Add Mealie collection to hub

.tests/mealie-bf/config.yaml

@@ -0,0 +1,13 @@
+parsers:
+- crowdsecurity/syslog-logs
+- crowdsecurity/dateparse-enrich
+- ./parsers/s01-parse/Jgigantino31/mealie-logs.yaml
+scenarios:
+- ./scenarios/Jgigantino31/mealie-bf.yaml
+postoverflows:
+- ""
+log_file: mealie-bf.log
+log_type: mealie
+labels: {}
+ignore_parsers: true
+override_statics: []

.tests/mealie-bf/mealie-bf.log

@@ -0,0 +1,24 @@
+[ERROR|auth|L83] 2025-07-16T19:43:16: Incorrect username or password from 127.0.0.1
+[ERROR|auth|L83] 2025-07-16T19:43:16: Incorrect username or password from 127.0.0.1
+[ERROR|auth|L83] 2025-07-16T19:43:16: Incorrect username or password from 127.0.0.1
+[ERROR|auth|L83] 2025-07-16T19:43:16: Incorrect username or password from 127.0.0.1
+[ERROR|auth|L83] 2025-07-16T19:43:16: Incorrect username or password from 127.0.0.1
+[ERROR|auth|L83] 2025-07-16T19:43:16: Incorrect username or password from 127.0.0.1
+[ERROR|auth|L83] 2025-07-16T19:43:16: Incorrect username or password from 127.0.0.1
+[ERROR|auth|L83] 2025-07-16T19:43:16: Incorrect username or password from 127.0.0.1
+[ERROR|auth|L83] 2025-07-16T19:43:16: Incorrect username or password from 127.0.0.1
+[ERROR|auth|L83] 2025-07-16T19:43:16: Incorrect username or password from 127.0.0.1
+[ERROR|auth|L83] 2025-07-16T19:43:16: Incorrect username or password from 127.0.0.1
+[ERROR|auth|L83] 2025-07-16T19:43:16: Incorrect username or password from 127.0.0.1
+ERROR    2025-07-16T20:12:38 - Incorrect username or password from 127.0.0.1
+ERROR    2025-07-16T20:12:38 - Incorrect username or password from 127.0.0.1
+ERROR    2025-07-16T20:12:38 - Incorrect username or password from 127.0.0.1
+ERROR    2025-07-16T20:12:38 - Incorrect username or password from 127.0.0.1
+ERROR    2025-07-16T20:12:38 - Incorrect username or password from 127.0.0.1
+ERROR    2025-07-16T20:12:38 - Incorrect username or password from 127.0.0.1
+ERROR    2025-07-16T20:12:38 - Incorrect username or password from 127.0.0.1
+ERROR    2025-07-16T20:12:38 - Incorrect username or password from 127.0.0.1
+ERROR    2025-07-16T20:12:38 - Incorrect username or password from 127.0.0.1
+ERROR    2025-07-16T20:12:38 - Incorrect username or password from 127.0.0.1
+ERROR    2025-07-16T20:12:38 - Incorrect username or password from 127.0.0.1
+ERROR    2025-07-16T20:12:38 - Incorrect username or password from 127.0.0.1

.tests/mealie-bf/parser.assert

@@ -0,0 +1 @@
+

.tests/mealie-bf/scenario.assert

@@ -0,0 +1,75 @@
+len(results) == 1
+"127.0.0.1" in results[0].Overflow.GetSources()
+results[0].Overflow.Sources["127.0.0.1"].IP == "127.0.0.1"
+results[0].Overflow.Sources["127.0.0.1"].Range == ""
+results[0].Overflow.Sources["127.0.0.1"].GetScope() == "Ip"
+results[0].Overflow.Sources["127.0.0.1"].GetValue() == "127.0.0.1"
+basename(results[0].Overflow.Alert.Events[0].GetMeta("datasource_path")) == "mealie-bf.log"
+results[0].Overflow.Alert.Events[0].GetMeta("datasource_type") == "file"
+results[0].Overflow.Alert.Events[0].GetMeta("log_type") == "mealie_failed_auth"
+results[0].Overflow.Alert.Events[0].GetMeta("service") == "mealie"
+results[0].Overflow.Alert.Events[0].GetMeta("source_ip") == "127.0.0.1"
+results[0].Overflow.Alert.Events[0].GetMeta("timestamp") == "2025-07-16T20:12:38Z"
+basename(results[0].Overflow.Alert.Events[1].GetMeta("datasource_path")) == "mealie-bf.log"
+results[0].Overflow.Alert.Events[1].GetMeta("datasource_type") == "file"
+results[0].Overflow.Alert.Events[1].GetMeta("log_type") == "mealie_failed_auth"
+results[0].Overflow.Alert.Events[1].GetMeta("service") == "mealie"
+results[0].Overflow.Alert.Events[1].GetMeta("source_ip") == "127.0.0.1"
+results[0].Overflow.Alert.Events[1].GetMeta("timestamp") == "2025-07-16T20:12:38Z"
+basename(results[0].Overflow.Alert.Events[2].GetMeta("datasource_path")) == "mealie-bf.log"
+results[0].Overflow.Alert.Events[2].GetMeta("datasource_type") == "file"
+results[0].Overflow.Alert.Events[2].GetMeta("log_type") == "mealie_failed_auth"
+results[0].Overflow.Alert.Events[2].GetMeta("service") == "mealie"
+results[0].Overflow.Alert.Events[2].GetMeta("source_ip") == "127.0.0.1"
+results[0].Overflow.Alert.Events[2].GetMeta("timestamp") == "2025-07-16T20:12:38Z"
+basename(results[0].Overflow.Alert.Events[3].GetMeta("datasource_path")) == "mealie-bf.log"
+results[0].Overflow.Alert.Events[3].GetMeta("datasource_type") == "file"
+results[0].Overflow.Alert.Events[3].GetMeta("log_type") == "mealie_failed_auth"
+results[0].Overflow.Alert.Events[3].GetMeta("service") == "mealie"
+results[0].Overflow.Alert.Events[3].GetMeta("source_ip") == "127.0.0.1"
+results[0].Overflow.Alert.Events[3].GetMeta("timestamp") == "2025-07-16T20:12:38Z"
+basename(results[0].Overflow.Alert.Events[4].GetMeta("datasource_path")) == "mealie-bf.log"
+results[0].Overflow.Alert.Events[4].GetMeta("datasource_type") == "file"
+results[0].Overflow.Alert.Events[4].GetMeta("log_type") == "mealie_failed_auth"
+results[0].Overflow.Alert.Events[4].GetMeta("service") == "mealie"
+results[0].Overflow.Alert.Events[4].GetMeta("source_ip") == "127.0.0.1"
+results[0].Overflow.Alert.Events[4].GetMeta("timestamp") == "2025-07-16T20:12:38Z"
+basename(results[0].Overflow.Alert.Events[5].GetMeta("datasource_path")) == "mealie-bf.log"
+results[0].Overflow.Alert.Events[5].GetMeta("datasource_type") == "file"
+results[0].Overflow.Alert.Events[5].GetMeta("log_type") == "mealie_failed_auth"
+results[0].Overflow.Alert.Events[5].GetMeta("service") == "mealie"
+results[0].Overflow.Alert.Events[5].GetMeta("source_ip") == "127.0.0.1"
+results[0].Overflow.Alert.Events[5].GetMeta("timestamp") == "2025-07-16T20:12:38Z"
+basename(results[0].Overflow.Alert.Events[6].GetMeta("datasource_path")) == "mealie-bf.log"
+results[0].Overflow.Alert.Events[6].GetMeta("datasource_type") == "file"
+results[0].Overflow.Alert.Events[6].GetMeta("log_type") == "mealie_failed_auth"
+results[0].Overflow.Alert.Events[6].GetMeta("service") == "mealie"
+results[0].Overflow.Alert.Events[6].GetMeta("source_ip") == "127.0.0.1"
+results[0].Overflow.Alert.Events[6].GetMeta("timestamp") == "2025-07-16T20:12:38Z"
+basename(results[0].Overflow.Alert.Events[7].GetMeta("datasource_path")) == "mealie-bf.log"
+results[0].Overflow.Alert.Events[7].GetMeta("datasource_type") == "file"
+results[0].Overflow.Alert.Events[7].GetMeta("log_type") == "mealie_failed_auth"
+results[0].Overflow.Alert.Events[7].GetMeta("service") == "mealie"
+results[0].Overflow.Alert.Events[7].GetMeta("source_ip") == "127.0.0.1"
+results[0].Overflow.Alert.Events[7].GetMeta("timestamp") == "2025-07-16T20:12:38Z"
+basename(results[0].Overflow.Alert.Events[8].GetMeta("datasource_path")) == "mealie-bf.log"
+results[0].Overflow.Alert.Events[8].GetMeta("datasource_type") == "file"
+results[0].Overflow.Alert.Events[8].GetMeta("log_type") == "mealie_failed_auth"
+results[0].Overflow.Alert.Events[8].GetMeta("service") == "mealie"
+results[0].Overflow.Alert.Events[8].GetMeta("source_ip") == "127.0.0.1"
+results[0].Overflow.Alert.Events[8].GetMeta("timestamp") == "2025-07-16T20:12:38Z"
+basename(results[0].Overflow.Alert.Events[9].GetMeta("datasource_path")) == "mealie-bf.log"
+results[0].Overflow.Alert.Events[9].GetMeta("datasource_type") == "file"
+results[0].Overflow.Alert.Events[9].GetMeta("log_type") == "mealie_failed_auth"
+results[0].Overflow.Alert.Events[9].GetMeta("service") == "mealie"
+results[0].Overflow.Alert.Events[9].GetMeta("source_ip") == "127.0.0.1"
+results[0].Overflow.Alert.Events[9].GetMeta("timestamp") == "2025-07-16T20:12:38Z"
+basename(results[0].Overflow.Alert.Events[10].GetMeta("datasource_path")) == "mealie-bf.log"
+results[0].Overflow.Alert.Events[10].GetMeta("datasource_type") == "file"
+results[0].Overflow.Alert.Events[10].GetMeta("log_type") == "mealie_failed_auth"
+results[0].Overflow.Alert.Events[10].GetMeta("service") == "mealie"
+results[0].Overflow.Alert.Events[10].GetMeta("source_ip") == "127.0.0.1"
+results[0].Overflow.Alert.Events[10].GetMeta("timestamp") == "2025-07-16T20:12:38Z"
+results[0].Overflow.Alert.GetScenario() == "Jgigantino31/mealie-bf"
+results[0].Overflow.Alert.Remediation == true
+results[0].Overflow.Alert.GetEventsCount() == 11

.tests/mealie-logs/config.yaml

@@ -0,0 +1,13 @@
+parsers:
+- crowdsecurity/syslog-logs
+- crowdsecurity/dateparse-enrich
+- ./parsers/s01-parse/Jgigantino31/mealie-logs.yaml
+scenarios:
+- ""
+postoverflows:
+- ""
+log_file: mealie-logs.log
+log_type: mealie
+labels: {}
+ignore_parsers: false
+override_statics: []

.tests/mealie-logs/mealie-logs.log

@@ -0,0 +1,10 @@
+ERROR    2025-07-16T19:42:45 - Incorrect username or password from 127.0.0.1
+ERROR    2025-07-16T19:42:45 - Incorrect username or password from 127.0.0.1
+INFO     2025-07-16T19:42:45 - [127.0.0.1:32894] 401 Unauthorized "POST /api/auth/token HTTP/1.1"
+INFO     2025-07-16T19:42:45 - [127.0.0.1:53864] 200 OK "GET /api/app/about HTTP/1.1"
+INFO     2025-07-16T19:43:15 - [127.0.0.1:42322] 200 OK "GET /api/app/about HTTP/1.1"
+WARNING  2025-07-16T19:43:16 - Found user but their auth method is not 'Mealie'. Unable to continue with credentials login
+ERROR    2025-07-16T19:43:16 - Incorrect username or password from 127.0.0.1
+WARNING  2025-07-16T19:43:16 - Found user but their auth method is not 'Mealie'. Unable to continue with credentials login
+ERROR    2025-07-16T19:43:16 - Incorrect username or password from 127.0.0.1
+INFO     2025-07-16T19:43:16 - [127.0.0.1:32894] 401 Unauthorized "POST /api/auth/token HTTP/1.1"