Skip to content

Instantly share code, notes, and snippets.

@xbb

xbb/opnsense-filterlog.grok

Last active April 22, 2024 12:06
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save xbb/00b5bf8fb353a5947c60914f996b2691 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save xbb/00b5bf8fb353a5947c60914f996b2691 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. xbb revised this gist Jan 23, 2022. 1 changed file with 2 additions and 2 deletions.
    4 changes: 2 additions & 2 deletions opnsense-filterlog.grok
    View file
    Original file line number Diff line number Diff line change
    @@ -1,14 +1,14 @@
    #
    # OPNsense filterlog GROK patterns
    # Based on: https://github.com/opnsense/ports/blob/95ff6a3/opnsense/filterlog/files/description.txt
    # Based on: https://github.com/opnsense/ports/blob/b221352/opnsense/filterlog/files/description.txt
    #
    # Entrypoint: %{OPNSENSE_FILTERLOG}
    #
    # TODO: OPNSENSE_CARP
    #
    OPNSENSE_DIRECTION \bin(?:/out)?|out\b
    OPNSENSE_WORD \b[\w-]+\b
    OPNSENSE_FILTERLOG %{OPNSENSE_TCP}|%{OPNSENSE_UDP}
    OPNSENSE_FILTERLOG %{OPNSENSE_TCP}|%{OPNSENSE_UDP}|%{OPNSENSE_IPV4}|%{OPNSENSE_IPV6}
    OPNSENSE_IPV4 %{OPNSENSE_PACKETFILTER},%{INT:ip_ver},%{BASE16NUM:tos},%{OPNSENSE_WORD:ecn}?,%{INT:ttl},%{INT:id},%{INT:offset},%{OPNSENSE_WORD:flags},%{INT:proto_num},%{OPNSENSE_WORD:proto},%{INT:length},%{IPV4:src},%{IPV4:dst}
    OPNSENSE_IPV6 %{OPNSENSE_PACKETFILTER},%{INT:ip_ver},%{BASE16NUM:class},%{BASE16NUM:flow},%{INT:hop_limit},%{OPNSENSE_WORD:proto},%{INT:proto_num},%{INT:length},%{IPV6:src},%{IPV6:dst}
    OPNSENSE_LABEL (?:\b%{OPNSENSE_WORD:label}\b|\(null\))
  2. xbb created this gist Aug 3, 2021.
    17 changes: 17 additions & 0 deletions opnsense-filterlog.grok
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,17 @@
    #
    # OPNsense filterlog GROK patterns
    # Based on: https://github.com/opnsense/ports/blob/95ff6a3/opnsense/filterlog/files/description.txt
    #
    # Entrypoint: %{OPNSENSE_FILTERLOG}
    #
    # TODO: OPNSENSE_CARP
    #
    OPNSENSE_DIRECTION \bin(?:/out)?|out\b
    OPNSENSE_WORD \b[\w-]+\b
    OPNSENSE_FILTERLOG %{OPNSENSE_TCP}|%{OPNSENSE_UDP}
    OPNSENSE_IPV4 %{OPNSENSE_PACKETFILTER},%{INT:ip_ver},%{BASE16NUM:tos},%{OPNSENSE_WORD:ecn}?,%{INT:ttl},%{INT:id},%{INT:offset},%{OPNSENSE_WORD:flags},%{INT:proto_num},%{OPNSENSE_WORD:proto},%{INT:length},%{IPV4:src},%{IPV4:dst}
    OPNSENSE_IPV6 %{OPNSENSE_PACKETFILTER},%{INT:ip_ver},%{BASE16NUM:class},%{BASE16NUM:flow},%{INT:hop_limit},%{OPNSENSE_WORD:proto},%{INT:proto_num},%{INT:length},%{IPV6:src},%{IPV6:dst}
    OPNSENSE_LABEL (?:\b%{OPNSENSE_WORD:label}\b|\(null\))
    OPNSENSE_PACKETFILTER %{INT:rule},%{INT:subrule}?,%{INT:anchor}?,%{OPNSENSE_LABEL:label},%{OPNSENSE_WORD:interface},%{OPNSENSE_WORD:reason},%{OPNSENSE_WORD:action},%{OPNSENSE_DIRECTION:dir}
    OPNSENSE_TCP (?:%{OPNSENSE_IPV4}|%{OPNSENSE_IPV6}),%{INT:src_port},%{INT:dst_port},%{INT:data_len},%{OPNSENSE_WORD:tcp_flags},(?:%{INT:tcp_seq}(?:\:\d+)?)?,%{INT:tcp_ack}?,%{INT:tcp_win},%{INT:tcp_urg}?,(?<tcp_options>[^,]+)?
    OPNSENSE_UDP (?:%{OPNSENSE_IPV4}|%{OPNSENSE_IPV6}),%{INT:src_port},%{INT:dst_port},%{INT:data_len}