Skip to content

[maltrail.conf, [SERVER]] Add support for SYSLOG_SERVER= and LOGSTASH_SERVER= options #19080

@MikhailKasimov

Description

@MikhailKasimov

Hello!

In maltrail.conf to add support for SYSLOG_SERVER and LOGSTASH_SERVER options in [Server] section to make it possible to send messages to remote syslog/SIEM about successful and failed log-ins:

мая 01 21:40:26 linux-mk500-154 maltrail[15984]: Failed password for admin from 192.168.x.y port 27566
мая 01 21:40:43 linux-mk500-154 maltrail[15989]: Failed password for qweqweqwd from 192.168.c.d port 27568
мая 01 21:40:52 linux-mk500-154 maltrail[15991]: Failed password for qweqwqweqw from 192.168.a.b port 27571
мая 01 21:49:54 linux-mk500-154 maltrail[16153]: Accepted password for admin from 192.168.e.f port 27774

Can be useful to track brute-force attacks on MT server service.

Thank you!

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions