Cisco ASA: Fix message 106100 #20245

adriansr · 2020-07-27T14:50:40Z

What does this PR do?

This updates the parser for Cisco ASA message 106100 so that it doesn't fail when extra information is appended after the port numbers.

Checklist

My code follows the style guidelines of this project
I have commented my code, particularly in hard-to-understand areas
I have made corresponding changes to the documentation
I have made corresponding change to the default configuration files
I have added tests that prove my fix is effective or that my feature works
I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Author's Checklist

[ ]

How to test this PR locally

Related issues

Fixes #19350

This updates the parser for Cisco ASA message 106100 so that it doesn't fail when extra information is appended after the port numbers. Fixes elastic#19350

elasticmachine · 2020-07-27T14:50:42Z

Pinging @elastic/siem (Team:SIEM)

andrewstucki · 2020-07-27T14:57:50Z

x-pack/filebeat/module/cisco/shared/ingest/asa-ftd-pipeline.yml

@@ -253,7 +253,7 @@ processors:
  - dissect:
      if: "ctx._temp_.cisco.message_id == '106100'"
      field: "message"
-      pattern: "access-list %{_temp_.cisco.list_id} %{event.outcome} %{network.transport} %{_temp_.cisco.source_interface}/%{source.address}(%{source.port}) -> %{_temp_.cisco.destination_interface}/%{destination.address}(%{destination.port}) %{}"
+      pattern: "access-list %{_temp_.cisco.list_id} %{event.outcome} %{network.transport} %{_temp_.cisco.source_interface}/%{source.address}(%{source.port})%{}-> %{_temp_.cisco.destination_interface}/%{destination.address}(%{destination.port})%{}"


Did we want to add the ECS mapping to the user if we can identify the field as such? As indicated by the docs the thing we were missing is one of the following:

idfw_user— The user identity username, including the domain name that is added to the existing syslog when the ASA can find the username for the IP address.
sg_info— The security group tag that is added to the syslog when the ASA can find a security group tag for the IP address. The security group name is displayed with the security group tag, if available.

If we just want this as a bugfix to not drop the event that's cool too, as I'm not entirely sure how to distinguish idfw_user v. sg_info.

Yeah, it's both issues, didn't want to complicate the parsing even more for a bug fix, and I don't see an easy way of telling user and info apart.

leehinman · 2020-07-27T14:59:09Z

x-pack/filebeat/module/cisco/asa/test/asa-fix.log-expected.json

+        "event.kind": "event",
+        "event.module": "cisco",
+        "event.original": "%ASA-6-106100: access-list incoming permitted udp dmz2/127.2.3.4(56575) -> inside/127.3.4.5(53) hit-cnt 1 first hit [0x93d0e533, 0x578ef52f]",
+        "event.outcome": "allow",


allow isn't one of the allowed values for event.outcome.

I've created an issue: #20253

elasticmachine · 2020-07-27T15:42:56Z

💚 Build Succeeded

Expand to view the summary

Build stats

Build Cause: [Pull request #20245 opened]
Start Time: 2020-07-27T14:51:15.378+0000
Duration: 52 min 35 sec

Test stats 🧪

Test	Results
Failed	0
Passed	2434
Skipped	385
Total	2819

This updates the parser for Cisco ASA message 106100 so that it doesn't fail when extra information is appended after the port numbers. Fixes elastic#19350 (cherry picked from commit ac688ca)

This updates the parser for Cisco ASA message 106100 so that it doesn't fail when extra information is appended after the port numbers. Fixes #19350 (cherry picked from commit ac688ca)

* upstream/7.9: (32 commits) feat(ci): support storing artifacts for PRs in separate dirs (elastic#20282) (elastic#20301) Cisco ASA: Fix message 106100 (elastic#20245) (elastic#20277) [CI] Change upstream reference (elastic#20296) (elastic#20297) [docs] Fix Windows download link for agent (elastic#20258) (elastic#20290) Cherry-pick to 7.9: [docs] Rename release highlights to what's new (elastic#20255) (elastic#20285) Elastic agent on k8s (elastic#19727) (elastic#20262) [Filebeat Module] Defender ATP - Adding dashboard (elastic#20058) (elastic#20093) fix: use a fixed worker type for tests (elastic#20130) (elastic#20247) [Elastic Agent] Fix Windows powershell install service script (elastic#20203) (elastic#20252) [Ingest Manager] Fixed unzip on older windows (elastic#20088) (elastic#20109) adding possibility to override content-type checks, it was breaking certain webhooks that is not able to set content-headers at all. Still defaults to application/json (elastic#20232) (elastic#20237) [Filebeat][Gsuite] Make GSuite docs more clear (elastic#19981) (elastic#20067) Increase index.max_docvalue_fields_search to 200 (elastic#20218) (elastic#20221) Call host parser only once when building light metricsets (elastic#20149) (elastic#20190) [Metricbeat] Use MySQL Host Parser in Query metricset (elastic#20191) (elastic#20212) [Filebeat] Ignore cylance.protect timestamps while testing (elastic#20207) (elastic#20217) [libbeat] Fix write error in ensureWriter.Write (elastic#20112) (elastic#20145) Cherry-pick elastic#20127 to 7.9: Fix failing unit tests on windows (elastic#20180) Remove f5/firepass rsa2elk fileset (elastic#20160) (elastic#20206) Cherry-pick elastic#20138 to 7.9: [Filebeat] Update crowdstrike module (elastic#20177) ...

This updates the parser for Cisco ASA message 106100 so that it doesn't fail when extra information is appended after the port numbers. Fixes #19350 (cherry picked from commit ac688ca)

…ne-2.0 * upstream/master: (29 commits) Add an explicit system test for processes on unix systems (elastic#20320) [Autodiscovery] Ignore ErrInputNotFinished errors in autodiscover config checks (elastic#20305) [CI] Update README.md with CI references (elastic#20316) Add ECK doc links to Heartbeat docs (elastic#20284) [Filebeat] Add export tests to x-pack/filebeat (elastic#20156) feat(ci): support building docker images for PRs (elastic#20323) Update system tests dependency (elastic#20287) [Libbeat] Log debug message if the Kibana dashboard can not be imported from the archive (elastic#12211) (elastic#20150) [Filebeat][Gsuite] Transform all dates to timestamp with processor (elastic#20308) Infer types in Prometheus remote_write (elastic#19944) Remove unnecessary restarts of metricsets while using Node autodiscover (elastic#19974) docs: update changelog on master branch (elastic#20259) feat(ci): support storing artifacts for PRs in separate dirs (elastic#20282) [CI] Change upstream reference (elastic#20296) [Filebeat] Updates to Suricata module (elastic#20220) [docs] Fix Windows download link for agent (elastic#20258) [docs] Rename release highlights to what's new (elastic#20255) fix: update the display name of the multibranch job (elastic#20265) [Elastic Agent] Add basic protocol to control Elastic Agent. (elastic#20146) Cisco ASA: Fix message 106100 (elastic#20245) ...

This updates the parser for Cisco ASA message 106100 so that it doesn't fail when extra information is appended after the port numbers. Fixes elastic#19350

This updates the parser for Cisco ASA message 106100 so that it doesn't fail when extra information is appended after the port numbers. Fixes elastic#19350 (cherry picked from commit 170f9c2)

…tic#20279) This updates the parser for Cisco ASA message 106100 so that it doesn't fail when extra information is appended after the port numbers. Fixes elastic#19350 (cherry picked from commit 170f9c2)

Cisco ASA: Fix message 106100

2a47c3c

This updates the parser for Cisco ASA message 106100 so that it doesn't fail when extra information is appended after the port numbers. Fixes elastic#19350

adriansr added bug review Team:SIEM labels Jul 27, 2020

botelastic bot added needs_team Indicates that the issue/PR needs a Team:* label and removed needs_team Indicates that the issue/PR needs a Team:* label labels Jul 27, 2020

andrewstucki reviewed Jul 27, 2020

View reviewed changes

leehinman requested changes Jul 27, 2020

View reviewed changes

adriansr requested review from leehinman and andrewstucki July 28, 2020 12:58

leehinman approved these changes Jul 28, 2020

View reviewed changes

adriansr merged commit ac688ca into elastic:master Jul 28, 2020

adriansr deleted the fix_fb_19350 branch July 28, 2020 14:08

adriansr mentioned this pull request Jul 28, 2020

Cherry-pick #20245 to 7.x: Cisco ASA: Fix message 106100 #20276

Merged

6 tasks

adriansr added the v7.10.0 label Jul 28, 2020

adriansr mentioned this pull request Jul 28, 2020

Cherry-pick #20245 to 7.9: Cisco ASA: Fix message 106100 #20277

Merged

6 tasks

adriansr added the v7.9.0 label Jul 28, 2020

adriansr mentioned this pull request Jul 28, 2020

Cherry-pick #20245 to 7.8: Cisco ASA: Fix message 106100 #20279

Merged

6 tasks

adriansr added the v7.8.2 label Jul 28, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Cisco ASA: Fix message 106100 #20245

Cisco ASA: Fix message 106100 #20245

adriansr commented Jul 27, 2020 •

edited by andrewkroh

Loading

elasticmachine commented Jul 27, 2020

andrewstucki Jul 27, 2020

adriansr Jul 27, 2020

leehinman Jul 27, 2020

adriansr Jul 27, 2020

elasticmachine commented Jul 27, 2020

Build stats

Test stats 🧪

Cisco ASA: Fix message 106100 #20245

Cisco ASA: Fix message 106100 #20245

Conversation

adriansr commented Jul 27, 2020 • edited by andrewkroh Loading

What does this PR do?

Checklist

Author's Checklist

How to test this PR locally

Related issues

elasticmachine commented Jul 27, 2020

andrewstucki Jul 27, 2020

Choose a reason for hiding this comment

adriansr Jul 27, 2020

Choose a reason for hiding this comment

leehinman Jul 27, 2020

Choose a reason for hiding this comment

adriansr Jul 27, 2020

Choose a reason for hiding this comment

elasticmachine commented Jul 27, 2020

💚 Build Succeeded

Build stats

Test stats 🧪

adriansr commented Jul 27, 2020 •

edited by andrewkroh

Loading