Mongodb > 4.4 crowdsec parser WIP

gistfile1.txt

filter: "evt.Parsed.program == 'mongo'"
onsuccess: next_stage
name: crowdsecurity/myservice-logs
description: "Mongodb4.4"
debug: true
nodes:
  - grok:
      pattern: '%{IPORHOST:remote_addr}:%{NUMBER}'
      expression: JsonExtract(evt.Line.Raw, "attr.remote")
  - grok:
      pattern: '%{TIMESTAMP_ISO8601:timestamp}'
      expression: JsonExtract(evt.Line.Raw, "t.$date")
statics:
  - meta: log_type
    value: mongodb_failed_auth
  - meta: source_ip
    expression: evt.Parsed.remote_addr
  - target: evt.StrTime
    expression: evt.Parsed.timestamp
  - meta: sub_type
    expression: JsonExtract(evt.Line.Raw, "msg")
    

mongo.log

{"t":{"$date":"2022-06-01T14:37:11.545+00:00"},"s":"I",  "c":"ACCESS",   "id":20249,   "ctx":"conn3","msg":"Authentication failed","attr":{"mechanism":"SCRAM-SHA-1","speculative":false,"principalName":"admin","authenticationDatabase":"admin","remote":"127.0.0.1:33632","extraInfo":{},"error":"UserNotFound: Could not find user \"admin\" for db \"admin\""}}