Add nethvoice whitelist configuration

[stephdl]

Introduce a new configuration file for whitelisting events from nethvoice, allowing specific HTTP status codes to be accepted.

• This is just a workaround, probably more whitelist should be added
• as a dangerous things, I whitelisted bad login attempt of a user, feel free to accept ?

NethServer/dev#7259

to verify what crowdsec see

podman exec -ti crowdsec2 cscli metrics

the relevant part is

Whitelist Metrics:
╭─────────────────────────────────────────────┬─────────────────────┬──────┬─────────────╮
│ Whitelist                                   │ Reason              │ Hits │ Whitelisted │
├─────────────────────────────────────────────┼─────────────────────┼──────┼─────────────┤
│ crowdsecurity/nextcloud-whitelist           │ Nextcloud Whitelist │ 728  │ -           │
│ nethserver/nethvoice-whitelist-http-probing │ nethvoice Whitelist │ 728  │ 46          │
╰─────────────────────────────────────────────┴─────────────────────┴──────┴─────────────╯

full output

Acquisition Metrics:
╭──────────────────────────────────────────┬────────────┬──────────────┬────────────────┬────────────────────────┬───────────────────╮
│ Source                                   │ Lines read │ Lines parsed │ Lines unparsed │ Lines poured to bucket │ Lines whitelisted │
├──────────────────────────────────────────┼────────────┼──────────────┼────────────────┼────────────────────────┼───────────────────┤
│ journalctl:journalctl-_TRANSPORT=journal │ 1.39k      │ 728          │ 661            │ 182                    │ 46                │
│ journalctl:journalctl-_TRANSPORT=stdout  │ 3          │ -            │ 3              │ -                      │ -                 │
│ journalctl:journalctl-_TRANSPORT=syslog  │ 95         │ -            │ 95             │ -                      │ -                 │
╰──────────────────────────────────────────┴────────────┴──────────────┴────────────────┴────────────────────────┴───────────────────╯

Local API Alerts:
╭──────────────────────────────────┬───────╮
│ Reason                           │ Count │
├──────────────────────────────────┼───────┤
│ crowdsecurity/ssh-slow-bf        │ 3     │
│ LePresidente/http-generic-401-bf │ 5     │
│ crowdsecurity/CVE-2019-18935     │ 1     │
│ crowdsecurity/netgear_rce        │ 1     │
│ crowdsecurity/ssh-bf             │ 8     │
╰──────────────────────────────────┴───────╯

Local API Decisions:
╭────────────────────────────────────────────┬────────┬────────┬───────╮
│ Reason                                     │ Origin │ Action │ Count │
├────────────────────────────────────────────┼────────┼────────┼───────┤
│ crowdsecurity/dovecot-spam                 │ CAPI   │ ban    │ 464   │
│ crowdsecurity/fortinet-cve-2018-13379      │ CAPI   │ ban    │ 7     │
│ crowdsecurity/http-cve-2021-42013          │ CAPI   │ ban    │ 3     │
│ crowdsecurity/http-path-traversal-probing  │ CAPI   │ ban    │ 142   │
│ crowdsecurity/http-wordpress_wpconfig      │ CAPI   │ ban    │ 59    │
│ crowdsecurity/CVE-2022-37042               │ CAPI   │ ban    │ 2     │
│ crowdsecurity/http-wordpress-scan          │ CAPI   │ ban    │ 1639  │
│ crowdsecurity/pgsql-bf                     │ CAPI   │ ban    │ 9     │
│ crowdsecurity/postfix-helo-rejected        │ CAPI   │ ban    │ 8     │
│ crowdsecurity/proftpd-bf                   │ CAPI   │ ban    │ 5     │
│ crowdsecurity/CVE-2019-18935               │ CAPI   │ ban    │ 15    │
│ crowdsecurity/CVE-2023-49103               │ CAPI   │ ban    │ 75    │
│ crowdsecurity/apache_log4j2_cve-2021-44228 │ CAPI   │ ban    │ 14    │
│ crowdsecurity/http-bad-user-agent          │ CAPI   │ ban    │ 6375  │
│ crowdsecurity/CVE-2023-22515               │ CAPI   │ ban    │ 3     │
│ crowdsecurity/http-cve-2021-41773          │ CAPI   │ ban    │ 222   │
│ crowdsecurity/http-probing                 │ CAPI   │ ban    │ 4856  │
│ crowdsecurity/netgear_rce                  │ CAPI   │ ban    │ 108   │
│ crowdsecurity/nextcloud-bf                 │ CAPI   │ ban    │ 1     │
│ crowdsecurity/postfix-relay-denied         │ CAPI   │ ban    │ 58    │
│ crowdsecurity/ssh-cve-2024-6387            │ CAPI   │ ban    │ 26    │
│ crowdsecurity/http-backdoors-attempts      │ CAPI   │ ban    │ 205   │
│ crowdsecurity/http-admin-interface-probing │ CAPI   │ ban    │ 224   │
│ crowdsecurity/http-crawl-non_statics       │ CAPI   │ ban    │ 377   │
│ crowdsecurity/http-cve-probing             │ CAPI   │ ban    │ 9     │
│ crowdsecurity/http-wordpress_user-enum     │ CAPI   │ ban    │ 802   │
│ crowdsecurity/jira_cve-2021-26086          │ CAPI   │ ban    │ 10    │
│ crowdsecurity/mariadb-bf                   │ CAPI   │ ban    │ 29    │
│ crowdsecurity/postfix-spam                 │ CAPI   │ ban    │ 235   │
│ crowdsecurity/CVE-2024-9474                │ CAPI   │ ban    │ 2     │
│ crowdsecurity/ssh-slow-bf                  │ CAPI   │ ban    │ 4537  │
│ crowdsecurity/ssh-bf                       │ CAPI   │ ban    │ 4550  │
│ crowdsecurity/http-generic-bf              │ CAPI   │ ban    │ 16    │
│ crowdsecurity/http-open-proxy              │ CAPI   │ ban    │ 1660  │
│ crowdsecurity/http-sensitive-files         │ CAPI   │ ban    │ 235   │
│ crowdsecurity/postfix-non-smtp-command     │ CAPI   │ ban    │ 352   │
│ crowdsecurity/thinkphp-cve-2018-20062      │ CAPI   │ ban    │ 86    │
│ crowdsecurity/CVE-2022-35914               │ CAPI   │ ban    │ 6     │
│ crowdsecurity/CVE-2022-26134               │ CAPI   │ ban    │ 9     │
│ crowdsecurity/grafana-cve-2021-43798       │ CAPI   │ ban    │ 1     │
│ crowdsecurity/http-bf-wordpress_bf         │ CAPI   │ ban    │ 1195  │
│ crowdsecurity/CVE-2017-9841                │ CAPI   │ ban    │ 316   │
│ crowdsecurity/nginx-req-limit-exceeded     │ CAPI   │ ban    │ 369   │
╰────────────────────────────────────────────┴────────┴────────┴───────╯

Local API Metrics:
╭──────────────────────┬────────┬──────╮
│ Route                │ Method │ Hits │
├──────────────────────┼────────┼──────┤
│ /v1/decisions/stream │ GET    │ 84   │
│ /v1/heartbeat        │ GET    │ 13   │
│ /v1/usage-metrics    │ POST   │ 1    │
│ /v1/watchers/login   │ POST   │ 1    │
╰──────────────────────┴────────┴──────╯

Local API Bouncers Metrics:
╭───────────┬──────────────────────┬────────┬──────╮
│ Bouncer   │ Route                │ Method │ Hits │
├───────────┼──────────────────────┼────────┼──────┤
│ localhost │ /v1/decisions/stream │ GET    │ 84   │
╰───────────┴──────────────────────┴────────┴──────╯

Local API Machines Metrics:
╭───────────┬───────────────┬────────┬──────╮
│ Machine   │ Route         │ Method │ Hits │
├───────────┼───────────────┼────────┼──────┤
│ localhost │ /v1/heartbeat │ GET    │ 13   │
╰───────────┴───────────────┴────────┴──────╯

Parser Metrics:
╭─────────────────────────────────────────────┬───────┬────────┬──────────╮
│ Parsers                                     │ Hits  │ Parsed │ Unparsed │
├─────────────────────────────────────────────┼───────┼────────┼──────────┤
│ child-crowdsecurity/http-logs               │ 2.18k │ 1.46k  │ 727      │
│ child-crowdsecurity/syslog-logs             │ 1.49k │ 1.49k  │ -        │
│ child-crowdsecurity/traefik-logs            │ 728   │ 728    │ -        │
│ crowdsecurity/dateparse-enrich              │ 728   │ 728    │ -        │
│ crowdsecurity/geoip-enrich                  │ 728   │ 728    │ -        │
│ crowdsecurity/http-logs                     │ 728   │ 728    │ -        │
│ crowdsecurity/nextcloud-whitelist           │ 728   │ 728    │ -        │
│ crowdsecurity/syslog-logs                   │ 1.49k │ 1.49k  │ -        │
│ crowdsecurity/traefik-logs                  │ 728   │ 728    │ -        │
│ nethserver/nethvoice-whitelist-http-probing │ 728   │ 728    │ -        │
╰─────────────────────────────────────────────┴───────┴────────┴──────────╯

Scenario Metrics:
╭──────────────────────────────────────┬───────────────┬───────────┬──────────────┬────────┬─────────╮
│ Scenario                             │ Current Count │ Overflows │ Instantiated │ Poured │ Expired │
├──────────────────────────────────────┼───────────────┼───────────┼──────────────┼────────┼─────────┤
│ LePresidente/http-generic-403-bf     │ -             │ -         │ 1            │ 5      │ 1       │
│ crowdsecurity/http-crawl-non_statics │ 2             │ -         │ 57           │ 174    │ 55      │
│ crowdsecurity/http-probing           │ 1             │ -         │ 3            │ 3      │ 2       │
╰──────────────────────────────────────┴───────────────┴───────────┴──────────────┴────────┴─────────╯

Whitelist Metrics:
╭─────────────────────────────────────────────┬─────────────────────┬──────┬─────────────╮
│ Whitelist                                   │ Reason              │ Hits │ Whitelisted │
├─────────────────────────────────────────────┼─────────────────────┼──────┼─────────────┤
│ crowdsecurity/nextcloud-whitelist           │ Nextcloud Whitelist │ 728  │ -           │
│ nethserver/nethvoice-whitelist-http-probing │ nethvoice Whitelist │ 728  │ 46          │
╰─────────────────────────────────────────────┴─────────────────────┴──────┴─────────────╯

[DavidePrincipi]

Using the same approach as Nextcloud is fine, but let's wait for @Stell0 regarding the validity of the expression.