad_password'
185185

186186
```
187187

‎crowdsec-docs/docs/appsec/troubleshooting.md‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,7 @@ cscli bouncers add appsec_test -k this_is_a_bad_password
7575
> Emit a request to the AppSec Component
7676
7777
```bash
78-
curl -I -X POST localhost:7422/ -i -H 'x-crowdsec-appsec-api-key: this_is_a_bad_password' -H 'x-crowdsec-appsec-ip: 42.42.42.42' -H 'x-crowdsec-appsec-uri: /test' -H 'x-crowdsec-appsec-host: test.com' -H 'x-crowdsec-appsec-verb: GET'
78+
curl -I -X POST localhost:7422/ -i -H 'x-crowdsec-appsec-api-key: this_is_a_bad_password' -H 'x-crowdsec-appsec-ip: 192.168.1.1' -H 'x-crowdsec-appsec-uri: /test' -H 'x-crowdsec-appsec-host: test.com' -H 'x-crowdsec-appsec-verb: GET'
7979
HTTP/1.1 200 OK
8080
Date: Tue, 05 Dec 2023 19:37:56 GMT
8181
Content-Length: 18
@@ -85,7 +85,7 @@ Content-Type: text/plain; charset=utf-8
8585
If you receive a `200 OK`, you can authenticate to the AppSec Component. If the component is misconfigured or your API key is invalid, you will receive a `401 Unauthorized`:
8686

8787
```bash
88-
curl -I -X POST localhost:7422/ -i -H 'x-crowdsec-appsec-api-key: meeh' -H 'x-crowdsec-appsec-ip: 42.42.42.42' -H 'x-crowdsec-appsec-uri: /test' -H 'x-crowdsec-appsec-host: test.com' -H 'x-crowdsec-appsec-verb: GET'
88+
curl -I -X POST localhost:7422/ -i -H 'x-crowdsec-appsec-api-key: meeh' -H 'x-crowdsec-appsec-ip: 192.168.1.1' -H 'x-crowdsec-appsec-uri: /test' -H 'x-crowdsec-appsec-host: test.com' -H 'x-crowdsec-appsec-verb: GET'
8989
HTTP/1.1 401 Unauthorized
9090
Date: Tue, 05 Dec 2023 19:38:51 GMT
9191
Content-Length: 0
@@ -212,7 +212,7 @@ cscli bouncers add appsec_test -k this_is_a_bad_password
212212
We can now query our AppSec Component (we're assuming here that it runs on the default `127.0.0.1:7422`, see the `listen_addr` parameter of the acquisition config):
213213

214214
```bash
215-
▶ curl -X POST localhost:7422/ -i -H 'x-crowdsec-appsec-ip: 42.42.42.42' -H 'x-crowdsec-appsec-uri: /rpc2' -H 'x-crowdsec-appsec-host: google.com' -H 'x-crowdsec-appsec-verb: POST' -H 'x-crowdsec-appsec-api-key: this_is_a_bad_password'
215+
▶ curl -X POST localhost:7422/ -i -H 'x-crowdsec-appsec-ip: 192.168.1.1' -H 'x-crowdsec-appsec-uri: /rpc2' -H 'x-crowdsec-appsec-host: google.com' -H 'x-crowdsec-appsec-verb: POST' -H 'x-crowdsec-appsec-api-key: this_is_a_bad_password'
216216
HTTP/1.1 403 Forbidden
217217
Date: Tue, 05 Dec 2023 11:17:51 GMT
218218
Content-Length: 16
@@ -225,7 +225,7 @@ And we see the alert appearing in `crowdsec.log` :
225225

226226
```
227227
...
228-
INFO[2023-12-05 12:17:52] (test) alert : crowdsecurity/vpatch-CVE-2023-42793 by ip 42.42.42.42
228+
INFO[2023-12-05 12:17:52] (test) alert : crowdsecurity/vpatch-CVE-2023-42793 by ip 192.168.1.1
229229
...
230230
```
231231

@@ -235,7 +235,7 @@ And in `cscli alerts list` :
235235
╭────┬────────────────┬─────────────────────────────────────┬─────────┬────┬───────────┬───────────────────────────────╮
236236
│ ID │ value │ reason │ country │ as │ decisions │ created_at │
237237
├────┼────────────────┼─────────────────────────────────────┼─────────┼────┼───────────┼───────────────────────────────┤
238-
│ 1 │ Ip:42.42.42.42 │ crowdsecurity/vpatch-CVE-2023-42793 │ │ │ │ 2023-12-05 11:17:51 +0000 UTC │
238+
│ 1 │ Ip:192.168.1.1 │ crowdsecurity/vpatch-CVE-2023-42793 │ │ │ │ 2023-12-05 11:17:51 +0000 UTC │
239239
╰────┴────────────────┴─────────────────────────────────────┴─────────┴────┴───────────┴───────────────────────────────╯
240240
241241
```

‎crowdsec-docs/docs/expr/other_helpers.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ An empty string if the key doesn't exist (or has been evicted), and error is rai
3434

3535
Returns true if it's a valid IPv4.
3636

37-
> `IsIPV4("1.2.3.4")`
37+
> `IsIPV4("192.168.1.1")`
3838
3939
> `IsIPV4(Alert.GetValue())`
4040
@@ -44,7 +44,7 @@ Returns true if it's a valid IP (v4 or v6).
4444

4545
> `IsIP("2001:0db8:85a3:0000:0000:8a2e:0370:7334")`
4646
47-
> `IsIP("1.2.3.4")`
47+
> `IsIP("192.168.1.1")`
4848
4949
> `IsIP(Alert.GetValue())`
5050

‎crowdsec-docs/docs/getting_started/crowdsec_tour.mdx‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -116,7 +116,7 @@ sudo cscli decisions list
116116
+-----+-----------+-------------+------------------------------------+--------+---------+----+--------+--------------------+----------+
117117
| 802 | cscli | Ip:1.2.3.5 | manual 'ban' from | ban | | | 1 | 3h50m58.10039043s | 802 |
118118
| | | | 'b76cc7b1bbdc489e93909d2043031de8' | | | | | | |
119-
| 801 | crowdsec | Ip:1.2.3.4 | crowdsecurity/ssh-bf | ban | | | 6 | 3h59m45.100387557s | 801 |
119+
| 801 | crowdsec | Ip:192.168.1.1 | crowdsecurity/ssh-bf | ban | | | 6 | 3h59m45.100387557s | 801 |
120120
+-----+-----------+-------------+------------------------------------+--------+---------+----+--------+--------------------+----------+
121121
```
122122
</details>
@@ -130,11 +130,11 @@ There are different decisions `SOURCE`:
130130
## Add/Remove decisions
131131

132132
```bash
133-
cscli decisions add -i 1.2.3.4
134-
cscli decisions delete -i 1.2.3.4
133+
cscli decisions add -i 192.168.1.1
134+
cscli decisions delete -i 192.168.1.1
135135
```
136136

137-
Those commands will respectively add a manual decision for ip `1.2.3.4` (with default parameters such as duration and such), and remove all active decisions for ip `1.2.3.4`.
137+
Those commands will respectively add a manual decision for ip `192.168.1.1` (with default parameters such as duration and such), and remove all active decisions for ip `192.168.1.1`.
138138

139139

140140

‎crowdsec-docs/docs/local_api/bouncers-api.md‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,7 @@ As stated in the [swagger documentation](https://crowdsecurity.github.io/api_doc
7272
To have some data to query for, let's add two decisions to our local API
7373

7474
```bash
75-
▶ sudo cscli decisions add -i 1.2.3.4
75+
▶ sudo cscli decisions add -i 192.168.1.1
7676
INFO[0000] Decision successfully added
7777
▶ sudo cscli decisions add -r 2.2.3.0/24
7878
INFO[0000] Decision successfully added
@@ -82,7 +82,7 @@ INFO[0000] Decision successfully added
8282
+------+--------+------------------+----------------------------------------------------+--------+---------+----+--------+--------------------+----------+
8383
| 2337 | cscli | Range:2.2.3.0/24 | manual 'ban' from | ban | | | 1 | 3h59m18.079301785s | 1164 |
8484
| | | | '939972095cf1459c8b22cc608eff85daEb4yoi2wiTD7Y3fA' | | | | | | |
85-
| 2336 | cscli | Ip:1.2.3.4 | manual 'ban' from | ban | | | 1 | 3h59m11.079297437s | 1163 |
85+
| 2336 | cscli | Ip:192.168.1.1 | manual 'ban' from | ban | | | 1 | 3h59m11.079297437s | 1163 |
8686
| | | | '939972095cf1459c8b22cc608eff85daEb4yoi2wiTD7Y3fA' | | | | | | |
8787
+------+--------+------------------+----------------------------------------------------+--------+---------+----+--------+--------------------+----------+
8888

@@ -92,8 +92,8 @@ INFO[0000] Decision successfully added
9292

9393

9494
```bash title="Query a single banned IP"
95-
▶ curl -H "X-Api-Key: 837be58e22a28738066de1be8f53636b" http://localhost:8080/v1/decisions\?ip=1.2.3.4
96-
[{"duration":"3h51m57.363171728s","id":2336,"origin":"cscli","scenario":"manual 'ban' from '939972095cf1459c8b22cc608eff85daEb4yoi2wiTD7Y3fA'","scope":"Ip","type":"ban","value":"1.2.3.4"}]
95+
▶ curl -H "X-Api-Key: 837be58e22a28738066de1be8f53636b" http://localhost:8080/v1/decisions\?ip=192.168.1.1
96+
[{"duration":"3h51m57.363171728s","id":2336,"origin":"cscli","scenario":"manual 'ban' from '939972095cf1459c8b22cc608eff85daEb4yoi2wiTD7Y3fA'","scope":"Ip","type":"ban","value":"192.168.1.1"}]
9797
```
9898

9999
```bash title="Query a single IP"
@@ -112,7 +112,7 @@ _note: notice that the decision returned is the range that we banned earlier and
112112

113113
```bash title="Query a range in which one of the ban is contained"
114114
▶ curl -H "X-Api-Key: 837be58e22a28738066de1be8f53636b" http://localhost:8080/v1/decisions\?range=1.2.3.0/24\&contains\=false
115-
[{"duration":"3h48m7.676653651s","id":2336,"origin":"cscli","scenario":"manual 'ban' from '939972095cf1459c8b22cc608eff85daEb4yoi2wiTD7Y3fA'","scope":"Ip","type":"ban","value":"1.2.3.4"}]
115+
[{"duration":"3h48m7.676653651s","id":2336,"origin":"cscli","scenario":"manual 'ban' from '939972095cf1459c8b22cc608eff85daEb4yoi2wiTD7Y3fA'","scope":"Ip","type":"ban","value":"192.168.1.1"}]
116116
```
117117
_note: notice the `contains` flag that is set to false_
118118

@@ -141,7 +141,7 @@ INFO[0000] Decision successfully added
141141
| | | | '939972095cf1459c8b22cc608eff85daEb4yoi2wiTD7Y3fA' | | | | | | |
142142
| 2337 | cscli | Range:2.2.3.0/24 | manual 'ban' from | ban | | | 1 | 3h27m1.384972861s | 1164 |
143143
| | | | '939972095cf1459c8b22cc608eff85daEb4yoi2wiTD7Y3fA' | | | | | | |
144-
| 2336 | cscli | Ip:1.2.3.4 | manual 'ban' from | ban | | | 1 | 3h26m54.384971268s | 1163 |
144+
| 2336 | cscli | Ip:192.168.1.1 | manual 'ban' from | ban | | | 1 | 3h26m54.384971268s | 1163 |
145145
| | | | '939972095cf1459c8b22cc608eff85daEb4yoi2wiTD7Y3fA' | | | | | | |
146146
+------+--------+------------------+----------------------------------------------------+-------------+---------+----+--------+--------------------+----------+
147147
```
@@ -174,7 +174,7 @@ Given the our state looks like :
174174
+------+--------+------------------+----------------------------------------------------+--------+---------+----+--------+--------------------+----------+
175175
| 2337 | cscli | Range:2.2.3.0/24 | manual 'ban' from | ban | | | 1 | 2h55m26.05271136s | 1164 |
176176
| | | | '939972095cf1459c8b22cc608eff85daEb4yoi2wiTD7Y3fA' | | | | | | |
177-
| 2336 | cscli | Ip:1.2.3.4 | manual 'ban' from | ban | | | 1 | 2h55m19.052706441s | 1163 |
177+
| 2336 | cscli | Ip:192.168.1.1 | manual 'ban' from | ban | | | 1 | 2h55m19.052706441s | 1163 |
178178
| | | | '939972095cf1459c8b22cc608eff85daEb4yoi2wiTD7Y3fA' | | | | | | |
179179
+------+--------+------------------+----------------------------------------------------+--------+---------+----+--------+--------------------+----------+
180180

‎crowdsec-docs/docs/local_api/profiles/format.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -102,7 +102,7 @@ It is a list of `models.Decision` objects. The following fields, when present, a
102102
- `scope` : defines the scope of the resulting decision
103103
- `duration` : defines for how long will the decision be valid. The format must comply with [golang's ParseDuration](https://pkg.go.dev/time#ParseDuration)
104104
- `type` : defines the type of the remediation that will be applied by available bouncers, for example `ban`, `captcha`
105-
- `value` : define a hardcoded value for the decision (ie. `1.2.3.4`)
105+
- `value` : define a hardcoded value for the decision (ie. `192.168.1.1`)
106106

107107
### `duration_expr`
108108

‎crowdsec-docs/docs/log_processor/parsers/create.md‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -14,9 +14,9 @@ The creation of said functional testing will guide our process and will make it
1414
We're going to create a parser for the imaginary service "myservice" that produce three types of logs via syslog :
1515

1616
```
17-
Dec 8 06:28:43 mymachine myservice[2806]: bad password for user 'toto' from '1.2.3.4'
18-
Dec 8 06:28:43 mymachine myservice[2806]: unknown user 'toto' from '1.2.3.4'
19-
Dec 8 06:28:43 mymachine myservice[2806]: accepted connection for user 'toto' from '1.2.3.4'
17+
Dec 8 06:28:43 mymachine myservice[2806]: bad password for user 'toto' from '192.168.1.1'
18+
Dec 8 06:28:43 mymachine myservice[2806]: unknown user 'toto' from '192.168.1.1'
19+
Dec 8 06:28:43 mymachine myservice[2806]: accepted connection for user 'toto' from '192.168.1.1'
2020
```
2121

2222
As we are going to parse those logs to further detect bruteforce and user-enumeration attacks, we're simply going to "discard" the last type of logs.
@@ -144,8 +144,8 @@ results["s01-parse"]["crowdsecurity/myservice-logs"][0].Evt.Parsed["program"] ==
144144
results["s01-parse"]["crowdsecurity/myservice-logs"][0].Evt.Parsed["timestamp"] == "Dec 8 06:28:43"
145145
results["s01-parse"]["crowdsecurity/myservice-logs"][0].Evt.Parsed["is_my_service"] == "yes"
146146
results["s01-parse"]["crowdsecurity/myservice-logs"][0].Evt.Parsed["logsource"] == "syslog"
147-
results["s01-parse"]["crowdsecurity/myservice-logs"][0].Evt.Parsed["message"] == "bad password for user 'toto' from '1.2.3.4'"
148-
results["s01-parse"]["crowdsecurity/myservice-logs"][0].Evt.Parsed["some_data"] == "bad password for user 'toto' from '1.2.3.4'"
147+
results["s01-parse"]["crowdsecurity/myservice-logs"][0].Evt.Parsed["message"] == "bad password for user 'toto' from '192.168.1.1'"
148+
results["s01-parse"]["crowdsecurity/myservice-logs"][0].Evt.Parsed["some_data"] == "bad password for user 'toto' from '192.168.1.1'"
149149
...
150150
151151
@@ -162,19 +162,19 @@ Further inspection can be seen with `cscli hubtest explain` :
162162

163163
```bash
164164
▶ cscli hubtest explain myservice-logs
165-
line: Dec 8 06:28:43 mymachine myservice[2806]: bad password for user 'toto' from '1.2.3.4'
165+
line: Dec 8 06:28:43 mymachine myservice[2806]: bad password for user 'toto' from '192.168.1.1'
166166
├ s00-raw
167167
| └ 🟢 crowdsecurity/syslog-logs
168168
└ s01-parse
169169
└ 🟢 crowdsecurity/myservice-logs
170170
171-
line: Dec 8 06:28:43 mymachine myservice[2806]: unknown user 'toto' from '1.2.3.4'
171+
line: Dec 8 06:28:43 mymachine myservice[2806]: unknown user 'toto' from '192.168.1.1'
172172
├ s00-raw
173173
| └ 🟢 crowdsecurity/syslog-logs
174174
└ s01-parse
175175
└ 🟢 crowdsecurity/myservice-logs
176176
177-
line: Dec 8 06:28:43 mymachine myservice[2806]: accepted connection for user 'toto' from '1.2.3.4'
177+
line: Dec 8 06:28:43 mymachine myservice[2806]: accepted connection for user 'toto' from '192.168.1.1'
178178
├ s00-raw
179179
| └ 🟢 crowdsecurity/syslog-logs
180180
└ s01-parse
@@ -250,12 +250,12 @@ results["s01-parse"]["crowdsecurity/myservice-logs"][0].Success == true
250250
...
251251
results["s01-parse"]["crowdsecurity/myservice-logs"][0].Evt.Parsed["timestamp"] == "Dec 8 06:28:43"
252252
results["s01-parse"]["crowdsecurity/myservice-logs"][0].Evt.Parsed["program"] == "myservice"
253-
results["s01-parse"]["crowdsecurity/myservice-logs"][0].Evt.Parsed["source_ip"] == "1.2.3.4"
253+
results["s01-parse"]["crowdsecurity/myservice-logs"][0].Evt.Parsed["source_ip"] == "192.168.1.1"
254254
results["s01-parse"]["crowdsecurity/myservice-logs"][0].Evt.Parsed["user"] == "toto"
255255
results["s01-parse"]["crowdsecurity/myservice-logs"][0].Evt.Meta["log_subtype"] == "myservice_bad_password"
256256
results["s01-parse"]["crowdsecurity/myservice-logs"][0].Evt.Meta["log_type"] == "myservice_failed_auth"
257257
results["s01-parse"]["crowdsecurity/myservice-logs"][0].Evt.Meta["service"] == "myservice"
258-
results["s01-parse"]["crowdsecurity/myservice-logs"][0].Evt.Meta["source_ip"] == "1.2.3.4"
258+
results["s01-parse"]["crowdsecurity/myservice-logs"][0].Evt.Meta["source_ip"] == "192.168.1.1"
259259
results["s01-parse"]["crowdsecurity/myservice-logs"][0].Evt.Meta["username"] == "toto"
260260
...
261261
results["s01-parse"]["crowdsecurity/myservice-logs"][1].Evt.Meta["log_subtype"] == "myservice_bad_user"
@@ -272,26 +272,26 @@ Again, further inspection with `cscli hubtest explain` will show us more about w
272272

273273
```bash
274274
▶ cscli hubtest explain myservice-logs
275-
line: Dec 8 06:28:43 mymachine myservice[2806]: bad password for user 'toto' from '1.2.3.4'
275+
line: Dec 8 06:28:43 mymachine myservice[2806]: bad password for user 'toto' from '192.168.1.1'
276276
├ s00-raw
277277
| └ 🟢 crowdsecurity/syslog-logs
278278
└ s01-parse
279279
└ 🟢 crowdsecurity/myservice-logs
280280
281-
line: Dec 8 06:28:43 mymachine myservice[2806]: unknown user 'toto' from '1.2.3.4'
281+
line: Dec 8 06:28:43 mymachine myservice[2806]: unknown user 'toto' from '192.168.1.1'
282282
├ s00-raw
283283
| └ 🟢 crowdsecurity/syslog-logs
284284
└ s01-parse
285285
└ 🟢 crowdsecurity/myservice-logs
286286
287-
line: Dec 8 06:28:43 mymachine myservice[2806]: accepted connection for user 'toto' from '1.2.3.4'
287+
line: Dec 8 06:28:43 mymachine myservice[2806]: accepted connection for user 'toto' from '192.168.1.1'
288288
├ s00-raw
289289
| └ 🟢 crowdsecurity/syslog-logs
290290
└ s01-parse
291291
└ 🔴 crowdsecurity/myservice-logs
292292
```
293293

294-
__note: we can see that our log line `accepted connection for user 'toto' from '1.2.3.4'` wasn't parsed by `crowdsecurity/myservice-logs` as we have no pattern for it__
294+
__note: we can see that our log line `accepted connection for user 'toto' from '192.168.1.1'` wasn't parsed by `crowdsecurity/myservice-logs` as we have no pattern for it__
295295

296296

297297
## Closing word

0 commit comments

Comments
 (0)