# SPDX-License-Identifier: AGPL-3.0-only
# A request for a credentials or secrets file that does NOT start with
# a slash-dot — those are http-secret-probe's, from the pack. This is
# the rest of the list: SQL dumps, private keys, cloud and deploy
# credentials, config backups. WHATEVER the status: a 200 on /db.sql.gz
# is not a page view, it is an exfiltration that worked.
#
# Sources: this host's own CrowdSec secret-file-probe scenario plus the
# hub's sensitive_data list, pruned to what cannot name a legitimate
# file on this machine's sites.
#
# No single literal is shared by these names, so the gate is the
# multi-literal prefilter: the pattern runs only on lines carrying one
# of these fragments.
parser: http-secret-file
log: http
prefilter_any:
  - ".sql"
  - "id_rsa"
  - "id_dsa"
  - "id_ecdsa"
  - "id_ed25519"
  - "rclone.conf"
  - "docker-compose"
  - "terraform.tfstate"
  - "serverless.y"
  - "sftp-config.json"
  - "credentials.json"
  - "secrets.y"
  - "secrets.json"
  - "wp-config.php."
  - ".pem"
  - ".key"
  - "env.bak"
  - "env.backup"
  - "/@fs/"
regex: '^(?P<ip>\S+) \S+ \S+ \[(?P<time>[^\]]+)\] "(?P<method>[A-Z]+) (?P<path>[^ "?]*(?i:\.sql(?:\.(?:gz|tar|bz2|bzip2|zip|rar|7z))?|id_(?:rsa|dsa|ecdsa|ed25519)|rclone\.conf|docker-compose\.ya?ml|terraform\.tfstate|serverless\.ya?ml|sftp-config\.json|application_default_credentials\.json|gcp-credentials\.json|credentials\.json|secrets\.(?:ya?ml|json)|wp-config\.php\.(?:bak|old|save|txt)|(?:server|host|localhost|private|privatekey|privkey|key)\.(?:key|pem)|env\.(?:bak|backup)|/@fs/)[^ "?]*)(?:\?[^ "]*)? [^"]*" \d{3} '
time_field: time
time_format: nginx
