5 lines
623 B
JSON
5 lines
623 B
JSON
{
|
|
"title": "freeradius_login_ok",
|
|
"description": "Standalone FreeRADIUS: successful authentication (default auth_log format: 'Auth: (n) Login OK: [user] (from client X port P)')",
|
|
"source": "rule \"freeradius_login_ok\"\nwhen\n contains(to_string($message.message), \"Login OK\")\nthen\n set_field(\"vendor\", \"freeradius\");\n set_field(\"event_type\", \"radius_auth_success\");\n let m = regex(\"Login OK: \\\\[([^\\\\]]+)\\\\] \\\\(from client (\\\\S+)\", to_string($message.message), [\"user\",\"client\"]);\n set_field(\"radius_user\", m[\"user\"]);\n set_field(\"radius_client\", m[\"client\"]);\nend"
|
|
}
|