multiarch-docker-images/log-alert/config.json

{
    "log-fetchers": {
        "parseable": {
            "type": "parseable",
            "config": {
                "url-from-env": "{PARSEABLE_URL}",
                "dataset-from-env": "{PARSEABLE_DATASET}",
                "user-from-env": "{PARSEABLE_USER}",
                "password-from-env": "{PARSEABLE_PASSWORD}"
            }
        }
    },
    "alerters": {
        "gotify": {
            "type": "gotify",
            "config": {
                "url-from-env": "{GOTIFY_URL}",
                "token-from-env": "{GOTIFY_TOKEN}"
            }
        }
    },
    "alerting-rules": {
        "ssh-outside": {
            "check-interval": 30,
            "log-fetcher": {
                "name": "parseable",
                "filters": {
                    "labels": {
                        "container_name": "openssh-server"
                    },
                    "text": "Accepted",
                    "timestamp": "date"
                }
            },
            "filters": [
                {
                    "type": "timestamp",
                    "config": {
                        "source-field": "date"
                    }
                },
                {
                    "type": "regexp",
                    "config": {
                        "match": "Accepted (?P<method>\\w+) for (?P<username>\\w+) from (?P<ip>[^\\s]+)"
                    }
                },
                {
                    "type": "geolocation",
                    "config": {
                        "source-field": "ip"
                    }
                }
            ],
            "alerter": {
                "name": "gotify",
                "title": "SSH login from {country}",
                "message": "New SSH login for {username} on {hostname} from ip {ip} (country: {country}, provider: {isp}, method: {method})"
            }
        },
        "ssh-local-fileserver": {
            "check-interval": 30,
            "log-fetcher": {
                "name": "parseable",
                "filters": {
                    "labels": {
                        "filename": "/var/log/host/auth.log",
                        "process": "sshd",
                        "hostname": "fileserver"
                    },
                    "text": "Accepted"
                }
            },
            "filters": [
                {
                    "type": "timestamp",
                    "config": {
                        "source-field": "timestamp",
                        "timezone": "Europe/Paris",
                        "timestamp-format": "%b %d %H:%M:%S"
                    }
                },
                {
                    "type": "regexp",
                    "config": {
                        "match": "Accepted (?P<method>\\w+) for (?P<username>\\w+) from (?P<ip>[^\\s]+)"
                    }
                }
            ],
            "alerter": {
                "name": "gotify",
                "title": "Local SSH login",
                "message": "New SSH login for {username} on {hostname} from ip {ip} (method: {method})"
            }
        },
        "ssh-local-webserver": {
            "check-interval": 30,
            "log-fetcher": {
                "name": "parseable",
                "filters": {
                    "labels": {
                        "filename": "/var/log/host/auth.log",
                        "process": "sshd",
                        "hostname": "webserver"
                    },
                    "text": "Accepted"
                }
            },
            "filters": [
                {
                    "type": "timestamp",
                    "config": {
                        "source-field": "timestamp"
                    }
                },
                {
                    "type": "regexp",
                    "config": {
                        "match": "Accepted (?P<method>\\w+) for (?P<username>\\w+) from (?P<ip>[^\\s]+)"
                    }
                }
            ],
            "alerter": {
                "name": "gotify",
                "title": "Local SSH login",
                "message": "New SSH login for {username} on {hostname} from ip {ip} (method: {method})"
            }
        }
    }
}