Cisco WLC Mapping

Packs/Cisco_Wireless_LAN_Controller/ModelingRules/Cisco_Wireless_LAN_Controller/Cisco_Wireless_LAN_Controller.yml

@@ -0,0 +1,6 @@
+fromversion: 8.3.0
+id: Cisco_WLC_ModelingRule
+name: Cisco WLC Modeling Rule
+rules: ''
+schema: ''
+tags: ''

Packs/Cisco_Wireless_LAN_Controller/ModelingRules/Cisco_Wireless_LAN_Controller/Cisco_Wireless_LAN_Controller_schema.json

@@ -0,0 +1,8 @@
+{
+  "cisco_wlc_raw": {
+    "_raw_log": {
+      "type": "string",
+      "is_array": false
+    }
+  }
+}

Packs/Cisco_Wireless_LAN_Controller/ParsingRules/Cisco_Wireless_LAN_Controller/Cisco_Wireless_LAN_Controller.xif

@@ -0,0 +1,19 @@
+[INGEST:vendor="cisco", product="wlc", target_dataset="cisco_wlc_raw", no_hit=keep]
+// Supported date time formats: 
+// - MMM dd hh:mm:ss.nnn
+// - MMM dd hh:mm:ss.nnn TZ
+// - yyyy MMM dd hh:mm:ss.nnn
+// - yyyy MMM dd hh:mm:ss.nnn TZ
+// For example: "2021 Jan 01 10:00:00.123 UTC".
+filter _raw_log ~= "\d*\s*\S+\s+\d+\s+\S+\s*\S*\:\s+\%"
+| alter
+    tmp_get_log_datetime = arraystring(regextract(_raw_log, "(\d*\s*\S+\s+\d+\s+\S+)\s*\S*\:\s+\%"), "")
+| alter
+    tmp_get_year = if(tmp_get_log_datetime ~= "\d{4}", arraystring(regextract(tmp_get_log_datetime, "\d{4}"), ""), "1970"),
+    tmp_get_time_milli = arraystring(regextract(tmp_get_log_datetime, "\d{2}:\d{2}:\d{2}\.\d{3}"), ""),
+    tmp_get_month_day = arraystring(regextract(tmp_get_log_datetime, "(\S+\s\d+)\s"), "")
+| alter
+    tmp_full_timestamp = arraystring(arraycreate(tmp_get_year, tmp_get_month_day, tmp_get_time_milli), " ")
+| alter
+    _time = if(tmp_full_timestamp ~= "1970", _insert_time, parse_timestamp("%Y %h %e %H:%M:%E3S", tmp_full_timestamp))
+| fields -tmp_get_log_datetime, tmp_get_year, tmp_get_time_milli, tmp_get_month_day, tmp_full_timestamp;

Packs/Cisco_Wireless_LAN_Controller/ParsingRules/Cisco_Wireless_LAN_Controller/Cisco_Wireless_LAN_Controller.yml

@@ -0,0 +1,6 @@
+name: Cisco WLC Parsing Rule
+id: Cisco_WLC_ParsingRule
+fromversion: 8.3.0
+tags: []
+rules: ''
+samples: ''

Packs/Cisco_Wireless_LAN_Controller/README.md

@@ -0,0 +1,72 @@
+# Cisco Wireless LAN Controller (WLC)
+
+<~XSIAM>
+
+This pack includes Cortex XSIAM content.
+
+
+## Message Logging Configuration
+You need to configure Cisco WLC to forward Syslog messages.
+
+* Product documentation for configuring message logging either from the GUI and CLI - [Link](https://www.cisco.com/c/en/us/td/docs/wireless/controller/8-5/config-guide/b_cg85/configuring_system_and_message_logging.html#sys-msg-logging).
+
+Open your Cisco WLC GUI, and follow these instructions:
+1. Go to Management &rarr; Logs &rarr; Config. The Syslog Configuration page appears.
+2. In the **Syslog Server IP Address** field, enter the IPv4/IPv6 address of the server to which to send the syslog messages and click Add.
+3. Optional, to set the severity level for filtering syslog messages to the syslog servers, choose one of the options under **Syslog Level**.
+4. Optional, to set the facility for outgoing syslog messages to the syslog servers, choose one of the options under **Syslog Facility**.
+5. Click **Apply**.
+6. Optional, to set the severity level for logging messages to the controller buffer and console, choose one of the options from either the **Buffered Log Level** and **Console Log Level** dropdown lists.
+7. Select the **File Info** checkbox if you want the message logs to include information about the source file. The default value is enabled.
+8. Select the **Trace Info** checkbox if you want the message logs to include traceback information. The default is disabled.
+9. Click **Apply**.
+10. Click **Save Configuration**.
+
+
+## Timestamp Ingestion
+
+The following timestamp formats are currently supported for ingestion from Cisco WLC Syslog Messages in UTC time:
+* MMM dd hh:mm:ss.nnn
+* MMM dd hh:mm:ss.nnn TZ
+* yyyy MMM dd hh:mm:ss.nnn
+* yyyy MMM dd hh:mm:ss.nnn TZ
+
+In order to configure one of the above formats, follow these instructions:
+1. Open your Cisco WLC CLI terminal, and type **enable** to enter Privileged EXEC mode.
+2. Enter Global Configuration Mode by either typing **configure terminal** or **conf t**.
+3. To configure the timezone in UTC format, type:
+```bash
+config time timezone enable 0 0
+```
+4. For adding a **year** and **milliseconds** to your syslog messages, type:
+```bash
+config service timestamps log datetime year msec
+```
+5. Revert back to Privileged EXEC mode by typing **end**. 
+6. Save your changes by either typing 
+```bash
+write memory
+OR
+copy running-config startup-config 
+```
+And wait for system confirmation.
+
+
+## Collect Events from Vendor
+In order to use the collector, use the [Broker VM](#broker-vm) option.
+
+### Broker VM
+To create or configure the Broker VM, use the information described [here](https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Configure-the-Broker-VM).
+
+You can configure the specific vendor and product for this instance.
+
+1. Navigate to **Settings** &rarr; **Configuration** &rarr; **Data Broker** &rarr; **Broker VMs**.
+2. Go to the **Apps** column under the **Brokers** tab and add the **Syslog Collector** app for the relevant broker instance. If the app already exists, hover over it and click **Configure**.
+3. Click **Add New** for adding a new syslog data source.
+4. When configuring the new syslog data source, set the following values:
+   | Parameter     | Value   
+   | :---          | :---        
+   | `Vendor`      | Enter **cisco**.
+   | `Product`     | Enter **wlc**.
+
+</~XSIAM>

Packs/Cisco_Wireless_LAN_Controller/pack_metadata.json

@@ -0,0 +1,18 @@
+{
+    "name": "Cisco Wireless LAN Controller",
+    "description": "Cisco Wireless LAN Controller (WLC) is used to manage and ensure seamless and secure wireless communication within organizations.",
+    "support": "xsoar",
+    "currentVersion": "1.0.0",
+    "author": "Cortex XSOAR",
+    "url": "https://www.paloaltonetworks.com/cortex",
+    "email": "",
+    "categories": [
+        "Analytics & SIEM"
+    ],
+    "tags": [],
+    "useCases": [],
+    "keywords": [],
+    "marketplaces": [
+        "marketplacev2"
+    ]
+}