Skip to content

Commit 84a77c7

Browse files
taylor-swansontaylor-swanson
committed
[cisco_asa] Add new log types
- Add support for 111007, 113022, 113023, 425005, 611103 logs - Add tests
1 parent c6aad62 commit 84a77c7

File tree

6 files changed

+403
-2
lines changed

6 files changed

+403
-2
lines changed

‎packages/cisco_asa/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "2.36.0"
3+
changes:
4+
- description: Add additional log types.
5+
type: enhancement
6+
link: https://github.com/elastic/integrations/pull/10340
27
- version: "2.35.3"
38
changes:
49
- description: Fix patterns for 113008, 725002.

‎packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-asa.log‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -266,4 +266,10 @@ Oct 10 2018 12:34:56 localhost CiscoASA[999]: %ASA-4-106023: Deny tcp src outsid
266266
Oct 10 2018 12:34:56 localhost CiscoASA[999]: %ASA-4-106023: Deny tcp src outside:192.168.124.24/80 dst inside:172.31.98.44/8309 by access-group "inbound" [0x0, 0x0]
267267
Oct 10 2018 12:34:56 localhost CiscoASA[999]: %ASA-4-106023: Deny tcp src outside:192.168.124.24/80 dst inside:172.31.98.44/8309 by access-group "inbound" [0x0, 0x0]
268268
Oct 10 2018 12:34:56 localhost CiscoASA[999]: %ASA-4-106023: Deny tcp src outside:192.168.124.24/80 dst inside:172.31.98.44/8309 by access-group "inbound" [0x0, 0x0]
269-
<166>Jan 11 2023 13:34:06 localhost : %ASA-6-302013: Built outbound TCP connection 353540142 for outside-noanet:192.168.124.24/443 (192.168.124.24/443) to inside:172.31.98.44/49234 (172.31.98.44/49234)
269+
<166>Jan 11 2023 13:34:06 localhost : %ASA-6-302013: Built outbound TCP connection 353540142 for outside-noanet:192.168.124.24/443 (192.168.124.24/443) to inside:172.31.98.44/49234 (172.31.98.44/49234)
270+
<164>Jan 11 2023 13:34:06: %ASA-4-106023: Deny udp src MY_mgmt:192.168.124.24/123 dst MPLS_Internet:172.31.98.44/123 by access-group "MY_mgmt_access_in" [0x0, 0x0]
271+
<165>Jan 11 2023 13:34:06: %ASA-5-111007: Begin configuration: 192.168.124.24 reading from http [POST]
272+
<162>Jan 11 2023 13:34:06: %ASA-2-113022: AAA Marking LDAP server 192.168.124.24 in aaa-server group GROUP_NAME as FAILED
273+
<162>Jan 11 2023 13:34:06: %ASA-2-113023: AAA Marking LDAP server 192.168.124.24 in aaa-server group GROUP_NAME as ACTIVE
274+
<165>Jan 11 2023 13:34:06: %ASA-5-425005: Interface GigabitEthernet0/1 become active in redundant interface Redundant1
275+
<165>Jun 21 2024 09:07:00: %ASA-5-611103: User logged out: Uname: USER_NAME

‎packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-asa.log-expected.json‎

Lines changed: 332 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22746,6 +22746,338 @@
2274622746
"tags": [
2274722747
"preserve_original_event"
2274822748
]
22749+
},
22750+
{
22751+
"@timestamp": "2023-01-11T13:34:06.000Z",
22752+
"cisco": {
22753+
"asa": {
22754+
"destination_interface": "MPLS_Internet",
22755+
"rule_name": "MY_mgmt_access_in",
22756+
"source_interface": "MY_mgmt"
22757+
}
22758+
},
22759+
"destination": {
22760+
"address": "172.31.98.44",
22761+
"ip": "172.31.98.44",
22762+
"port": 123
22763+
},
22764+
"ecs": {
22765+
"version": "8.11.0"
22766+
},
22767+
"event": {
22768+
"action": "firewall-rule",
22769+
"category": [
22770+
"network"
22771+
],
22772+
"code": "106023",
22773+
"kind": "event",
22774+
"original": "<164>Jan 11 2023 13:34:06: %ASA-4-106023: Deny udp src MY_mgmt:192.168.124.24/123 dst MPLS_Internet:172.31.98.44/123 by access-group \"MY_mgmt_access_in\" [0x0, 0x0]",
22775+
"outcome": "success",
22776+
"severity": 4,
22777+
"timezone": "UTC",
22778+
"type": [
22779+
"connection",
22780+
"denied"
22781+
]
22782+
},
22783+
"log": {
22784+
"level": "warning",
22785+
"syslog": {
22786+
"facility": {
22787+
"code": 20
22788+
},
22789+
"priority": 164,
22790+
"severity": {
22791+
"code": 4
22792+
}
22793+
}
22794+
},
22795+
"network": {
22796+
"community_id": "1:xbya/aiSMeIJU6Accp+zqxHVMZQ=",
22797+
"iana_number": "17",
22798+
"transport": "udp"
22799+
},
22800+
"observer": {
22801+
"egress": {
22802+
"interface": {
22803+
"name": "MPLS_Internet"
22804+
}
22805+
},
22806+
"ingress": {
22807+
"interface": {
22808+
"name": "MY_mgmt"
22809+
}
22810+
},
22811+
"product": "asa",
22812+
"type": "firewall",
22813+
"vendor": "Cisco"
22814+
},
22815+
"related": {
22816+
"ip": [
22817+
"192.168.124.24",
22818+
"172.31.98.44"
22819+
]
22820+
},
22821+
"source": {
22822+
"address": "192.168.124.24",
22823+
"ip": "192.168.124.24",
22824+
"port": 123
22825+
},
22826+
"tags": [
22827+
"preserve_original_event"
22828+
]
22829+
},
22830+
{
22831+
"@timestamp": "2023-01-11T13:34:06.000Z",
22832+
"destination": {
22833+
"address": "192.168.124.24",
22834+
"ip": "192.168.124.24"
22835+
},
22836+
"ecs": {
22837+
"version": "8.11.0"
22838+
},
22839+
"event": {
22840+
"action": "configuration",
22841+
"category": [
22842+
"configuration"
22843+
],
22844+
"code": "111007",
22845+
"kind": "event",
22846+
"original": "<165>Jan 11 2023 13:34:06: %ASA-5-111007: Begin configuration: 192.168.124.24 reading from http [POST]",
22847+
"outcome": "success",
22848+
"severity": 5,
22849+
"timezone": "UTC",
22850+
"type": [
22851+
"info"
22852+
]
22853+
},
22854+
"log": {
22855+
"level": "notification",
22856+
"syslog": {
22857+
"facility": {
22858+
"code": 20
22859+
},
22860+
"priority": 165,
22861+
"severity": {
22862+
"code": 5
22863+
}
22864+
}
22865+
},
22866+
"observer": {
22867+
"product": "asa",
22868+
"type": "firewall",
22869+
"vendor": "Cisco"
22870+
},
22871+
"related": {
22872+
"ip": [
22873+
"192.168.124.24"
22874+
]
22875+
},
22876+
"tags": [
22877+
"preserve_original_event"
22878+
]
22879+
},
22880+
{
22881+
"@timestamp": "2023-01-11T13:34:06.000Z",
22882+
"destination": {
22883+
"address": "192.168.124.24",
22884+
"ip": "192.168.124.24"
22885+
},
22886+
"ecs": {
22887+
"version": "8.11.0"
22888+
},
22889+
"event": {
22890+
"action": "server-failed",
22891+
"category": [
22892+
"network"
22893+
],
22894+
"code": "113022",
22895+
"kind": "event",
22896+
"original": "<162>Jan 11 2023 13:34:06: %ASA-2-113022: AAA Marking LDAP server 192.168.124.24 in aaa-server group GROUP_NAME as FAILED",
22897+
"outcome": "failure",
22898+
"severity": 2,
22899+
"timezone": "UTC",
22900+
"type": [
22901+
"info"
22902+
]
22903+
},
22904+
"log": {
22905+
"level": "critical",
22906+
"syslog": {
22907+
"facility": {
22908+
"code": 20
22909+
},
22910+
"priority": 162,
22911+
"severity": {
22912+
"code": 2
22913+
}
22914+
}
22915+
},
22916+
"network": {
22917+
"protocol": "ldap"
22918+
},
22919+
"observer": {
22920+
"product": "asa",
22921+
"type": "firewall",
22922+
"vendor": "Cisco"
22923+
},
22924+
"related": {
22925+
"ip": [
22926+
"192.168.124.24"
22927+
]
22928+
},
22929+
"tags": [
22930+
"preserve_original_event"
22931+
]
22932+
},
22933+
{
22934+
"@timestamp": "2023-01-11T13:34:06.000Z",
22935+
"destination": {
22936+
"address": "192.168.124.24",
22937+
"ip": "192.168.124.24"
22938+
},
22939+
"ecs": {
22940+
"version": "8.11.0"
22941+
},
22942+
"event": {
22943+
"action": "server-active",
22944+
"category": [
22945+
"network"
22946+
],
22947+
"code": "113023",
22948+
"kind": "event",
22949+
"original": "<162>Jan 11 2023 13:34:06: %ASA-2-113023: AAA Marking LDAP server 192.168.124.24 in aaa-server group GROUP_NAME as ACTIVE",
22950+
"outcome": "success",
22951+
"severity": 2,
22952+
"timezone": "UTC",
22953+
"type": [
22954+
"info"
22955+
]
22956+
},
22957+
"log": {
22958+
"level": "critical",
22959+
"syslog": {
22960+
"facility": {
22961+
"code": 20
22962+
},
22963+
"priority": 162,
22964+
"severity": {
22965+
"code": 2
22966+
}
22967+
}
22968+
},
22969+
"network": {
22970+
"protocol": "ldap"
22971+
},
22972+
"observer": {
22973+
"product": "asa",
22974+
"type": "firewall",
22975+
"vendor": "Cisco"
22976+
},
22977+
"related": {
22978+
"ip": [
22979+
"192.168.124.24"
22980+
]
22981+
},
22982+
"tags": [
22983+
"preserve_original_event"
22984+
]
22985+
},
22986+
{
22987+
"@timestamp": "2023-01-11T13:34:06.000Z",
22988+
"cisco": {
22989+
"asa": {
22990+
"interface_name": "GigabitEthernet0/1",
22991+
"redundant_interface_name": "Redundant1"
22992+
}
22993+
},
22994+
"ecs": {
22995+
"version": "8.11.0"
22996+
},
22997+
"event": {
22998+
"action": "interface-switchover",
22999+
"category": [
23000+
"network"
23001+
],
23002+
"code": "425005",
23003+
"kind": "event",
23004+
"original": "<165>Jan 11 2023 13:34:06: %ASA-5-425005: Interface GigabitEthernet0/1 become active in redundant interface Redundant1",
23005+
"severity": 5,
23006+
"timezone": "UTC",
23007+
"type": [
23008+
"info"
23009+
]
23010+
},
23011+
"log": {
23012+
"level": "notification",
23013+
"syslog": {
23014+
"facility": {
23015+
"code": 20
23016+
},
23017+
"priority": 165,
23018+
"severity": {
23019+
"code": 5
23020+
}
23021+
}
23022+
},
23023+
"observer": {
23024+
"product": "asa",
23025+
"type": "firewall",
23026+
"vendor": "Cisco"
23027+
},
23028+
"tags": [
23029+
"preserve_original_event"
23030+
]
23031+
},
23032+
{
23033+
"@timestamp": "2024-06-21T09:07:00.000Z",
23034+
"ecs": {
23035+
"version": "8.11.0"
23036+
},
23037+
"event": {
23038+
"action": "logged-out",
23039+
"category": [
23040+
"authentication",
23041+
"network"
23042+
],
23043+
"code": "611103",
23044+
"kind": "event",
23045+
"original": "<165>Jun 21 2024 09:07:00: %ASA-5-611103: User logged out: Uname: USER_NAME",
23046+
"outcome": "success",
23047+
"severity": 5,
23048+
"timezone": "UTC",
23049+
"type": [
23050+
"info"
23051+
]
23052+
},
23053+
"log": {
23054+
"level": "notification",
23055+
"syslog": {
23056+
"facility": {
23057+
"code": 20
23058+
},
23059+
"priority": 165,
23060+
"severity": {
23061+
"code": 5
23062+
}
23063+
}
23064+
},
23065+
"observer": {
23066+
"product": "asa",
23067+
"type": "firewall",
23068+
"vendor": "Cisco"
23069+
},
23070+
"related": {
23071+
"user": [
23072+
"USER_NAME"
23073+
]
23074+
},
23075+
"tags": [
23076+
"preserve_original_event"
23077+
],
23078+
"user": {
23079+
"name": "USER_NAME"
23080+
}
2274923081
}
2275023082
]
2275123083
}

0 commit comments

Comments
 (0)