Hi I'm trying to filter out the login & logout events from linux ssh events send as syslog to Logstash and forward it to my firewall via syslog again. This setup is to allow my firewall to map the user-id to IP address in the traffic logs.
This are the raw logs and i'm only interested in the particular logs:
2023-03-16T17:26:27+08:00 poc-rsyslog-client sshd[8487]: Accepted password for test_user from 10.8.4.23 port 35900 ssh2
2023-03-16T17:26:27+08:00 poc-rsyslog-client sshd[8487]: pam_unix(sshd:session): session opened for user test_user by (uid=0)
2023-03-16T17:27:27+08:00 poc-rsyslog-client sshd[8487]: Received disconnect from 10.8.4.23 port 35900:11: disconnected by user
2023-03-16T17:27:27+08:00 poc-rsyslog-client sshd[8487]: Disconnected from 10.8.4.23 port 35900
2023-03-16T17:27:27+08:00 poc-rsyslog-client sshd[8487]: pam_unix(sshd:session): session closed for user test_user
For login event I need to refer to first log which contain the user-id (test_user) and ip address (10.8.4.23)
As for logout event, I need co-relate Forth & Fifth log which contain the user-id and ip address.
Below is my configuration:
input {
syslog {
host => "10.8.4.20"
port => 55514
}
}
filter {
if "Accepted" in [message]{
grok {
match => {
"message" => "%{DATA:event} %{DATA:srcmethod} for %{DATA:srcuser} from %{IPORHOST:srcip} port %{NUMBER:srcport} %{GREEDYDATA:signature}"
}
}
}
else{
if "Disconnected" in [message] or "close" in [message]{
aggregate {
task_id => "%{syslog_pid}"
code => '
map["message"] ||= []
map["message"] << event.get("message")
event.cancel
'
push_map_as_event_on_timeout => true
timeout => 10
}
}
else{ drop {} }
}
}
output {
syslog {
host => "10.9.9.2"
port => "514"
protocol => "udp"
}
syslog {
host => "10.9.9.3"
port => "514"
protocol => "udp"
}
stdout {}
}
and the result I got from stdout is as following:
{
"event" => {
"original" => "<86>Mar 22 20:44:35 localhost sshd[17161]: Accepted password for test_user from 10.8.4.23 port 47506 ssh2"
},
"srcuser" => "test_user",
"@timestamp" => 2023-03-22T12:44:35.000Z,
"host" => {
"ip" => "10.8.246.200",
"hostname" => "localhost"
},
"message" => "Accepted password for root from 10.8.4.23 port 47506 ssh2",
"process" => {
"pid" => 17161,
"name" => "sshd"
},
"service" => {
"type" => "system"
},
"srcport" => "47506",
"srcip" => "10.8.4.23",
"srcmethod" => "password",
"@version" => "1",
"log" => {
"syslog" => {
"priority" => 86,
"severity" => {
"name" => "Informational",
"code" => 6
},
"facility" => {
"name" => "security/authorization",
"code" => 10
}
}
},
"signature" => "ssh2"
}
{
"@version" => "1",
"event" => {
"original" => "<86>Mar 22 20:44:39 localhost sshd[17161]: Disconnected from 10.8.4.23 port 47506"
},
"log" => {
"syslog" => {
"priority" => 86,
"severity" => {
"name" => "Informational",
"code" => 6
},
"facility" => {
"name" => "security/authorization",
"code" => 10
}
}
},
"@timestamp" => 2023-03-22T12:44:39.000Z,
"host" => {
"ip" => "10.8.246.200",
"hostname" => "localhost"
},
"message" => "Disconnected from 10.8.4.23 port 47506",
"process" => {
"pid" => 17161,
"name" => "sshd"
},
"service" => {
"type" => "system"
}
}
{
"@version" => "1",
"event" => {
"original" => "<86>Mar 22 20:44:39 localhost sshd[17161]: pam_unix(sshd:session): session closed for user test_user"
},
"log" => {
"syslog" => {
"priority" => 86,
"severity" => {
"name" => "Informational",
"code" => 6
},
"facility" => {
"name" => "security/authorization",
"code" => 10
}
}
},
"@timestamp" => 2023-03-22T12:44:39.000Z,
"host" => {
"ip" => "10.8.246.200",
"hostname" => "localhost"
},
"message" => "pam_unix(sshd:session): session closed for user test_user",
"process" => {
"pid" => 17161,
"name" => "sshd"
},
"service" => {
"type" => "system"
}
}
How do i achieve my second goal which is co-relate the last 2 output into single output?
