x-pack/filebeat/module/cisco/{asa,ftd}: allow configuration of time z…

CHANGELOG.next.asciidoc

@@ -191,6 +191,7 @@ https://github.com/elastic/beats/compare/v8.2.0\...main[Check the HEAD diff]
 - Allow users to redact sensitive data from CEL input debug logs. {pull}34302[34302]
 - Added support for HTTP destination override to Google Cloud Storage input. {pull}34413[34413]
 - Add support for new Rabbitmq timestamp format for logs {pull}34211[34211]
+- Allow user configuration of timezone offset in Cisco ASA and FTD modules. {pull}34436[34436]
 
 *Auditbeat*
 

filebeat/docs/modules/cisco.asciidoc

@@ -89,6 +89,11 @@ Set to 0.0.0.0 to bind to all available interfaces.
 
 The UDP port to listen for syslog traffic. Defaults to 9001.
 
+*`var.timezone_offset`*::
+
+IANA time zone or time offset (e.g. `+0200`) to use when interpreting syslog
+timestamps without a time zone. Defaults to UTC.
+
 *`var.tags`*::
 
 A list of tags to include in events. Including `forwarded` indicates that the
@@ -219,6 +224,11 @@ Set to 0.0.0.0 to bind to all available interfaces.
 
 The UDP port to listen for syslog traffic. Defaults to 9003.
 
+*`var.timezone_offset`*::
+
+IANA time zone or time offset (e.g. `+0200`) to use when interpreting syslog
+timestamps without a time zone. Defaults to UTC.
+
 *`var.tags`*::
 
 A list of tags to include in events. Including `forwarded` indicates that the

x-pack/filebeat/filebeat.reference.yml

@@ -720,6 +720,10 @@ filebeat.modules:
     # based on zone egress and ingress
     #var.external_zones: [ "External" ]
 
+    # IANA time zone or time offset (e.g. `+0200`) to use when interpreting syslog
+    # timestamps without a time zone.
+    #var.timezone_offset: UTC
+
   ftd:
     enabled: false
 
@@ -753,6 +757,10 @@ filebeat.modules:
     # based on zone egress and ingress
     #var.external_zones: [ "External" ]
 
+    # IANA time zone or time offset (e.g. `+0200`) to use when interpreting syslog
+    # timestamps without a time zone.
+    #var.timezone_offset: UTC
+
   ios:
     enabled: false
 

x-pack/filebeat/module/cisco/_meta/config.yml

@@ -32,6 +32,10 @@
     # based on zone egress and ingress
     #var.external_zones: [ "External" ]
 
+    # IANA time zone or time offset (e.g. `+0200`) to use when interpreting syslog
+    # timestamps without a time zone.
+    #var.timezone_offset: UTC
+
   ftd:
     enabled: false
 
@@ -65,6 +69,10 @@
     # based on zone egress and ingress
     #var.external_zones: [ "External" ]
 
+    # IANA time zone or time offset (e.g. `+0200`) to use when interpreting syslog
+    # timestamps without a time zone.
+    #var.timezone_offset: UTC
+
   ios:
     enabled: false
 

x-pack/filebeat/module/cisco/_meta/docs.asciidoc

@@ -82,6 +82,11 @@ Set to 0.0.0.0 to bind to all available interfaces.
 
 The UDP port to listen for syslog traffic. Defaults to 9001.
 
+*`var.timezone_offset`*::
+
+IANA time zone or time offset (e.g. `+0200`) to use when interpreting syslog
+timestamps without a time zone. Defaults to UTC.
+
 *`var.tags`*::
 
 A list of tags to include in events. Including `forwarded` indicates that the
@@ -212,6 +217,11 @@ Set to 0.0.0.0 to bind to all available interfaces.
 
 The UDP port to listen for syslog traffic. Defaults to 9003.
 
+*`var.timezone_offset`*::
+
+IANA time zone or time offset (e.g. `+0200`) to use when interpreting syslog
+timestamps without a time zone. Defaults to UTC.
+
 *`var.tags`*::
 
 A list of tags to include in events. Including `forwarded` indicates that the

x-pack/filebeat/module/cisco/asa/config/input.yml

@@ -29,6 +29,13 @@ processors:
       fields:
         ecs.version: 1.12.0
 
+{{ if .timezone_offset }}
+  - add_fields:
+      target: _temp_
+      fields:
+        timezone_offset: "{{ .timezone_offset }}"
+{{ end }}
+
 {{ if .external_zones }}
   - add_fields:
       target: _temp_

x-pack/filebeat/module/cisco/asa/manifest.yml

@@ -27,6 +27,7 @@ var:
     default: ASA
   - name: external_zones
   - name: internal_zones
+  - name: timezone_offset
 
 ingest_pipeline: ../shared/ingest/asa-ftd-pipeline.yml
 input: config/input.yml

x-pack/filebeat/module/cisco/asa/test/sample.log-expected.json

@@ -102,7 +102,7 @@
         ]
     },
     {
-        "@timestamp": "2014-04-15T11:34:34.000-02:00",
+        "@timestamp": "2014-04-15T13:34:34.000Z",
         "cisco.asa.destination_interface": "outside",
         "cisco.asa.message_id": "106100",
         "cisco.asa.rule_name": "acl_in",
@@ -122,7 +122,6 @@
         "event.original": "%ASA-session-5-106100: access-list acl_in permitted tcp inside/10.1.2.16(2241) -> outside/192.0.0.89(2000) hit-cnt 1 first hit [0x71a87d94, 0x0]",
         "event.outcome": "success",
         "event.severity": 5,
-        "event.timezone": "-02:00",
         "event.type": [
             "allowed",
             "connection"
@@ -1964,7 +1963,7 @@
         ]
     },
     {
-        "@timestamp": "2018-04-15T11:34:34.000-02:00",
+        "@timestamp": "2018-04-15T13:34:34.000Z",
         "cisco.asa.destination_interface": "outside",
         "cisco.asa.message_id": "106100",
         "cisco.asa.rule_name": "acl_in",
@@ -1984,7 +1983,6 @@
         "event.original": "%ASA-session-5-106100: access-list acl_in permitted tcp inside/10.0.0.16(2241) -> outside/192.0.0.99(2000) hit-cnt 1 first hit [0x71a87d94, 0x0]",
         "event.outcome": "success",
         "event.severity": 5,
-        "event.timezone": "-02:00",
         "event.type": [
             "allowed",
             "connection"

x-pack/filebeat/module/cisco/ftd/config/input.yml

@@ -29,6 +29,13 @@ processors:
       fields:
         ecs.version: 1.12.0
 
+{{ if .timezone_offset }}
+  - add_fields:
+      target: _temp_
+      fields:
+        timezone_offset: "{{ .timezone_offset }}"
+{{ end }}
+
 {{ if .external_zones }}
   - add_fields:
       target: _temp_

x-pack/filebeat/module/cisco/ftd/manifest.yml

@@ -27,6 +27,7 @@ var:
     default: FTD
   - name: external_zones
   - name: internal_zones
+  - name: timezone_offset
 
 ingest_pipeline: ../shared/ingest/asa-ftd-pipeline.yml
 input: config/input.yml