change expression

crowdsecurity · Jan 9, 2025 · f320ed6 · f320ed6
1 parent 2977c66
commit f320ed6
Showing 1 changed file with 7 additions and 1 deletion.
diff --git a/parsers/s01-parse/bouddha/wazuh-logs.yaml b/parsers/s01-parse/bouddha/wazuh-logs.yaml
@@ -8,7 +8,13 @@ statics:
   - meta: source_ip
     expression: evt.Unmarshaled.wazuh.req.remoteAddress
   - meta: log_type
-    value: wazuh_failed_auth
+    expression: |
+        (
+          evt.Unmarshaled.wazuh.type == 'response' &&
+          evt.Unmarshaled.wazuh.method == 'post' &&
+          evt.Unmarshaled.wazuh.statusCode in [401, '401'] &&
+          evt.Unmarshaled.wazuh.req.url == '/auth/login'
+        ) ? 'wazuh_failed_auth' : ''
   - meta: timestamp
     expression: evt.Unmarshaled.wazuh['@timestamp']
   - meta: status_code