mirror of
https://github.com/napnap75/multiarch-docker-images.git
synced 2026-09-25 20:31:52 +02:00
thomas
a5337c3d29
- Introduced alerters package with base Alerter class and implementations for LogAlerter and GotifyAlerter. - Created fetchers package with abstract LogFetcher class and implementations for FileLogFetcher, LokiLogFetcher, and ParseableLogFetcher. - Added filters package with base Filter class and implementations for RegexpFilter and GeolocationFilter. - Implemented rules package with base AlertRule class and SimpleAlertRule for alerting logic. - Enhanced configuration handling with utilities for loading and validating JSON configuration. - Updated logging setup for better logging management. - Modified main application logic to utilize the new modular structure, improving maintainability and readability. - Updated config.json and config.schema.json to reflect changes in alerting and fetching configurations. - Added python-dateutil to requirements for date parsing functionality.
81 lines
2.5 KiB
JSON
81 lines
2.5 KiB
JSON
{
|
|
"log-fetchers": {
|
|
"parseable": {
|
|
"type": "parseable",
|
|
"config": {
|
|
"url-from-env": "{PARSEABLE_URL}",
|
|
"dataset-from-env": "{PARSEABLE_DATASET}",
|
|
"user-from-env": "{PARSEABLE_USER}",
|
|
"password-from-env": "{PARSEABLE_PASSWORD}"
|
|
}
|
|
}
|
|
},
|
|
"alerters": {
|
|
"gotify": {
|
|
"type": "gotify",
|
|
"config": {
|
|
"url-from-env": "{GOTIFY_URL}",
|
|
"token-from-env": "{GOTIFY_TOKEN}"
|
|
}
|
|
}
|
|
},
|
|
"alerting-rules": {
|
|
"ssh-outside": {
|
|
"check-interval": 30,
|
|
"log-fetcher": {
|
|
"name": "parseable",
|
|
"filters": {
|
|
"labels": {
|
|
"container_name": "/openssh-server"
|
|
},
|
|
"text": "Accepted"
|
|
}
|
|
},
|
|
"filters": [
|
|
{
|
|
"type": "regexp",
|
|
"config": {
|
|
"match": "Accepted (?P<method>\\w+) for (?P<username>\\w+) from (?P<ip>[^\\s]+)"
|
|
}
|
|
},
|
|
{
|
|
"type": "geolocation",
|
|
"config": {
|
|
"source-field": "ip"
|
|
}
|
|
}
|
|
],
|
|
"alerter": {
|
|
"name": "gotify",
|
|
"title": "Outside SSH login",
|
|
"message": "New SSH login for {username} on {hostname} from ip {ip} (country: {country}, provider: {isp}, method: {method})"
|
|
}
|
|
},
|
|
"ssh-local": {
|
|
"check-interval": 30,
|
|
"log-fetcher": {
|
|
"name": "parseable",
|
|
"filters": {
|
|
"labels": {
|
|
"filename": "/var/log/host/auth.log",
|
|
"process": "sshd"
|
|
},
|
|
"text": "Accepted"
|
|
}
|
|
},
|
|
"filters": [
|
|
{
|
|
"type": "regexp",
|
|
"config": {
|
|
"match": "Accepted (?P<method>\\w+) for (?P<username>\\w+) from (?P<ip>[^\\s]+)"
|
|
}
|
|
}
|
|
],
|
|
"alerter": {
|
|
"name": "gotify",
|
|
"title": "Local SSH login",
|
|
"message": "New SSH login for {username} on {hostname} from ip {ip} (method: {method})"
|
|
}
|
|
}
|
|
}
|
|
} |