800+ IT
News
als RSS Feed abonnieren📚 Using Logstash to Parse IPtables Firewall Logs, (Sat, Feb 13th)
💡 Newskategorie: IT Security
🔗 Quelle: isc.sans.edu
One of our reader submitted some DSL Modem Firewall logs (iptables format) and I wrote a simple logstash parser to analyze and illustrate the activity, in this case it is all scanning activity against this modem. An iptables parser exist for Filebeat[2], but for this example, I wanted to show how to create a simple logstash parser using Grok[3] to parse these logs and send them to Elastic.
...