Skip to content

Commit a6b10f3

Browse files
Yanis-KouidriYanis KouidriLaurenceJJones
authored
feat: envoy parser / collection (#1622)
* Add parser for Envoy JSON logs via CRI * Add Envoy parser documentation * Add test instructions for Envoy JSON logs parser * Add Envoy parser log entries * align with other webservers * add envoy collection * clean envoy test fixture * document envoy collection usage * rename envoy parser to envoy-logs * add envoy clf parsing * refresh envoy clf asserts * fix envoy clf escaping --------- Co-authored-by: Yanis Kouidri <yanis.kouidri@gmail.com> Co-authored-by: Laurence <laurence.jones@live.co.uk>
1 parent db22c45 commit a6b10f3

File tree

14 files changed

+947
-0
lines changed

14 files changed

+947
-0
lines changed

‎.tests/envoy-http-bad-user-agent/config.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
parsers:
2+
- crowdsecurity/cri-logs
3+
- parsers/s01-parse/yanis-kouidri/envoy-logs.yaml
4+
- crowdsecurity/http-logs
5+
- crowdsecurity/dateparse-enrich
6+
scenarios:
7+
- crowdsecurity/http-bad-user-agent
8+
postoverflows:
9+
- ""
10+
log_file: envoy-http-bad-user-agent.log
11+
log_type: containerd
12+
ignore_parsers: true
13+
labels:
14+
program: envoy

‎.tests/envoy-http-bad-user-agent/envoy-http-bad-user-agent.log‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
2025-12-31T17:37:40.493035218+01:00 stdout F {"start_time":"2025-12-31T16:37:40.479Z","method":"GET","x-envoy-origin-path":"/admin","response_code":404,"user-agent":"Mozilla/5.0 zgrab/0.x","downstream_remote_address":"10.0.0.12:59292",":authority":"app.internal"}
2+
2025-12-31T17:37:41.493035218+01:00 stdout F {"start_time":"2025-12-31T16:37:41.479Z","method":"GET","x-envoy-origin-path":"/login","response_code":200,"user-agent":"Mozilla/5.0 zgrab/0.x","downstream_remote_address":"10.0.0.12:59292",":authority":"app.internal"}

‎.tests/envoy-http-bad-user-agent/scenario.assert‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
len(results) == 1
2+
"10.0.0.12" in results[0].Overflow.GetSources()
3+
results[0].Overflow.Sources["10.0.0.12"].IP == "10.0.0.12"
4+
results[0].Overflow.Sources["10.0.0.12"].Range == ""
5+
results[0].Overflow.Sources["10.0.0.12"].GetScope() == "Ip"
6+
results[0].Overflow.Sources["10.0.0.12"].GetValue() == "10.0.0.12"
7+
basename(results[0].Overflow.Alert.Events[0].GetMeta("datasource_path")) == "envoy-http-bad-user-agent.log"
8+
results[0].Overflow.Alert.Events[0].GetMeta("datasource_type") == "file"
9+
results[0].Overflow.Alert.Events[0].GetMeta("http_args_len") == "0"
10+
results[0].Overflow.Alert.Events[0].GetMeta("http_path") == "/admin"
11+
results[0].Overflow.Alert.Events[0].GetMeta("http_status") == "404"
12+
results[0].Overflow.Alert.Events[0].GetMeta("http_user_agent") == "Mozilla/5.0 zgrab/0.x"
13+
results[0].Overflow.Alert.Events[0].GetMeta("http_verb") == "GET"
14+
results[0].Overflow.Alert.Events[0].GetMeta("log_type") == "http_access-log"
15+
results[0].Overflow.Alert.Events[0].GetMeta("service") == "http"
16+
results[0].Overflow.Alert.Events[0].GetMeta("source_ip") == "10.0.0.12"
17+
results[0].Overflow.Alert.Events[0].GetMeta("target_fqdn") == "app.internal"
18+
results[0].Overflow.Alert.Events[0].GetMeta("timestamp") == "2025-12-31T16:37:40.479Z"
19+
basename(results[0].Overflow.Alert.Events[1].GetMeta("datasource_path")) == "envoy-http-bad-user-agent.log"
20+
results[0].Overflow.Alert.Events[1].GetMeta("datasource_type") == "file"
21+
results[0].Overflow.Alert.Events[1].GetMeta("http_args_len") == "0"
22+
results[0].Overflow.Alert.Events[1].GetMeta("http_path") == "/login"
23+
results[0].Overflow.Alert.Events[1].GetMeta("http_status") == "200"
24+
results[0].Overflow.Alert.Events[1].GetMeta("http_user_agent") == "Mozilla/5.0 zgrab/0.x"
25+
results[0].Overflow.Alert.Events[1].GetMeta("http_verb") == "GET"
26+
results[0].Overflow.Alert.Events[1].GetMeta("log_type") == "http_access-log"
27+
results[0].Overflow.Alert.Events[1].GetMeta("service") == "http"
28+
results[0].Overflow.Alert.Events[1].GetMeta("source_ip") == "10.0.0.12"
29+
results[0].Overflow.Alert.Events[1].GetMeta("target_fqdn") == "app.internal"
30+
results[0].Overflow.Alert.Events[1].GetMeta("timestamp") == "2025-12-31T16:37:41.479Z"
31+
results[0].Overflow.Alert.GetScenario() == "crowdsecurity/http-bad-user-agent"
32+
results[0].Overflow.Alert.Remediation == true
33+
results[0].Overflow.Alert.GetEventsCount() == 2

‎.tests/envoy-http-crawl-non_statics/config.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
parsers:
2+
- crowdsecurity/cri-logs
3+
- parsers/s01-parse/yanis-kouidri/envoy-logs.yaml
4+
- crowdsecurity/http-logs
5+
- crowdsecurity/dateparse-enrich
6+
scenarios:
7+
- crowdsecurity/http-crawl-non_statics
8+
postoverflows:
9+
- ""
10+
log_file: envoy-http-crawl-non_statics.log
11+
log_type: containerd
12+
ignore_parsers: true
13+
labels:
14+
program: envoy

‎.tests/envoy-http-crawl-non_statics/envoy-http-crawl-non_statics.log‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
2025-12-31T17:40:00.000000100+01:00 stdout F {"start_time":"2025-12-31T16:40:00.100Z","method":"GET","x-envoy-origin-path":"/page-01","response_code":404,"user-agent":"Mozilla/5.0","downstream_remote_address":"10.0.0.13:40000",":authority":"crawl.internal"}
2+
2025-12-31T17:40:00.000000110+01:00 stdout F {"start_time":"2025-12-31T16:40:00.110Z","method":"GET","x-envoy-origin-path":"/page-02","response_code":404,"user-agent":"Mozilla/5.0","downstream_remote_address":"10.0.0.13:40000",":authority":"crawl.internal"}
3+
2025-12-31T17:40:00.000000120+01:00 stdout F {"start_time":"2025-12-31T16:40:00.120Z","method":"GET","x-envoy-origin-path":"/page-03","response_code":404,"user-agent":"Mozilla/5.0","downstream_remote_address":"10.0.0.13:40000",":authority":"crawl.internal"}
4+
2025-12-31T17:40:00.000000130+01:00 stdout F {"start_time":"2025-12-31T16:40:00.130Z","method":"GET","x-envoy-origin-path":"/page-04","response_code":404,"user-agent":"Mozilla/5.0","downstream_remote_address":"10.0.0.13:40000",":authority":"crawl.internal"}
5+
2025-12-31T17:40:00.000000140+01:00 stdout F {"start_time":"2025-12-31T16:40:00.140Z","method":"GET","x-envoy-origin-path":"/page-05","response_code":404,"user-agent":"Mozilla/5.0","downstream_remote_address":"10.0.0.13:40000",":authority":"crawl.internal"}
6+
2025-12-31T17:40:00.000000150+01:00 stdout F {"start_time":"2025-12-31T16:40:00.150Z","method":"GET","x-envoy-origin-path":"/page-06","response_code":404,"user-agent":"Mozilla/5.0","downstream_remote_address":"10.0.0.13:40000",":authority":"crawl.internal"}
7+
2025-12-31T17:40:00.000000160+01:00 stdout F {"start_time":"2025-12-31T16:40:00.160Z","method":"GET","x-envoy-origin-path":"/page-07","response_code":404,"user-agent":"Mozilla/5.0","downstream_remote_address":"10.0.0.13:40000",":authority":"crawl.internal"}
8+
2025-12-31T17:40:00.000000170+01:00 stdout F {"start_time":"2025-12-31T16:40:00.170Z","method":"GET","x-envoy-origin-path":"/page-08","response_code":404,"user-agent":"Mozilla/5.0","downstream_remote_address":"10.0.0.13:40000",":authority":"crawl.internal"}
9+
2025-12-31T17:40:00.000000180+01:00 stdout F {"start_time":"2025-12-31T16:40:00.180Z","method":"GET","x-envoy-origin-path":"/page-09","response_code":404,"user-agent":"Mozilla/5.0","downstream_remote_address":"10.0.0.13:40000",":authority":"crawl.internal"}
10+
2025-12-31T17:40:00.000000190+01:00 stdout F {"start_time":"2025-12-31T16:40:00.190Z","method":"GET","x-envoy-origin-path":"/page-10","response_code":404,"user-agent":"Mozilla/5.0","downstream_remote_address":"10.0.0.13:40000",":authority":"crawl.internal"}
11+
2025-12-31T17:40:00.000000200+01:00 stdout F {"start_time":"2025-12-31T16:40:00.200Z","method":"GET","x-envoy-origin-path":"/page-11","response_code":404,"user-agent":"Mozilla/5.0","downstream_remote_address":"10.0.0.13:40000",":authority":"crawl.internal"}
12+
2025-12-31T17:40:00.000000210+01:00 stdout F {"start_time":"2025-12-31T16:40:00.210Z","method":"GET","x-envoy-origin-path":"/page-12","response_code":404,"user-agent":"Mozilla/5.0","downstream_remote_address":"10.0.0.13:40000",":authority":"crawl.internal"}
13+
2025-12-31T17:40:00.000000220+01:00 stdout F {"start_time":"2025-12-31T16:40:00.220Z","method":"GET","x-envoy-origin-path":"/page-13","response_code":404,"user-agent":"Mozilla/5.0","downstream_remote_address":"10.0.0.13:40000",":authority":"crawl.internal"}
14+
2025-12-31T17:40:00.000000230+01:00 stdout F {"start_time":"2025-12-31T16:40:00.230Z","method":"GET","x-envoy-origin-path":"/page-14","response_code":404,"user-agent":"Mozilla/5.0","downstream_remote_address":"10.0.0.13:40000",":authority":"crawl.internal"}
15+
2025-12-31T17:40:00.000000240+01:00 stdout F {"start_time":"2025-12-31T16:40:00.240Z","method":"GET","x-envoy-origin-path":"/page-15","response_code":404,"user-agent":"Mozilla/5.0","downstream_remote_address":"10.0.0.13:40000",":authority":"crawl.internal"}
16+
2025-12-31T17:40:00.000000250+01:00 stdout F {"start_time":"2025-12-31T16:40:00.250Z","method":"GET","x-envoy-origin-path":"/page-16","response_code":404,"user-agent":"Mozilla/5.0","downstream_remote_address":"10.0.0.13:40000",":authority":"crawl.internal"}
17+
2025-12-31T17:40:00.000000260+01:00 stdout F {"start_time":"2025-12-31T16:40:00.260Z","method":"GET","x-envoy-origin-path":"/page-17","response_code":404,"user-agent":"Mozilla/5.0","downstream_remote_address":"10.0.0.13:40000",":authority":"crawl.internal"}
18+
2025-12-31T17:40:00.000000270+01:00 stdout F {"start_time":"2025-12-31T16:40:00.270Z","method":"GET","x-envoy-origin-path":"/page-18","response_code":404,"user-agent":"Mozilla/5.0","downstream_remote_address":"10.0.0.13:40000",":authority":"crawl.internal"}
19+
2025-12-31T17:40:00.000000280+01:00 stdout F {"start_time":"2025-12-31T16:40:00.280Z","method":"GET","x-envoy-origin-path":"/page-19","response_code":404,"user-agent":"Mozilla/5.0","downstream_remote_address":"10.0.0.13:40000",":authority":"crawl.internal"}
20+
2025-12-31T17:40:00.000000290+01:00 stdout F {"start_time":"2025-12-31T16:40:00.290Z","method":"GET","x-envoy-origin-path":"/page-20","response_code":404,"user-agent":"Mozilla/5.0","downstream_remote_address":"10.0.0.13:40000",":authority":"crawl.internal"}
21+
2025-12-31T17:40:00.000000300+01:00 stdout F {"start_time":"2025-12-31T16:40:00.300Z","method":"GET","x-envoy-origin-path":"/page-21","response_code":404,"user-agent":"Mozilla/5.0","downstream_remote_address":"10.0.0.13:40000",":authority":"crawl.internal"}
22+
2025-12-31T17:40:00.000000310+01:00 stdout F {"start_time":"2025-12-31T16:40:00.310Z","method":"GET","x-envoy-origin-path":"/page-22","response_code":404,"user-agent":"Mozilla/5.0","downstream_remote_address":"10.0.0.13:40000",":authority":"crawl.internal"}
23+
2025-12-31T17:40:00.000000320+01:00 stdout F {"start_time":"2025-12-31T16:40:00.320Z","method":"GET","x-envoy-origin-path":"/page-23","response_code":404,"user-agent":"Mozilla/5.0","downstream_remote_address":"10.0.0.13:40000",":authority":"crawl.internal"}
24+
2025-12-31T17:40:00.000000330+01:00 stdout F {"start_time":"2025-12-31T16:40:00.330Z","method":"GET","x-envoy-origin-path":"/page-24","response_code":404,"user-agent":"Mozilla/5.0","downstream_remote_address":"10.0.0.13:40000",":authority":"crawl.internal"}
25+
2025-12-31T17:40:00.000000340+01:00 stdout F {"start_time":"2025-12-31T16:40:00.340Z","method":"GET","x-envoy-origin-path":"/page-25","response_code":404,"user-agent":"Mozilla/5.0","downstream_remote_address":"10.0.0.13:40000",":authority":"crawl.internal"}
26+
2025-12-31T17:40:00.000000350+01:00 stdout F {"start_time":"2025-12-31T16:40:00.350Z","method":"GET","x-envoy-origin-path":"/page-26","response_code":404,"user-agent":"Mozilla/5.0","downstream_remote_address":"10.0.0.13:40000",":authority":"crawl.internal"}
27+
2025-12-31T17:40:00.000000360+01:00 stdout F {"start_time":"2025-12-31T16:40:00.360Z","method":"GET","x-envoy-origin-path":"/page-27","response_code":404,"user-agent":"Mozilla/5.0","downstream_remote_address":"10.0.0.13:40000",":authority":"crawl.internal"}
28+
2025-12-31T17:40:00.000000370+01:00 stdout F {"start_time":"2025-12-31T16:40:00.370Z","method":"GET","x-envoy-origin-path":"/page-28","response_code":404,"user-agent":"Mozilla/5.0","downstream_remote_address":"10.0.0.13:40000",":authority":"crawl.internal"}
29+
2025-12-31T17:40:00.000000380+01:00 stdout F {"start_time":"2025-12-31T16:40:00.380Z","method":"GET","x-envoy-origin-path":"/page-29","response_code":404,"user-agent":"Mozilla/5.0","downstream_remote_address":"10.0.0.13:40000",":authority":"crawl.internal"}
30+
2025-12-31T17:40:00.000000390+01:00 stdout F {"start_time":"2025-12-31T16:40:00.390Z","method":"GET","x-envoy-origin-path":"/page-30","response_code":404,"user-agent":"Mozilla/5.0","downstream_remote_address":"10.0.0.13:40000",":authority":"crawl.internal"}
31+
2025-12-31T17:40:00.000000400+01:00 stdout F {"start_time":"2025-12-31T16:40:00.400Z","method":"GET","x-envoy-origin-path":"/page-31","response_code":404,"user-agent":"Mozilla/5.0","downstream_remote_address":"10.0.0.13:40000",":authority":"crawl.internal"}
32+
2025-12-31T17:40:00.000000410+01:00 stdout F {"start_time":"2025-12-31T16:40:00.410Z","method":"GET","x-envoy-origin-path":"/page-32","response_code":404,"user-agent":"Mozilla/5.0","downstream_remote_address":"10.0.0.13:40000",":authority":"crawl.internal"}
33+
2025-12-31T17:40:00.000000420+01:00 stdout F {"start_time":"2025-12-31T16:40:00.420Z","method":"GET","x-envoy-origin-path":"/page-33","response_code":404,"user-agent":"Mozilla/5.0","downstream_remote_address":"10.0.0.13:40000",":authority":"crawl.internal"}
34+
2025-12-31T17:40:00.000000430+01:00 stdout F {"start_time":"2025-12-31T16:40:00.430Z","method":"GET","x-envoy-origin-path":"/page-34","response_code":404,"user-agent":"Mozilla/5.0","downstream_remote_address":"10.0.0.13:40000",":authority":"crawl.internal"}
35+
2025-12-31T17:40:00.000000440+01:00 stdout F {"start_time":"2025-12-31T16:40:00.440Z","method":"GET","x-envoy-origin-path":"/page-35","response_code":404,"user-agent":"Mozilla/5.0","downstream_remote_address":"10.0.0.13:40000",":authority":"crawl.internal"}
36+
2025-12-31T17:40:00.000000450+01:00 stdout F {"start_time":"2025-12-31T16:40:00.450Z","method":"GET","x-envoy-origin-path":"/page-36","response_code":404,"user-agent":"Mozilla/5.0","downstream_remote_address":"10.0.0.13:40000",":authority":"crawl.internal"}
37+
2025-12-31T17:40:00.000000460+01:00 stdout F {"start_time":"2025-12-31T16:40:00.460Z","method":"GET","x-envoy-origin-path":"/page-37","response_code":404,"user-agent":"Mozilla/5.0","downstream_remote_address":"10.0.0.13:40000",":authority":"crawl.internal"}
38+
2025-12-31T17:40:00.000000470+01:00 stdout F {"start_time":"2025-12-31T16:40:00.470Z","method":"GET","x-envoy-origin-path":"/page-38","response_code":404,"user-agent":"Mozilla/5.0","downstream_remote_address":"10.0.0.13:40000",":authority":"crawl.internal"}
39+
2025-12-31T17:40:00.000000480+01:00 stdout F {"start_time":"2025-12-31T16:40:00.480Z","method":"GET","x-envoy-origin-path":"/page-39","response_code":404,"user-agent":"Mozilla/5.0","downstream_remote_address":"10.0.0.13:40000",":authority":"crawl.internal"}
40+
2025-12-31T17:40:00.000000490+01:00 stdout F {"start_time":"2025-12-31T16:40:00.490Z","method":"GET","x-envoy-origin-path":"/page-40","response_code":404,"user-agent":"Mozilla/5.0","downstream_remote_address":"10.0.0.13:40000",":authority":"crawl.internal"}
41+
2025-12-31T17:40:00.000000490+01:00 stdout F {"start_time":"2025-12-31T16:40:00.490Z","method":"GET","x-envoy-origin-path":"/page-41","response_code":404,"user-agent":"Mozilla/5.0","downstream_remote_address":"10.0.0.13:40000",":authority":"crawl.internal"}

‎.tests/envoy-http-crawl-non_statics/scenario.assert‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
len(results) == 1
2+
"10.0.0.13" in results[0].Overflow.GetSources()
3+
results[0].Overflow.Sources["10.0.0.13"].IP == "10.0.0.13"
4+
results[0].Overflow.Sources["10.0.0.13"].Range == ""
5+
results[0].Overflow.Sources["10.0.0.13"].GetScope() == "Ip"
6+
results[0].Overflow.Sources["10.0.0.13"].GetValue() == "10.0.0.13"
7+
basename(results[0].Overflow.Alert.Events[0].GetMeta("datasource_path")) == "envoy-http-crawl-non_statics.log"
8+
results[0].Overflow.Alert.Events[0].GetMeta("datasource_type") == "file"
9+
results[0].Overflow.Alert.Events[0].GetMeta("http_args_len") == "0"
10+
results[0].Overflow.Alert.Events[0].GetMeta("http_path") == "/page-36"
11+
results[0].Overflow.Alert.Events[0].GetMeta("http_status") == "404"
12+
results[0].Overflow.Alert.Events[0].GetMeta("http_user_agent") == "Mozilla/5.0"
13+
results[0].Overflow.Alert.Events[0].GetMeta("http_verb") == "GET"
14+
results[0].Overflow.Alert.Events[0].GetMeta("log_type") == "http_access-log"
15+
results[0].Overflow.Alert.Events[0].GetMeta("service") == "http"
16+
results[0].Overflow.Alert.Events[0].GetMeta("source_ip") == "10.0.0.13"
17+
results[0].Overflow.Alert.Events[0].GetMeta("target_fqdn") == "crawl.internal"
18+
results[0].Overflow.Alert.Events[0].GetMeta("timestamp") == "2025-12-31T16:40:00.45Z"
19+
basename(results[0].Overflow.Alert.Events[1].GetMeta("datasource_path")) == "envoy-http-crawl-non_statics.log"
20+
results[0].Overflow.Alert.Events[1].GetMeta("datasource_type") == "file"
21+
results[0].Overflow.Alert.Events[1].GetMeta("http_args_len") == "0"
22+
results[0].Overflow.Alert.Events[1].GetMeta("http_path") == "/page-37"
23+
results[0].Overflow.Alert.Events[1].GetMeta("http_status") == "404"
24+
results[0].Overflow.Alert.Events[1].GetMeta("http_user_agent") == "Mozilla/5.0"
25+
results[0].Overflow.Alert.Events[1].GetMeta("http_verb") == "GET"
26+
results[0].Overflow.Alert.Events[1].GetMeta("log_type") == "http_access-log"
27+
results[0].Overflow.Alert.Events[1].GetMeta("service") == "http"
28+
results[0].Overflow.Alert.Events[1].GetMeta("source_ip") == "10.0.0.13"
29+
results[0].Overflow.Alert.Events[1].GetMeta("target_fqdn") == "crawl.internal"
30+
results[0].Overflow.Alert.Events[1].GetMeta("timestamp") == "2025-12-31T16:40:00.46Z"
31+
basename(results[0].Overflow.Alert.Events[2].GetMeta("datasource_path")) == "envoy-http-crawl-non_statics.log"
32+
results[0].Overflow.Alert.Events[2].GetMeta("datasource_type") == "file"
33+
results[0].Overflow.Alert.Events[2].GetMeta("http_args_len") == "0"
34+
results[0].Overflow.Alert.Events[2].GetMeta("http_path") == "/page-38"
35+
results[0].Overflow.Alert.Events[2].GetMeta("http_status") == "404"
36+
results[0].Overflow.Alert.Events[2].GetMeta("http_user_agent") == "Mozilla/5.0"
37+
results[0].Overflow.Alert.Events[2].GetMeta("http_verb") == "GET"
38+
results[0].Overflow.Alert.Events[2].GetMeta("log_type") == "http_access-log"
39+
results[0].Overflow.Alert.Events[2].GetMeta("service") == "http"
40+
results[0].Overflow.Alert.Events[2].GetMeta("source_ip") == "10.0.0.13"
41+
results[0].Overflow.Alert.Events[2].GetMeta("target_fqdn") == "crawl.internal"
42+
results[0].Overflow.Alert.Events[2].GetMeta("timestamp") == "2025-12-31T16:40:00.47Z"
43+
basename(results[0].Overflow.Alert.Events[3].GetMeta("datasource_path")) == "envoy-http-crawl-non_statics.log"
44+
results[0].Overflow.Alert.Events[3].GetMeta("datasource_type") == "file"
45+
results[0].Overflow.Alert.Events[3].GetMeta("http_args_len") == "0"
46+
results[0].Overflow.Alert.Events[3].GetMeta("http_path") == "/page-39"
47+
results[0].Overflow.Alert.Events[3].GetMeta("http_status") == "404"
48+
results[0].Overflow.Alert.Events[3].GetMeta("http_user_agent") == "Mozilla/5.0"
49+
results[0].Overflow.Alert.Events[3].GetMeta("http_verb") == "GET"
50+
results[0].Overflow.Alert.Events[3].GetMeta("log_type") == "http_access-log"
51+
results[0].Overflow.Alert.Events[3].GetMeta("service") == "http"
52+
results[0].Overflow.Alert.Events[3].GetMeta("source_ip") == "10.0.0.13"
53+
results[0].Overflow.Alert.Events[3].GetMeta("target_fqdn") == "crawl.internal"
54+
results[0].Overflow.Alert.Events[3].GetMeta("timestamp") == "2025-12-31T16:40:00.48Z"
55+
basename(results[0].Overflow.Alert.Events[4].GetMeta("datasource_path")) == "envoy-http-crawl-non_statics.log"
56+
results[0].Overflow.Alert.Events[4].GetMeta("datasource_type") == "file"
57+
results[0].Overflow.Alert.Events[4].GetMeta("http_args_len") == "0"
58+
results[0].Overflow.Alert.Events[4].GetMeta("http_path") == "/page-40"
59+
results[0].Overflow.Alert.Events[4].GetMeta("http_status") == "404"
60+
results[0].Overflow.Alert.Events[4].GetMeta("http_user_agent") == "Mozilla/5.0"
61+
results[0].Overflow.Alert.Events[4].GetMeta("http_verb") == "GET"
62+
results[0].Overflow.Alert.Events[4].GetMeta("log_type") == "http_access-log"
63+
results[0].Overflow.Alert.Events[4].GetMeta("service") == "http"
64+
results[0].Overflow.Alert.Events[4].GetMeta("source_ip") == "10.0.0.13"
65+
results[0].Overflow.Alert.Events[4].GetMeta("target_fqdn") == "crawl.internal"
66+
results[0].Overflow.Alert.Events[4].GetMeta("timestamp") == "2025-12-31T16:40:00.49Z"
67+
basename(results[0].Overflow.Alert.Events[5].GetMeta("datasource_path")) == "envoy-http-crawl-non_statics.log"
68+
results[0].Overflow.Alert.Events[5].GetMeta("datasource_type") == "file"
69+
results[0].Overflow.Alert.Events[5].GetMeta("http_args_len") == "0"
70+
results[0].Overflow.Alert.Events[5].GetMeta("http_path") == "/page-41"
71+
results[0].Overflow.Alert.Events[5].GetMeta("http_status") == "404"
72+
results[0].Overflow.Alert.Events[5].GetMeta("http_user_agent") == "Mozilla/5.0"
73+
results[0].Overflow.Alert.Events[5].GetMeta("http_verb") == "GET"
74+
results[0].Overflow.Alert.Events[5].GetMeta("log_type") == "http_access-log"
75+
results[0].Overflow.Alert.Events[5].GetMeta("service") == "http"
76+
results[0].Overflow.Alert.Events[5].GetMeta("source_ip") == "10.0.0.13"
77+
results[0].Overflow.Alert.Events[5].GetMeta("target_fqdn") == "crawl.internal"
78+
results[0].Overflow.Alert.Events[5].GetMeta("timestamp") == "2025-12-31T16:40:00.49Z"
79+
results[0].Overflow.Alert.GetScenario() == "crowdsecurity/http-crawl-non_statics"
80+
results[0].Overflow.Alert.Remediation == true
81+
results[0].Overflow.Alert.GetEventsCount() == 41

0 commit comments

Comments
 (0)