Skip to content

Commit 5dcefa1

Browse files
hleinhlein
committed
conf: parser: add Mikrotik firewall parser
Signed-off-by: Hank Leininger <hlein@korelogic.com>
1 parent 1d9ddbf commit 5dcefa1

File tree

1 file changed

+254
-0
lines changed

1 file changed

+254
-0
lines changed

‎conf/parsers_mikrotik.yaml‎

Lines changed: 254 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,254 @@
1+
# parsing rules for Mikrotik firewalls
2+
# https://forum.mikrotik.com/
3+
4+
parsers:
5+
6+
- name: mikrotik-firewall
7+
# Firewall logs from Mikrotiks
8+
# https://regex101.com/r/k8JY20/1
9+
format: regex
10+
regex: |
11+
(?x)
12+
13+
(?<ident>firewall) ,info \s
14+
15+
# labels are optional, and user-defined
16+
(?: catchall \s )?
17+
(?:
18+
(?<fw_action>
19+
(?:
20+
accept (?:keepalive) ?
21+
| allow (?: \s [-A-Za-z]+ )?
22+
| (?: [-A-Za-z]+ \s ) ? drop (?: \s invalid ) ?
23+
| [a-z0-9]+_scanhost
24+
| masq
25+
)
26+
)
27+
\s
28+
)?
29+
30+
(?<fw_direction> (?: forward | input | output | srcnat ) ) :\s
31+
(?: in: (?: \(unknown\s [0-9]\) | (?<in_interface>[^ ]+) ) ) \s
32+
(?: out: (?: \(unknown\s [0-9]\) | (?<out_interface>[^ ,]+) ) ) ,\s
33+
34+
(?: connection-state: (?<conn_state>[^\s]+) \s )?
35+
36+
(?: src-mac\s (?<macsrc>[0-9a-f]{2} (?: :[0-9a-f]{2}){5} ) ,\s )?
37+
38+
proto\s
39+
40+
(?:
41+
(?<proto>TCP)
42+
\s\(
43+
(?: (?<tcp_syn>SYN) ,? )?
44+
(?: (?<tcp_ack>ACK) ,? )?
45+
(?: (?<tcp_rst>RST) ,? )?
46+
(?: (?<tcp_fin>FIN) ,? )?
47+
(?: (?<tcp_psh>PSH) ,? )?
48+
(?: (?<tcp_urg>URG) ,? )?
49+
\)
50+
|
51+
(?<proto>UDP)
52+
|
53+
(?<proto>ICMP)
54+
\s \(
55+
type\s (?<icmp_type>\d+),\s
56+
code\s (?<icmp_code>\d+) \)
57+
|
58+
(?<proto>[^\s,]+)
59+
)
60+
,\s
61+
(?<source>(?:[0-9]{1,3}\.){3}[0-9]{1,3})
62+
(?: : (?<src_port>\d+) )?
63+
->
64+
(?<dest>(?:[0-9]{1,3}\.){3}[0-9]{1,3})
65+
(?: : (?<dst_port>\d+) )?
66+
,\s
67+
68+
# NAT logs:
69+
# - parens-tuple for source or dest
70+
# - apparently *both* could be rewritten
71+
# - NAT IPs are not necessarily 1:1
72+
(?:
73+
NAT\s
74+
(?:
75+
\(
76+
(?<nat_source_orig>(?:[0-9]{1,3}\.){3}[0-9]{1,3})
77+
(?: : \k<src_port> )?
78+
->
79+
(?<nat_source>(?:[0-9]{1,3}\.){3}[0-9]{1,3})
80+
(?: : (?<nat_src_port>\d+) )?
81+
\)
82+
->
83+
\k<dest>
84+
(?: : \k<dst_port> )?
85+
|
86+
(?: \k<source> | (?<nat_source_orig>(?:[0-9]{1,3}\.){3}[0-9]{1,3}) )
87+
(?: : \k<src_port> )?
88+
->
89+
\(
90+
(?<nat_dest_orig>(?:[0-9]{1,3}\.){3}[0-9]{1,3})
91+
(?: : (?<nat_dst_port>\d+) )?
92+
->
93+
(?<nat_dest>(?:[0-9]{1,3}\.){3}[0-9]{1,3})
94+
(?: : \k<dst_port> )?
95+
\)
96+
)
97+
, \s
98+
)?
99+
100+
len\s (?<pkt_len>\d+)
101+
types: 'src_port:integer,dst_port:integer,pkt_len:integer'
102+
103+
- name: mikrotik-proxy
104+
# Proxy logs from Mikrotiks
105+
# https://regex101.com/r/C3Odc7/1
106+
format: regex
107+
regex: |
108+
(?x)
109+
110+
(?<ident>web-proxy) ,account \s
111+
112+
(?<host>[^\s]+) \s
113+
(?<method>[^\s]+) \s
114+
(?<url>\S+) \s+
115+
116+
action=(?<proxy_action>\S+)
117+
118+
# Only permitted requests will show a cache status
119+
(?:
120+
\s cache=(?<cache_status>\S+)
121+
(?: \s \([^)]*\) )?
122+
)?
123+
$
124+
125+
- name: mikrotik-dhcp
126+
# DHCP logs from Mikrotiks
127+
# https://regex101.com/r/jBqBIg/1
128+
format: regex
129+
regex: |
130+
(?x)
131+
132+
(?<ident>dhcp) ,info \s
133+
134+
(?:
135+
dhcp-client\s on\s
136+
(?<fw_netname>[-_.A-Za-z0-9]+) \s
137+
(?<dhcp_action>(?: got | lost ) )\s
138+
IP\s address\s
139+
(?<src_ip>[0-9.]{7,15})
140+
(?: \s - \s .*) ?
141+
|
142+
(?<fw_netname>[-_.A-Za-z0-9]+) \s
143+
(?<dhcp_action> (?: de )? assigned ) \s
144+
(?<src_ip>[0-9.]{7,15}) \s
145+
(?: for | from | to ) \s
146+
(?<macsrc>[A-F0-9]{2} (?: :[A-F0-9]{2}){5} )
147+
(?: \s (?<hostname>\S+) )?
148+
)
149+
\s?
150+
$
151+
152+
- name: mikrotik-ovpn
153+
# OpenVPN logs from Mikrotiks
154+
# https://regex101.com/r/hoEBSE/1
155+
format: regex
156+
regex: |
157+
(?x)
158+
159+
ovpn,info\s
160+
161+
(?:
162+
connection\s established\s from\s
163+
(?<src_ip>[0-9.]{7,15})
164+
,\s port: \s
165+
(?<src_port>\d+)
166+
\s to \s
167+
(?<dst_ip>[0-9.]{7,15})
168+
|
169+
< (?<src_ip>[0-9.]{7,15}) >:\s
170+
disconnected
171+
(?: \s <[^>]+>)?
172+
|
173+
(?<vpn_name>[^ :]+) :\s
174+
(?:
175+
initializing\.\.\.
176+
|
177+
connect (?: ed | ing\.\.\. )
178+
|
179+
disconnected
180+
(?: \s <[^>]+>)?
181+
|
182+
terminating\.\.\. .*
183+
|
184+
using\s encoding\s -\s
185+
(?<cipher>[-_/A-Z0-9]+)
186+
)
187+
)
188+
189+
- name: mikrotik-logins
190+
# Login/logout events from Mikrotiks
191+
# https://regex101.com/r/LpmF15/1
192+
format: regex
193+
regex: |
194+
(?x)
195+
196+
system,info,account\s
197+
198+
user\s
199+
(?<user>[^\s]+)
200+
\s logged\s (?: in | out ) \s
201+
202+
(?:
203+
from \s
204+
(?:
205+
(?<source>[0-9.]{7,15})
206+
|
207+
(?<srcmac>[0-9A-F]{2} (?: :[0-9A-F]{2}){5} )
208+
)
209+
\s
210+
)?
211+
212+
# remote protocol or local
213+
via \s
214+
(?<access_method>.*)
215+
216+
- name: mikrotik-other
217+
# Other logs from Mikrotiks
218+
# https://regex101.com/r/kaPYeX/1
219+
format: regex
220+
regex: |
221+
(?x)
222+
223+
# list of topics obtained from CLI: /system/logging/add topics=<tab>
224+
# include the whole list; as long as this is the last Mikrotik parser,
225+
# more specific ones that matched will have already consumed the message.
226+
(?<ident>
227+
(?:
228+
account |dot1x |l2tp |pptp |store
229+
|acme-client |dude |ldp |ptp |stp
230+
|amt |e-mail |lora |queue |system
231+
|async |error |lte |radius |telephony
232+
|backup |event |manager |radvd |tftp
233+
|bfd |evpn |mme |raw |timer
234+
|bgp |fetch |mpls |read |tr069
235+
|bridge |firewall |mqtt |rip |update
236+
|calc |gps |mvrp |route |upnp
237+
|caps |gsm |natpmp |rpki |ups
238+
|certificate |health |netinstall |rsvp |vpls
239+
|clock |hotspot |netwatch |script |vrrp
240+
|cmr |igmp-proxy |ntp |sertcp |warning
241+
|container |info |ospf |simulator |watchdog
242+
|critical |interface |ovpn |smb |web-proxy
243+
|ddns |ipsec |packet |snmp |wireguard
244+
|debug |iscsi |pim |socksify |wireless
245+
|dhcp |isdn |poe-out |ssh |write
246+
|disk |isis |ppp |sstp |zerotier
247+
|dns |kvm |pppoe |state
248+
)
249+
)
250+
, [^\s]+
251+
\s
252+
253+
# remaining message contents
254+
(?<mikrotik_remainder>.*)

0 commit comments

Comments
 (0)