Build a CrowdSec Scenario and Parser for Artica PCAP filter

• Return back to the Artica PCAP command-line main section

This article will enable you to integrate events generated by Artica PCAP filter into the CrowdSec process.

Create the Parser 

Create a new file /etc/crowdsec/parsers/s01-parse/articapcap.yaml

Save this content:

filter: "evt.Parsed.program == 'articapcap'"
name: articatech/articapcap-logs
description: "Parse Artica PCAP log"
onsuccess: next_stage

nodes:
  - grok:
          pattern: 'Detected bad IP \[%{IP:source_ip}\]'
          apply_on: message
          statics:
              - meta: log_type
                  value: articapcap

statics:
      - meta: service
          value: articapcap
      - meta: source_ip
          expression: "evt.Parsed.source_ip"

Create the Scenario

Create a new file /etc/crowdsec/scenarios/articatech/articalogon-bf.yaml

type: leaky
name: articatech/articapcap-bf
description: "Detect Artica PCAP bad reputation IP"
filter: "evt.Meta.log_type == 'articapcap'"
leakspeed: 5m
capacity: 5
groupby: evt.Meta.source_ip
blackhole: 5m
reprocess: true
labels:
service: articapcap
type: bruteforce
remediation: true

Tune the leakspeed,capacity,blackhole according to your needs. 

Modify the acquis.yaml

Open /etc/crowdsec/acquis.yaml.

Add these values:

---
filenames:
- /var/log/articapsniffer.log
labels:
  type: articapcap

Restart the service for the changes to take effect.

Testing configuration 

Run crowdsec -t to check whether there are any issues in the configuration.

If you have already detected events in the Artica PCAP filter log file, run 

cscli explain --file /var/log/articapsniffer.log --type articapcap

You should see something like this: 

line: {"level":"info","time":1691069841,"message":"Detected bad IP [124.123.122.108]:1433 (124.123.122.108.actcorp.in) Destination …"}
├ s00-raw
| ├ 🟢 crowdsecurity/non-syslog (+5 ~8)
| └ 🔴 crowdsecurity/syslog-logs
├ s01-parse
| ├ 🔴 articatech/artica-logon-logs
| └ 🟢 articatech/articapcap-logs (+4 ~1)
├ s02-enrich
| ├ 🔴 crowdsecurity/dateparse-enrich
| └ 🟢 crowdsecurity/geoip-enrich (+13)
├-------- parser success 🟢
├ Scenarios
  └ 🟢 articatech/articapcap-bf