Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Filebeat][Cisco ASA] log enhancement and performance #20831

Closed
wants to merge 16 commits into from
Closed

[Filebeat][Cisco ASA] log enhancement and performance #20831

Show file tree
Hide file tree
Changes from 5 commits
Commits
Show all changes
16 commits
Select commit Hold shift + click to select a range
769af9d
ecs fix - more message pattern
pcosic Aug 27, 2020
8e0491e
Update asa-ftd-pipeline.yml
pcosic Aug 31, 2020
b13af6e
Update asa-ftd-pipeline.yml
pcosic Sep 2, 2020
eafaae2
Update asa-ftd-pipeline.yml
pcosic Sep 2, 2020
40814cc
testing for PR and some minor fixes
pcosic Sep 8, 2020
b992fcd
commit for requested changes
pcosic Sep 18, 2020
5386064
newline
pcosic Sep 18, 2020
1775792
test
pcosic Oct 20, 2020
14aebc0
Merge branch 'master' into ingestCiscoMessagePattern
pcosic Oct 20, 2020
029083f
make test commit
pcosic Oct 20, 2020
e398834
Fix parsing on 106014 with an additional ${SPACE} in grok pattern, so…
pcosic Oct 21, 2020
1e9da38
fixed 106014 finally
pcosic Oct 30, 2020
e664cd6
Merge remote-tracking branch 'upstream/master' into ingestCiscoMessag…
pcosic Oct 30, 2020
babe7b5
after test commit
pcosic Oct 30, 2020
faf2659
Merge remote-tracking branch 'upstream/master' into ingestCiscoMessag…
pcosic Dec 17, 2020
763132e
Test after merge
pcosic Dec 17, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions x-pack/filebeat/module/cisco/asa/_meta/fields.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,8 @@
- name: event.reason
pcosic marked this conversation as resolved.
Show resolved Hide resolved
type: text
description: >
Reason why this event happened, according to the source.

- name: cisco.asa
type: group
description: >
Expand Down
15 changes: 15 additions & 0 deletions x-pack/filebeat/module/cisco/asa/test/additional_messages.log
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,3 +67,18 @@ Apr 27 02:03:03 dev01: %ASA-4-113019: Group = 91.240.17.178, Username = 91.240.1
Apr 27 02:03:03 dev01: %ASA-4-722051: Group some-policy User testuser IP 8.8.8.8 IPv4 Address 8.8.4.4 IPv6 address 2001:4860:4860::8888 assigned to session
Apr 27 02:03:03 dev01: %ASA-6-716002: Group another-policy User testuser IP 8.8.8.8 WebVPN session terminated: User Requested.
Apr 27 02:03:03 dev01: %ASA-3-710003: TCP access denied by ACL from 104.46.88.19/6370 to outside:195.74.114.34/23
Apr 27 2020 02:03:03 dev01: %ASA-5-434004: SFR requested ASA to bypass further packet redirection and process TCP flow from sourceInterfaceName:91.240.17.178/8888 to destinationInterfaceName:192.168.2.2/123123 locally
Apr 27 2020 02:03:03 dev01: %ASA-4-434002: SFR requested to drop TCP packet from sourceInterfaceName:91.240.17.138/8888 to destinationInterfaceName:192.168.2.2/514514
Apr 27 2020 02:03:03 dev01: %ASA-6-110002: Failed to locate egress interface for TCP from sourceInterfaceName:91.240.17.178/7777 to 192.168.2.2/123412
Apr 27 2020 02:03:03 dev01: %ASA-4-419002: Duplicate TCP SYN from sourceInterfaceName:91.240.17.178/7777 to destinationInterfaceName:192.168.2.2/514514 with different initial sequence number
Apr 27 2020 02:03:03 dev01: %ASA-6-602303: IPSEC: An outbound LAN-to-LAN SA (SPI= 0xF81283) between 91.240.17.178 and 192.168.2.2 (user= admin) has been created.
Apr 27 2020 02:03:03 dev01: %ASA-6-602304: IPSEC: An outbound LAN-to-LAN SA (SPI= 0xF81283) between 91.240.17.178 and 192.168.2.2 (user= admin) has been deleted.
Apr 27 2020 02:03:03 dev01: %ASA-5-750002: Local:91.240.17.178:7777 Remote:192.168.2.2:7777 Username:admin Received a IKE_INIT_SA request
Apr 27 2020 02:03:03 dev01: %ASA-4-750003: Local:91.240.17.178:7777 Remote:192.168.2.2:7777 Username:admin Negotiation aborted due to ERROR: Failed to locate an item in the database
Apr 27 2020 02:03:03 dev01: %ASA-5-713120: Group = 100.60.140.10, IP = 192.128.1.1, PHASE 2 COMPLETED (msgid=bbe383e88)
Apr 27 2020 02:03:03 dev01: %ASA-5-713202: IP = 192.64.157.61, Duplicate first packet detected. Ignoring packet.
Apr 27 2020 02:03:03 dev01: %ASA-6-713905: Group = 100.60.140.10, IP = 192.128.1.1, All IPSec SA proposals found unacceptable!
Apr 27 2020 02:03:03 dev01: %ASA-6-713904: All IPSec SA proposals found unacceptable!
Apr 27 2020 02:03:03 dev01: %ASA-6-713903: IP = 192.128.1.1, All IPSec SA proposals found unacceptable!
Apr 27 2020 02:03:03 dev01: %ASA-6-713902: Group = 100.60.140.10, All IPSec SA proposals found unacceptable!
Apr 27 2020 02:03:03 dev01: %ASA-6-713901: Group = 100.60.140.10, IP = 192.128.1.1, All IPSec SA proposals found unacceptable!
Loading