Cisco Accesslog and firewall rules doesn't match

[migruiz4]

Hi team,
while testing some rules, I noticed the decoder cisco-ios-acl can't trigger the firewall drop alerts.

This is a sample of cisco-acl log:

3924923: *Oct  6 03:32:04.114 gmt: %SEC-6-IPACCESSLOGP: list bcv_out denied tcp 10.0.3.100(50150) -> 192.168.216.1(443), 1 packet 

Actually is matching rule 4100

wazuh-ruleset/rules/0060-firewall_rules.xml

Lines 9 to 13 in 09b105a

	<group name="firewall,">
	<rule id="4100" level="0">
	<category>firewall</category>
	<description>Firewall rules grouped.</description>
	</rule>

And I think this should trigger the drop alert, because Cisco devices don't have the ACCEPT, REJECT, DROP actions.
Instead, they have "deny" and "permit"
So the equivalent to DROP would be "deny", and it doesn't match the rule.

wazuh-ruleset/rules/0060-firewall_rules.xml

Lines 15 to 24 in 09b105a

	<!-- We don't log firewall events, because they go
	- to their own log file.
	-->
	<rule id="4101" level="5">
	<if_sid>4100</if_sid>
	<action>DROP</action>
	<options>no_log</options>
	<description>Firewall drop event.</description>
	<group>firewall_drop,pci_dss_1.4,gpg13_4.12,gdpr_IV_35.7.d,</group>
	</rule>

Best regards,
Miguel

[fabamatic]

Sample log currently matches to rule 4716 - Cisco IOS informational message - IPACCESSLOGP. A rule looking for "denied" string may be added

[JavierBejMen]

This will be handle on the outgoing cisco rework in https://github.com/wazuh/feed