diff --git a/packages/cisco_asa/changelog.yml b/packages/cisco_asa/changelog.yml index 8d896c530a8..623762ec7a0 100644 --- a/packages/cisco_asa/changelog.yml +++ b/packages/cisco_asa/changelog.yml @@ -1,4 +1,9 @@ # newer versions go on top +- version: 2.25.2 + changes: + - description: Fix the protocol field processing in 313005. + type: bugfix + link: https://github.com/elastic/integrations/pull/8089 - version: 2.25.1 changes: - description: Remove redundant regular expression quantifier. diff --git a/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-additional-messages.log b/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-additional-messages.log index 399b054f131..296496377d3 100644 --- a/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-additional-messages.log +++ b/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-additional-messages.log @@ -13,6 +13,7 @@ May 5 17:51:17 dev01: %FTD-4-313005: No matching connection for ICMP error mess May 5 17:51:17 dev01: %FTD-4-313005: No matching connection for ICMP error message: icmp src srcif:192.168.2.2(LOCAL\testgroup\testuser) dst dstif:192.168.2.3 (type 3, code 3) on myif interface. Original IP payload: udp src 192.168.2.2/53 dst 192.168.2.3/10872. May 5 17:51:17 dev01: %FTD-4-313005: No matching connection for ICMP error message: icmp src srcif:192.168.2.2(LOCAL\testuser) dst dstif:192.168.2.3 (type 3, code 3) on myif interface. Original IP payload: udp src 192.168.2.2/53 dst 192.168.2.3/10872. <188>May 5 17:51:17: %ASA-4-313005: No matching connection for ICMP error message: icmp src srcif:192.168.2.2 dst dstif:192.168.2.3 (type 3, code 2) on srcif interface. Original IP payload: icmp src 192.168.2.2 dst 192.168.2.3 (type 0, code 0). +<188>May 5 17:51:17 dev01: %ASA-4-313005: No matching connection for ICMP error message: icmp src srcif:192.168.2.2 dst dstif:192.168.2.3 (type 3, code 2) on srcif interface. Original IP payload: protocol 51 src 192.168.2.2 dst 192.168.2.3. May 5 18:16:21 dev01: %ASA-6-302021: Teardown ICMP connection for faddr 192.168.2.2/0 gaddr 81.2.69.144/2 laddr 10.10.10.10/2 type 8 code 0 May 5 18:22:35 dev01: %ASA-7-609001: Built local-host net:10.10.10.10 May 5 18:24:31 dev01: %ASA-7-609002: Teardown local-host identity:10.10.10.10 duration 0:00:00 diff --git a/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-additional-messages.log-expected.json b/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-additional-messages.log-expected.json index b829381a23e..a09ece93e69 100644 --- a/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-additional-messages.log-expected.json +++ b/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-additional-messages.log-expected.json @@ -1121,6 +1121,89 @@ "preserve_original_event" ] }, + { + "@timestamp": "2023-05-05T17:51:17.000Z", + "cisco": { + "asa": { + "destination_interface": "dstif", + "icmp_code": 2, + "icmp_type": 3, + "original_iana_number": 51, + "source_interface": "srcif" + } + }, + "destination": { + "ip": "192.168.2.3" + }, + "ecs": { + "version": "8.10.0" + }, + "event": { + "action": "firewall-rule", + "category": [ + "network" + ], + "code": "313005", + "kind": "event", + "original": "\u003c188\u003eMay 5 17:51:17 dev01: %ASA-4-313005: No matching connection for ICMP error message: icmp src srcif:192.168.2.2 dst dstif:192.168.2.3 (type 3, code 2) on srcif interface. Original IP payload: protocol 51 src 192.168.2.2 dst 192.168.2.3.", + "severity": 4, + "timezone": "UTC", + "type": [ + "info" + ] + }, + "host": { + "hostname": "dev01" + }, + "log": { + "level": "warning", + "syslog": { + "facility": { + "code": 23 + }, + "priority": 188, + "severity": { + "code": 4 + } + } + }, + "network": { + "community_id": "1:E6cKJx0lLYUlU1tO5oQTlY25dBg=", + "iana_number": "1", + "transport": "icmp" + }, + "observer": { + "egress": { + "interface": { + "name": "dstif" + } + }, + "hostname": "dev01", + "ingress": { + "interface": { + "name": "srcif" + } + }, + "product": "asa", + "type": "firewall", + "vendor": "Cisco" + }, + "related": { + "hosts": [ + "dev01" + ], + "ip": [ + "192.168.2.2", + "192.168.2.3" + ] + }, + "source": { + "ip": "192.168.2.2" + }, + "tags": [ + "preserve_original_event" + ] + }, { "@timestamp": "2023-05-05T18:16:21.000Z", "cisco": { diff --git a/packages/cisco_asa/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/cisco_asa/data_stream/log/elasticsearch/ingest_pipeline/default.yml index b3c91ea0692..2db396d70e1 100644 --- a/packages/cisco_asa/data_stream/log/elasticsearch/ingest_pipeline/default.yml +++ b/packages/cisco_asa/data_stream/log/elasticsearch/ingest_pipeline/default.yml @@ -607,6 +607,7 @@ processors: description: "313005" patterns: - "No matching connection for ICMP error message: %{NOTSPACE:network.transport} src %{NOTCOLON:_temp_.cisco.source_interface}:%{IPORHOST} dst %{NOTCOLON:_temp_.cisco.destination_interface}:%{IPORHOST} \\(type %{NUMBER:_temp_.cisco.icmp_type}, code %{NUMBER:_temp_.cisco.icmp_code}\\) on %{NOTCOLON} interface.%{SPACE}Original IP payload: %{NOTSPACE:input.type} src %{IPORHOST:source.ip}(/%{NUMBER:source.port})? dst %{IPORHOST:destination.ip}(/%{NUMBER:destination.port})?[.]?" + - "No matching connection for ICMP error message: %{NOTSPACE:network.transport} src %{NOTCOLON:_temp_.cisco.source_interface}:%{IPORHOST} dst %{NOTCOLON:_temp_.cisco.destination_interface}:%{IPORHOST} \\(type %{NUMBER:_temp_.cisco.icmp_type}, code %{NUMBER:_temp_.cisco.icmp_code}\\) on %{NOTCOLON} interface.%{SPACE}Original IP payload: protocol %{NUMBER:_temp_.cisco.original_iana_number} src %{IPORHOST:source.ip}(/%{NUMBER:source.port})? dst %{IPORHOST:destination.ip}(/%{NUMBER:destination.port})?[.]?" - "No matching connection for ICMP error message: %{NOTSPACE:network.transport} src %{NOTCOLON:_temp_.cisco.source_interface}:%{IPORHOST}\\(%{NOTCOLON:source.user.domain}\\\\%{NOTSPACE:source.user.group.name}\\\\%{NOTSPACE:source.user.name}\\) dst %{NOTCOLON:_temp_.cisco.destination_interface}:%{IPORHOST} \\(type %{NUMBER:_temp_.cisco.icmp_type}, code %{NUMBER:_temp_.cisco.icmp_code}\\) on %{NOTCOLON} interface.%{SPACE}Original IP payload: %{NOTSPACE:input.type} src %{IPORHOST:source.ip}(/%{NUMBER:source.port})? dst %{IPORHOST:destination.ip}(/%{NUMBER:destination.port})?[.]?" - "No matching connection for ICMP error message: %{NOTSPACE:network.transport} src %{NOTCOLON:_temp_.cisco.source_interface}:%{IPORHOST}\\(%{NOTCOLON:source.user.domain}\\\\%{NOTSPACE:source.user.name}\\) dst %{NOTCOLON:_temp_.cisco.destination_interface}:%{IPORHOST} \\(type %{NUMBER:_temp_.cisco.icmp_type}, code %{NUMBER:_temp_.cisco.icmp_code}\\) on %{NOTCOLON} interface.%{SPACE}Original IP payload: %{NOTSPACE:input.type} src %{IPORHOST:source.ip}(/%{NUMBER:source.port})? dst %{IPORHOST:destination.ip}(/%{NUMBER:destination.port})?[.]?" pattern_definitions: @@ -1956,6 +1957,15 @@ processors: - append: field: error.message value: "Processor {{{ _ingest.on_failure_processor_type }}} with tag {{{ _ingest.on_failure_processor_tag }}} in pipeline {{{ _ingest.on_failure_pipeline }}} failed with message: {{{ _ingest.on_failure_message }}}" + - convert: + field: _temp_.cisco.original_iana_number + tag: "convert_original_iana_number" + type: integer + ignore_missing: true + on_failure: + - append: + field: error.message + value: "Processor {{{ _ingest.on_failure_processor_type }}} with tag {{{ _ingest.on_failure_processor_tag }}} in pipeline {{{ _ingest.on_failure_pipeline }}} failed with message: {{{ _ingest.on_failure_message }}}" - convert: field: http.response.status_code tag: "convert_http_resp_status_code" diff --git a/packages/cisco_asa/data_stream/log/fields/fields.yml b/packages/cisco_asa/data_stream/log/fields/fields.yml index ff3f026c0de..1def1b44e32 100644 --- a/packages/cisco_asa/data_stream/log/fields/fields.yml +++ b/packages/cisco_asa/data_stream/log/fields/fields.yml @@ -225,4 +225,8 @@ type: keyword description: > Reason for an AAA authentication rejection. + - name: original_iana_number + type: short + description: > + IANA Protocol Number of the original IP payload. diff --git a/packages/cisco_asa/docs/README.md b/packages/cisco_asa/docs/README.md index 7f24bdd1204..23683faec51 100644 --- a/packages/cisco_asa/docs/README.md +++ b/packages/cisco_asa/docs/README.md @@ -157,6 +157,7 @@ An example event for `log` looks as following: | cisco.asa.mapped_source_port | The translated source port. | long | | cisco.asa.message | The message associated with SIP and Skinny VoIP events | keyword | | cisco.asa.message_id | The Cisco ASA message identifier. | keyword | +| cisco.asa.original_iana_number | IANA Protocol Number of the original IP payload. | short | | cisco.asa.privilege.new | When a users privilege is changed this is the new value | keyword | | cisco.asa.privilege.old | When a users privilege is changed this is the old value | keyword | | cisco.asa.rejection_reason | Reason for an AAA authentication rejection. | keyword | diff --git a/packages/cisco_asa/manifest.yml b/packages/cisco_asa/manifest.yml index 64460ffb965..b5df0c8405f 100644 --- a/packages/cisco_asa/manifest.yml +++ b/packages/cisco_asa/manifest.yml @@ -1,7 +1,7 @@ format_version: "3.0.0" name: cisco_asa title: Cisco ASA -version: "2.25.1" +version: "2.25.2" description: Collect logs from Cisco ASA with Elastic Agent. type: integration categories: