Skip to content

[cisco_asa] Fix categorization of network protocols #9642

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
taylor-swanson merged 2 commits into from
Apr 18, 2024
Merged

[cisco_asa] Fix categorization of network protocols #9642

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
4e80a49
[cisco_asa] Fix categorization of network protocols
taylor-swanson Apr 18, 2024
1b4dcb7
changelog
taylor-swanson Apr 18, 2024
File filter

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions packages/cisco_asa/changelog.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,9 @@
# newer versions go on top
- version: "2.33.2"
changes:
- description: Fix categorization of protocols.
type: bugfix
link: https://github.com/elastic/integrations/pull/9642
- version: "2.33.1"
changes:
- description: Allow apostrophes in usernames.
Expand Down
20 changes: 12 additions & 8 deletions ...s/cisco_asa/data_stream/log/_dev/test/pipeline/test-additional-messages.log-expected.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -215,7 +215,7 @@
},
"network": {
"direction": "inbound",
"protocol": "icmp"
"type": "icmp"
},
"observer": {
"hostname": "dev01",
Expand Down Expand Up @@ -402,7 +402,7 @@
},
"network": {
"direction": "inbound",
"protocol": "icmp"
"type": "icmp"
},
"observer": {
"hostname": "dev01",
Expand Down Expand Up @@ -1439,7 +1439,7 @@
},
"network": {
"direction": "inbound",
"protocol": "icmp"
"type": "icmp"
},
"observer": {
"hostname": "dev01",
Expand Down Expand Up @@ -1507,7 +1507,7 @@
},
"network": {
"direction": "outbound",
"protocol": "icmp"
"type": "icmp"
},
"observer": {
"hostname": "dev01",
Expand Down Expand Up @@ -5223,7 +5223,8 @@
"level": "notification"
},
"network": {
"protocol": "tcp"
"iana_number": "6",
"transport": "tcp"
},
"observer": {
"egress": {
Expand Down Expand Up @@ -5310,7 +5311,8 @@
"level": "warning"
},
"network": {
"protocol": "tcp"
"iana_number": "6",
"transport": "tcp"
},
"observer": {
"egress": {
Expand Down Expand Up @@ -5397,7 +5399,8 @@
"level": "informational"
},
"network": {
"protocol": "tcp"
"iana_number": "6",
"transport": "tcp"
},
"observer": {
"hostname": "dev01",
Expand Down Expand Up @@ -5478,7 +5481,8 @@
"level": "warning"
},
"network": {
"protocol": "tcp"
"iana_number": "6",
"transport": "tcp"
},
"observer": {
"egress": {
Expand Down
4 changes: 2 additions & 2 deletions packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-non-canonical.log-expected.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1070,7 +1070,7 @@
},
"network": {
"direction": "inbound",
"protocol": "icmp"
"type": "icmp"
},
"observer": {
"hostname": "81.2.69.142",
Expand Down Expand Up @@ -1145,7 +1145,7 @@
},
"network": {
"direction": "inbound",
"protocol": "icmp"
"type": "icmp"
},
"observer": {
"hostname": "81.2.69.142",
Expand Down
6 changes: 3 additions & 3 deletions packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-sample.log-expected.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5570,7 +5570,7 @@
},
"network": {
"direction": "inbound",
"protocol": "icmp"
"type": "icmp"
},
"observer": {
"product": "asa",
Expand Down Expand Up @@ -5667,7 +5667,7 @@
},
"network": {
"direction": "inbound",
"protocol": "icmp"
"type": "icmp"
},
"observer": {
"product": "asa",
Expand Down Expand Up @@ -5768,7 +5768,7 @@
},
"network": {
"direction": "inbound",
"protocol": "icmp"
"type": "icmp"
},
"observer": {
"product": "asa",
Expand Down
6 changes: 3 additions & 3 deletions packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-sgt-tag-name.log-expected.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -509,7 +509,7 @@
},
"network": {
"direction": "inbound",
"protocol": "icmp"
"type": "icmp"
},
"observer": {
"hostname": "myAsaHostname",
Expand Down Expand Up @@ -1377,7 +1377,7 @@
},
"network": {
"direction": "outbound",
"protocol": "icmp"
"type": "icmp"
},
"observer": {
"hostname": "myAsaHostname",
Expand Down Expand Up @@ -2046,7 +2046,7 @@
},
"network": {
"direction": "inbound",
"protocol": "icmp"
"type": "icmp"
},
"observer": {
"hostname": "myAsaHostname",
Expand Down
10 changes: 5 additions & 5 deletions packages/cisco_asa/data_stream/log/elasticsearch/ingest_pipeline/default.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -511,7 +511,7 @@ processors:
field: "message"
description: "302020"
patterns:
- "Built %{NOTSPACE:network.direction} %{NOTSPACE:network.protocol} connection for faddr (?:%{NOTCOLON:_temp_.cisco.source_interface}:)?%{ECSDESTIPORHOST}/%{NUMBER}\\s*(?:\\(%{CISCO_USER_OR_SGT_DST}\\) )?gaddr (?:%{NOTCOLON}:)?%{MAPPEDSRC}/%{NUMBER} laddr (?:%{NOTCOLON:_temp_.cisco.source_interface}:)?%{ECSSOURCEIPORHOST}/%{NUMBER}\\s*(?:\\(%{CISCO_USER_OR_SGT_SRC}\\) )?(type %{NUMBER:_temp_.cisco.icmp_type} code %{NUMBER:_temp_.cisco.icmp_code})?"
- "Built %{NOTSPACE:network.direction} %{NOTSPACE:network.type} connection for faddr (?:%{NOTCOLON:_temp_.cisco.source_interface}:)?%{ECSDESTIPORHOST}/%{NUMBER}\\s*(?:\\(%{CISCO_USER_OR_SGT_DST}\\) )?gaddr (?:%{NOTCOLON}:)?%{MAPPEDSRC}/%{NUMBER} laddr (?:%{NOTCOLON:_temp_.cisco.source_interface}:)?%{ECSSOURCEIPORHOST}/%{NUMBER}\\s*(?:\\(%{CISCO_USER_OR_SGT_SRC}\\) )?(type %{NUMBER:_temp_.cisco.icmp_type} code %{NUMBER:_temp_.cisco.icmp_code})?"
pattern_definitions:
HOSTNAME: "\\b(?:[0-9A-Za-z][0-9A-Za-z\\-_]{0,62})(?:\\.(?:[0-9A-Za-z][0-9A-Za-z\\-_]{0,62}))*(\\.?|\\b)"
IPORHOST: "(?:%{IP}|%{HOSTNAME})"
Expand Down Expand Up @@ -955,17 +955,17 @@ processors:
if: "ctx._temp_.cisco.message_id == '434002'"
tag: parse_434002
field: "message"
pattern: "SFR requested to drop %{network.protocol} packet from %{_temp_.cisco.source_interface}:%{source.address}/%{source.port} to %{_temp_.cisco.destination_interface}:%{destination.address}/%{destination.port}"
pattern: "SFR requested to drop %{network.transport} packet from %{_temp_.cisco.source_interface}:%{source.address}/%{source.port} to %{_temp_.cisco.destination_interface}:%{destination.address}/%{destination.port}"
- dissect:
if: "ctx._temp_.cisco.message_id == '434004'"
tag: parse_434004
field: "message"
pattern: "SFR requested ASA to bypass further packet redirection and process %{network.protocol} flow from %{_temp_.cisco.source_interface}:%{source.address}/%{source.port} to %{_temp_.cisco.destination_interface}:%{destination.address}/%{destination.port} locally"
pattern: "SFR requested ASA to bypass further packet redirection and process %{network.transport} flow from %{_temp_.cisco.source_interface}:%{source.address}/%{source.port} to %{_temp_.cisco.destination_interface}:%{destination.address}/%{destination.port} locally"
- dissect:
if: "ctx._temp_.cisco.message_id == '110002'"
tag: parse_110002
field: "message"
pattern: "%{event.reason} for %{network.protocol} from %{_temp_.cisco.source_interface}:%{source.address}/%{source.port} to %{destination.address}/%{destination.port}"
pattern: "%{event.reason} for %{network.transport} from %{_temp_.cisco.source_interface}:%{source.address}/%{source.port} to %{destination.address}/%{destination.port}"
- dissect:
if: "ctx._temp_.cisco.message_id == '419002'"
tag: parse_419002
Expand Down Expand Up @@ -1013,7 +1013,7 @@ processors:
- set:
if: '["419002"].contains(ctx._temp_.cisco.message_id)'
tag: parse_419002
field: "network.protocol"
field: "network.transport"
value: "tcp"

#
Expand Down
2 changes: 1 addition & 1 deletion packages/cisco_asa/manifest.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
format_version: "3.0.3"
name: cisco_asa
title: Cisco ASA
version: "2.33.1"
version: "2.33.2"
description: Collect logs from Cisco ASA with Elastic Agent.
type: integration
categories:
Expand Down