Commits on Mar 24, 2021

1. Improve ASA/FTD Ingest Pipeline …

   Fixes elastic#21658
   
   For messages 716002:
   - Changed to GROK; allows for better parsing of event.reason
   - Added field for cisco.webvpn.group_name
   - Added field for event.reason per cisco docs for why session was terminated
   - Added field for cisco.termination_user for the AAA username terminating the connection
   
   For messages 722051:
   - Add angle brackets to dissect to properly dissect the message, per cisco docs
   - Added field for cisco.webvpn.group.name
   
   For messages 305011:
   - Change to GROK; allows for variance in message format with identity firewall
   
   For messages 302020:
   - Added GROK pattern to allows for variance in message format with identity firewall
   
   For messages 302014/302016/302021:
   - Added patterns and modified order of patterns of GROK to better match teardown messages
   - Note that order of processing is important as the most specific messages are matched first, falling through to the appropriate match.
   - Added temp fields for teardown initiator and user; defined in cisco docs but currently no real place to put them, but could be in future.
   - Added icmp_type and icmp_code parsing for 302021 messages
   - Changed duration matching from TIME to NOTSPACE, as long-lived connections (over 24 hours) don't match TIME.
   
   And:
   
   - Added descriptions to many fields to make them easier to find in 7.9+ Kibana Ingest Node Pipeline editor.
   - Changed source.bytes field type from integer to long, since long-lived flows can surpass the capacity of an integer; ECS reference field is defined as long.
   - Changed destination.bytes type from integer to long, since long-lived flows can surpass the capacity of an integer; ECS reference field is defined as long.

   

   hitchatwork authored and andrewkroh committed Mar 24, 2021
   Configuration menu

   • View commit details
   • Copy full SHA for 0c52b2d
   • Browse repository at this point

   Copy the full SHA

   0c52b2d View commit details

   Browse the repository at this point in the history