diff --git a/configs/local_decoder.xml b/configs/local_decoder.xml new file mode 100644 index 0000000..9b60626 --- /dev/null +++ b/configs/local_decoder.xml @@ -0,0 +1,194 @@ + + + + + + + + + + filterlog + + + + + pfsense-wrapped + filterlog\S* \S*,\S*,\S*,(\S*),\S*,\S*,(\S*), + id,action + + + + + pfsense-wrapped + \S*,\S*,\S*,\S*,\S*,\S*,\S*,\S*,\S*,(\S*),\S*,(\S*),(\S*), + protocol,srcip,dstip + + + + + pfsense-wrapped + (\d*),(\d*),\S* + srcport,dstport + + + + + pfsense-wrapped + datalength=(\S*)|(\d*) + length + + + + + + postfix\(\d+\): \w+ \d+ \d+:\d+:\d+ \w+ \.+\(\d+\): + + + + mailcow-journald-unwrap + \.+ + extra_data + + + + + + gitea + + + + + gitea + Failed authentication attempt + Failed authentication attempt for (\S+) from (\d+.\d+.\d+.\d+) + user, srcip + + + + + + dovecot + rip=(\S+), + srcip + + + + + + postfix + postfix/\S+smtpd\S*: warning: \S+: SASL + unknown\[((\d+\.\d+\.\d+)\.\d+)\]: SASL \S+ authentication failed.*sasl_username=(\S+) + srcip, src_subnet, dstuser + diff --git a/configs/local_rules.xml b/configs/local_rules.xml new file mode 100644 index 0000000..bfee7e7 --- /dev/null +++ b/configs/local_rules.xml @@ -0,0 +1,421 @@ + + + + + + + + + + + + + 5716 + 1.1.1.1 + sshd: authentication failed from IP 1.1.1.1. + authentication_failed,pci_dss_10.2.4,pci_dss_10.2.5, + + + + + + + + + + + pfsense-wrapped + pfSense wrapped syslog parent rule. + + + + + 87699 + block + pfSense firewall drop event (wrapped). + pfsense,firewall_block,pci_dss_1.4,gpg13_4.12,hipaa_164.312.a.1,nist_800_53_SC.7,tsc_CC6.7,tsc_CC6.8, + + + + + 87761 + + Multiple pfSense firewall block events from same source (wrapped). + + T1110 + + pfsense, + + + + + + + + + + + web|attack|attacks + etc/lists/blacklist-alienvault + IP address found in AlienVault reputation database. + + + + + + + + + + + 9705 + watchdog@invalid + Dovecot: mailcow watchdog health check (ignored) + + + + + 9707 + rip=172.22.1. + Dovecot: mailcow watchdog IMAP probe disconnect (ignored) + + + + + 9706 + imap(chris@wittenberger.us) + Dovecot: own-mailbox routine session disconnect (ignored) + + + + + 9706 + managesieve-login: Disconnected: Connection closed (no auth attempts + Mailcow watchdog managesieve healthcheck - suppressed + + + + + 9700 + no auth attempts + Dovecot: connection with no auth attempt from $(srcip) + dovecot,recon, + + + + + 100205 + + Dovecot: aggressive port scanning from $(srcip) - possible attack precursor + dovecot,recon,attack, + + + + + + + + + + + 9701 + Dovecot successful login - suppressed (routine IMAP polling) + + + + + + + + + + + gitea + Gitea event (parent) + + + + + 100400 + router: polling + Gitea: router polling - suppressed + + + + 100400 + router: completed + Gitea: router completed request - suppressed + + + + + 100400 + Failed authentication attempt + Gitea: failed authentication attempt + authentication_failed, + + T1110 + + + + + + 100410 + Gitea: possible brute force (5+ failed logins in 2 min) + authentication_failures, + + T1110 + + + + + + 100400 + new user signed up|created user + Gitea: new user account created + + + + 100400 + deleted user|DeleteUser + Gitea: user account deleted + + + + + 100400 + add public key|added SSH key|AddPublicKey + Gitea: SSH key added to account + + + + 100400 + delete public key|deleted SSH key|DeletePublicKey + Gitea: SSH key removed from account + + + + + 100400 + access token|AccessToken + Gitea: access token activity + + + + + 100400 + ResetPasswd|recover_account + Gitea: password reset / account recovery + + + + + 100400 + repository deleted|DeleteRepository + Gitea: repository deleted + + + + + 100400 + TwoFactor|two-factor|TOTP + Gitea: 2FA event + + + + + + + + + + + 3332 + + Postfix SASL: brute force login attempt from $(srcip) + authentication_failed,brute_force, + + + + + 100310 + 100204 + + Mail: successful login after brute force from $(srcip) - ACCOUNT COMPROMISED + authentication_success,brute_force_success,attack, + + + + + 3332 + + + Postfix SASL: distributed brute force targeting user $(dstuser) + authentication_failed,brute_force,distributed, + + + + + 100310 + + Postfix SASL: persistent brute force from $(srcip) - 3+ bursts in 24h + authentication_failed,brute_force,persistent, + + + + + 3332 + src_subnet + Postfix SASL: coordinated brute force from subnet $(src_subnet).0/24 + authentication_failed,brute_force,subnet_scan, + + + + + 3332 + + + Postfix SASL: credential stuffing against user $(dstuser) from multiple IPs + authentication_failed,brute_force,distributed,credential_stuffing, + + + + + 3332 + Postfix SASL: high volume of authentication failures (50+ in 1h) + authentication_failed,brute_force,volume, + + +