Dev/new pattern sshd logs for synology

.github/workflows/appsec_vpatch_lint.yaml

@@ -48,7 +48,7 @@ jobs:
         with:
           state: open
       - name: Comment PR if errors
-        if: ${{ (env.taxonomy_errors == '1') && (github.event_name == 'push') && (github.ref != 'refs/heads/master') }}
+        if: ${{ (env.taxonomy_errors == '1') && (github.event_name == 'push') && (github.ref != 'refs/heads/master') && (steps.findPr.outputs.pr != 'false') }}
         uses: thollander/actions-comment-pull-request@v2
         with:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/update_taxonomy.yaml

@@ -54,7 +54,7 @@ jobs:
         with:
           state: open
       - name: Comment PR if errors
-        if: ${{ (env.taxonomy_errors == '1') && (github.event_name == 'push') && (github.ref != 'refs/heads/master') }}
+        if: ${{ (env.taxonomy_errors == '1') && (github.event_name == 'push') && (github.ref != 'refs/heads/master') && (steps.findPr.outputs.pr != 'false') }}
         uses: thollander/actions-comment-pull-request@v2
         with:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.gitignore

@@ -27,6 +27,7 @@ taxonomy/scenario_taxonomy_errors.md
 
 workspace.code-workspace
 .cache
+runtime/
 
 waf-check/dataset/*
 waf-check/output/*

.tests/synology-dsm-logs-bf-slow-1h/config.yaml

@@ -0,0 +1,13 @@
+parsers:
+- crowdsecurity/syslog-logs
+- crowdsecurity/dateparse-enrich
+- ./parsers/s01-parse/crowdsecurity/synology-dsm-logs.yaml
+scenarios:
+- ./scenarios/crowdsecurity/synology-dsm-bf-slow-1h.yaml
+postoverflows:
+- ""
+log_file: synology-dsm-logs-bf-slow.log
+log_type: syslog
+labels: { }
+ignore_parsers: false
+

.tests/synology-dsm-logs-bf-slow-1h/scenario.assert

@@ -0,0 +1,49 @@
+results[0].Overflow.Alert.Events[0].GetMeta("datasource_path") == "synology-dsm-logs-bf-slow.log"
+results[0].Overflow.Alert.Events[0].GetMeta("datasource_type") == "file"
+results[0].Overflow.Alert.Events[0].GetMeta("log_type") == "synology-dsm_failed_auth"
+results[0].Overflow.Alert.Events[0].GetMeta("machine") == "synologynas"
+results[0].Overflow.Alert.Events[0].GetMeta("service") == "synology-dsm"
+results[0].Overflow.Alert.Events[0].GetMeta("source_ip") == "10.4.2.116"
+results[0].Overflow.Alert.Events[0].GetMeta("timestamp") == "2025-11-07T19:21:49+01:00"
+results[0].Overflow.Alert.Events[1].GetMeta("datasource_path") == "synology-dsm-logs-bf-slow.log"
+results[0].Overflow.Alert.Events[1].GetMeta("datasource_type") == "file"
+results[0].Overflow.Alert.Events[1].GetMeta("log_type") == "synology-dsm_failed_auth"
+results[0].Overflow.Alert.Events[1].GetMeta("machine") == "synologynas"
+results[0].Overflow.Alert.Events[1].GetMeta("service") == "synology-dsm"
+results[0].Overflow.Alert.Events[1].GetMeta("source_ip") == "10.4.2.116"
+results[0].Overflow.Alert.Events[1].GetMeta("timestamp") == "2025-11-07T23:54:33+01:00"
+results[0].Overflow.Alert.Events[2].GetMeta("datasource_path") == "synology-dsm-logs-bf-slow.log"
+results[0].Overflow.Alert.Events[2].GetMeta("datasource_type") == "file"
+results[0].Overflow.Alert.Events[2].GetMeta("log_type") == "synology-dsm_failed_auth"
+results[0].Overflow.Alert.Events[2].GetMeta("machine") == "synologynas"
+results[0].Overflow.Alert.Events[2].GetMeta("service") == "synology-dsm"
+results[0].Overflow.Alert.Events[2].GetMeta("source_ip") == "10.4.2.116"
+results[0].Overflow.Alert.Events[2].GetMeta("timestamp") == "2025-11-08T01:40:29+01:00"
+results[0].Overflow.Alert.Events[3].GetMeta("datasource_path") == "synology-dsm-logs-bf-slow.log"
+results[0].Overflow.Alert.Events[3].GetMeta("datasource_type") == "file"
+results[0].Overflow.Alert.Events[3].GetMeta("log_type") == "synology-dsm_failed_auth"
+results[0].Overflow.Alert.Events[3].GetMeta("machine") == "synologynas"
+results[0].Overflow.Alert.Events[3].GetMeta("service") == "synology-dsm"
+results[0].Overflow.Alert.Events[3].GetMeta("source_ip") == "10.4.2.116"
+results[0].Overflow.Alert.Events[3].GetMeta("timestamp") == "2025-11-08T02:48:22+01:00"
+results[0].Overflow.Alert.Events[4].GetMeta("datasource_path") == "synology-dsm-logs-bf-slow.log"
+results[0].Overflow.Alert.Events[4].GetMeta("datasource_type") == "file"
+results[0].Overflow.Alert.Events[4].GetMeta("log_type") == "synology-dsm_failed_auth"
+results[0].Overflow.Alert.Events[4].GetMeta("machine") == "synologynas"
+results[0].Overflow.Alert.Events[4].GetMeta("service") == "synology-dsm"
+results[0].Overflow.Alert.Events[4].GetMeta("source_ip") == "10.4.2.116"
+results[0].Overflow.Alert.Events[4].GetMeta("timestamp") == "2025-11-08T08:50:40+01:00"
+results[0].Overflow.Alert.Events[5].GetMeta("datasource_path") == "synology-dsm-logs-bf-slow.log"
+results[0].Overflow.Alert.Events[5].GetMeta("datasource_type") == "file"
+results[0].Overflow.Alert.Events[5].GetMeta("log_type") == "synology-dsm_failed_auth"
+results[0].Overflow.Alert.Events[5].GetMeta("machine") == "synologynas"
+results[0].Overflow.Alert.Events[5].GetMeta("service") == "synology-dsm"
+results[0].Overflow.Alert.Events[5].GetMeta("source_ip") == "10.4.2.116"
+results[0].Overflow.Alert.Events[5].GetMeta("timestamp") == "2025-11-08T16:03:09+01:00"
+results[0].Overflow.Alert.Events[6].GetMeta("datasource_path") == "synology-dsm-logs-bf-slow.log"
+results[0].Overflow.Alert.Events[6].GetMeta("datasource_type") == "file"
+results[0].Overflow.Alert.Events[6].GetMeta("log_type") == "synology-dsm_failed_auth"
+results[0].Overflow.Alert.Events[6].GetMeta("machine") == "synologynas"
+results[0].Overflow.Alert.Events[6].GetMeta("service") == "synology-dsm"
+results[0].Overflow.Alert.Events[6].GetMeta("source_ip") == "10.4.2.116"
+results[0].Overflow.Alert.Events[6].GetMeta("timestamp") == "2025-11-08T18:51:53+01:00"

.tests/synology-dsm-logs-bf-slow-1h/synology-dsm-logs-bf-slow.log

@@ -0,0 +1,61 @@
+2025-11-07T19:21:49+01:00 synologynas synoscgi_SYNO.API.Auth_3_login[13716]: pam_unix(webui:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=10.4.2.116
+2025-11-07T23:54:33+01:00 synologynas synoscgi_SYNO.API.Auth_3_login[22336]: pam_unix(webui:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=10.4.2.116
+2025-11-08T01:40:29+01:00 synologynas synoscgi_SYNO.API.Auth_3_login[5630]: pam_unix(webui:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=10.4.2.116
+2025-11-08T02:48:22+01:00 synologynas synoscgi_SYNO.API.Auth_3_login[15680]: pam_unix(webui:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=10.4.2.116
+2025-11-08T08:50:40+01:00 synologynas synoscgi_SYNO.API.Auth_3_login[1334]: pam_unix(webui:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=10.4.2.116
+2025-11-08T16:03:09+01:00 synologynas synoscgi_SYNO.API.Auth_3_login[404]: pam_unix(webui:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=10.4.2.116
+2025-11-08T18:51:53+01:00 synologynas synoscgi_SYNO.API.Auth_3_login[25863]: pam_unix(webui:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=10.4.2.116
+2025-11-08T22:42:43+01:00 synologynas synoscgi_SYNO.API.Auth_3_login[31115]: pam_unix(webui:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=10.4.2.116
+2025-11-08T22:48:07+01:00 synologynas synoscgi_SYNO.API.Auth_3_login[31868]: pam_unix(webui:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=10.4.2.116
+2025-11-09T01:38:58+01:00 synologynas synoscgi_SYNO.API.Auth_3_login[24135]: pam_unix(webui:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=10.4.2.116
+2025-11-09T02:24:01+01:00 synologynas synoscgi_SYNO.API.Auth_3_login[30350]: pam_unix(webui:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=10.4.2.116
+2025-11-09T02:41:38+01:00 synologynas synoscgi_SYNO.API.Auth_3_login[389]: pam_unix(webui:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=10.4.2.116
+2025-11-09T05:21:11+01:00 synologynas synoscgi_SYNO.API.Auth_3_login[23617]: pam_unix(webui:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=10.4.2.116
+2025-11-09T06:24:59+01:00 synologynas synoscgi_SYNO.API.Auth_3_login[514]: pam_unix(webui:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=10.4.2.116
+2025-11-09T12:40:07+01:00 synologynas synoscgi_SYNO.API.Auth_3_login[21651]: pam_unix(webui:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=10.4.2.116
+2025-11-09T16:56:07+01:00 synologynas synoscgi_SYNO.API.Auth_3_login[27883]: pam_unix(webui:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=10.4.2.116
+2025-11-09T19:34:15+01:00 synologynas synoscgi_SYNO.API.Auth_3_login[1873]: pam_unix(webui:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=10.4.2.116
+2025-11-09T19:48:31+01:00 synologynas synoscgi_SYNO.API.Auth_3_login[3940]: pam_unix(webui:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=10.4.2.116
+2025-11-10T03:37:54+01:00 synologynas synoscgi_SYNO.API.Auth_3_login[8929]: pam_unix(webui:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=10.4.2.116
+2025-11-10T07:44:35+01:00 synologynas synoscgi_SYNO.API.Auth_3_login[13179]: pam_unix(webui:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=10.4.2.116
+2025-11-10T09:07:55+01:00 synologynas synoscgi_SYNO.API.Auth_3_login[25661]: pam_unix(webui:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=10.4.2.116
+2025-11-10T11:47:37+01:00 synologynas synoscgi_SYNO.API.Auth_3_login[22145]: pam_unix(webui:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=10.4.2.116
+2025-11-10T12:34:39+01:00 synologynas synoscgi_SYNO.API.Auth_3_login[29400]: pam_unix(webui:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=10.4.2.116
+2025-11-11T16:10:20+01:00 synologynas synoscgi_SYNO.API.Auth_3_login[2839]: pam_unix(webui:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=10.4.2.116
+2025-11-11T17:51:42+01:00 synologynas synoscgi_SYNO.API.Auth_3_login[17951]: pam_unix(webui:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=10.4.2.116
+2025-11-11T22:48:55+01:00 synologynas synoscgi_SYNO.API.Auth_3_login[21832]: pam_unix(webui:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=10.4.2.116
+2025-11-12T04:49:51+01:00 synologynas synoscgi_SYNO.API.Auth_3_login[13195]: pam_unix(webui:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=10.4.2.116  user=admin
+2025-11-12T06:30:46+01:00 synologynas synoscgi_SYNO.API.Auth_3_login[28972]: pam_unix(webui:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=10.4.2.116  user=admin
+2025-11-12T18:35:02+01:00 synologynas synoscgi_SYNO.API.Auth_3_login[25697]: pam_unix(webui:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=10.4.2.116  user=admin
+2025-11-12T19:38:00+01:00 synologynas synoscgi_SYNO.API.Auth_3_login[3544]: pam_unix(webui:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=10.4.2.116  user=admin
+2025-11-12T20:16:49+01:00 synologynas synoscgi_SYNO.API.Auth_3_login[9864]: pam_unix(webui:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=10.4.2.116  user=admin
+2025-11-12T21:14:01+01:00 synologynas synoscgi_SYNO.API.Auth_3_login[19126]: pam_unix(webui:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=10.4.2.116  user=admin
+2025-11-12T21:26:20+01:00 synologynas synoscgi_SYNO.API.Auth_3_login[21025]: pam_unix(webui:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=10.4.2.116  user=admin
+2025-11-12T22:45:33+01:00 synologynas synoscgi_SYNO.API.Auth_3_login[1695]: pam_unix(webui:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=10.4.2.116  user=admin
+2025-11-12T23:45:50+01:00 synologynas synoscgi_SYNO.API.Auth_3_login[11329]: pam_unix(webui:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=10.4.2.116  user=admin
+2025-11-13T00:53:32+01:00 synologynas synoscgi_SYNO.API.Auth_3_login[23570]: pam_unix(webui:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=10.4.2.116  user=admin
+2025-11-13T05:46:28+01:00 synologynas synoscgi_SYNO.API.Auth_3_login[3929]: pam_unix(webui:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=10.4.2.116  user=admin
+2025-11-13T11:20:20+01:00 synologynas synoscgi_SYNO.API.Auth_3_login[23442]: pam_unix(webui:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=10.4.2.116  user=admin
+2025-11-13T17:45:14+01:00 synologynas synoscgi_SYNO.API.Auth_3_login[16642]: pam_unix(webui:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=10.4.2.116  user=admin
+2025-11-13T18:18:47+01:00 synologynas synoscgi_SYNO.API.Auth_3_login[21762]: pam_unix(webui:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=10.4.2.116  user=admin
+2025-11-13T18:36:14+01:00 synologynas synoscgi_SYNO.API.Auth_3_login[24534]: pam_unix(webui:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=10.4.2.116  user=admin
+2025-11-13T22:54:33+01:00 synologynas synoscgi_SYNO.API.Auth_3_login[3973]: pam_unix(webui:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=10.4.2.116  user=admin
+2025-11-14T02:54:07+01:00 synologynas synoscgi_SYNO.API.Auth_3_login[10187]: pam_unix(webui:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=10.4.2.116  user=admin
+2025-11-14T06:21:41+01:00 synologynas synoscgi_SYNO.API.Auth_3_login[10438]: pam_unix(webui:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=10.4.2.116  user=admin
+2025-11-14T06:39:06+01:00 synologynas synoscgi_SYNO.API.Auth_3_login[13389]: pam_unix(webui:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=10.4.2.116  user=admin
+2025-11-14T09:06:57+01:00 synologynas synoscgi_SYNO.API.Auth_3_login[4103]: pam_unix(webui:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=10.4.2.116  user=admin
+2025-11-14T18:47:23+01:00 synologynas synoscgi_SYNO.API.Auth_3_login[28303]: pam_unix(webui:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=10.4.2.116  user=admin
+2025-11-14T21:15:45+01:00 synologynas synoscgi_SYNO.API.Auth_3_login[18679]: pam_unix(webui:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=10.4.2.116  user=admin
+2025-11-14T21:24:26+01:00 synologynas synoscgi_SYNO.API.Auth_3_login[21802]: pam_unix(webui:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=10.4.2.116  user=admin
+2025-11-15T01:11:08+01:00 synologynas synoscgi_SYNO.API.Auth_3_login[29935]: pam_unix(webui:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=10.4.2.116  user=admin
+2025-11-15T01:22:27+01:00 synologynas synoscgi_SYNO.API.Auth_3_login[31743]: pam_unix(webui:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=10.4.2.116  user=admin
+2025-11-15T04:12:00+01:00 synologynas synoscgi_SYNO.API.Auth_3_login[27175]: pam_unix(webui:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=10.4.2.116  user=admin
+2025-11-15T05:04:02+01:00 synologynas synoscgi_SYNO.API.Auth_3_login[3213]: pam_unix(webui:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=10.4.2.116  user=admin
+2025-11-15T17:35:23+01:00 synologynas synoscgi_SYNO.API.Auth_3_login[6421]: pam_unix(webui:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=10.4.2.116  user=admin
+2025-11-15T17:39:46+01:00 synologynas synoscgi_SYNO.API.Auth_3_login[7076]: pam_unix(webui:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=10.4.2.116  user=admin
+2025-11-15T18:21:21+01:00 synologynas synoscgi_SYNO.API.Auth_3_login[13741]: pam_unix(webui:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=10.4.2.116  user=admin
+2025-11-15T19:38:10+01:00 synologynas synoscgi_SYNO.API.Auth_3_login[25829]: pam_unix(webui:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=10.4.2.116  user=admin
+2025-11-16T00:33:38+01:00 synologynas synoscgi_SYNO.API.Auth_3_login[6751]: pam_unix(webui:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=10.4.2.116  user=admin
+2025-11-16T08:15:01+01:00 synologynas synoscgi_SYNO.API.Auth_3_login[12200]: pam_unix(webui:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=10.4.2.116  user=admin
+2025-11-16T09:14:03+01:00 synologynas synoscgi_SYNO.API.Auth_3_login[21165]: pam_unix(webui:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=10.4.2.116  user=admin
+2025-11-16T10:06:11+01:00 synologynas synoscgi_SYNO.API.Auth_3_login[29263]: pam_unix(webui:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=10.4.2.116  user=admin