authelia: set target_user meta and align bf user-enum distinct key#1796
Conversation
Agent-Logs-Url: https://github.com/crowdsecurity/hub/sessions/3ccb9240-1172-44d6-897a-ab79d73f74a2 Co-authored-by: buixor <990714+buixor@users.noreply.github.com>
target_user meta and align bf user-enum distinct key
|
Hello @Copilot and thank you for your contribution! I'm a bot that helps maintainers to validate scenarios and ensure they include all the required information. The following items have errors: crowdsecurity/crs-exclusion-plugin-cpanel:
crowdsecurity/crs-exclusion-plugin-dokuwiki:
crowdsecurity/crs-exclusion-plugin-drupal:
crowdsecurity/crs-exclusion-plugin-nextcloud:
crowdsecurity/crs-exclusion-plugin-phpbb:
crowdsecurity/crs-exclusion-plugin-phpmyadmin:
crowdsecurity/crs-exclusion-plugin-wordpress:
crowdsecurity/crs-exclusion-plugin-xenforo:
Mitre ATT&CKInformation about mitre attack can be found here.
Expected format is (where labels:
classification:
- attack.TXXXXCVEsIf your scenario covers a specific CVE (Common Vulnerabilities and Exposures), please add it. Expected format is (where labels:
classification:
- cve.CVE-XXX-XXXBehaviorsPlease identify the behavior(s) your scenario is targeting. You can find the list of available behaviors here. Expected format is (where labels:
behavior: <behavior>See the labels documentation for more information. |
|
fix #1715 |
|
Hello @buixor and thank you for your contribution! ❗ It seems that the following scenarios are not part of the 'crowdsecurity/appsec-virtual-patching' collection: 🔴 crowdsecurity/vpatch-CVE-2024-1061 🔴 |
|
Hello @buixor, Scenarios/AppSec Rule are compliant with the taxonomy, thank you for your contribution! |
There was a problem hiding this comment.
Pull request overview
This PR aligns Authelia brute-force/user-enumeration detection with CrowdSec’s brute-force context expectations by emitting evt.Meta.target_user from the Authelia parser and deduplicating the user-enum scenario on that field.
Changes:
- Add
target_usermetadata toLePresidente/authelia-logs(sourced from the parsed username). - Update
LePresidente/authelia-bf_user-enumto usedistinct: evt.Meta.target_user. - Extend existing hubtest assertions to validate
target_useron parsed events and scenario alert events.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
scenarios/LePresidente/authelia-bf.yaml |
Switches user-enum scenario deduplication key from user to target_user. |
parsers/s01-parse/LePresidente/authelia-logs.yaml |
Adds evt.Meta.target_user alongside evt.Meta.user. |
.tests/authelia-logs/parser.assert |
Updates parser assertions to include target_user. |
.tests/authelia-bf/scenario.assert |
Updates scenario assertions to include target_user in alert events. |
| results["s01-parse"]["LePresidente/authelia-logs"][0].Evt.Meta["log_type"] == "auth_failed" | ||
| results["s01-parse"]["LePresidente/authelia-logs"][0].Evt.Meta["service"] == "authelia" | ||
| results["s01-parse"]["LePresidente/authelia-logs"][0].Evt.Meta["source_ip"] == "1.1.1.1" | ||
| results["s01-parse"]["LePresidente/authelia-logs"][0].Evt.Meta["user"] == "fakeuser" | ||
| results["s01-parse"]["LePresidente/authelia-logs"][0].Evt.Meta["target_user"] == "fakeuser" |
There was a problem hiding this comment.
Fixed in 1d2b846 by replacing the public IPs in .tests/authelia-logs/authelia-logs.log with an RFC 5737 example IP and updating .tests/authelia-logs/parser.assert accordingly. The targeted authelia-logs hubtest passes in the CrowdSec container.
| results[0].Overflow.Alert.Events[0].GetMeta("service") == "authelia" | ||
| results[0].Overflow.Alert.Events[0].GetMeta("source_ip") == "5.5.5.6" | ||
| results[0].Overflow.Alert.Events[0].GetMeta("timestamp") == "2022-02-16T12:31:49+02:00" | ||
| results[0].Overflow.Alert.Events[0].GetMeta("user") == "fakeuser1@example.com" | ||
| results[0].Overflow.Alert.Events[0].GetMeta("target_user") == "fakeuser1@example.com" |
Agent-Logs-Url: https://github.com/crowdsecurity/hub/sessions/0d92fbd5-bd50-4aa2-b171-7b1ef051787f Co-authored-by: buixor <990714+buixor@users.noreply.github.com>
Uh oh!
There was an error while loading. Please reload this page.