[Filebeat - Module Cisco-ASA] Parsing of Cisco Event Message 734001

[MarcusCaepio]

Hi all,
Describe the enhancement:
we recently switched from Logstash to Ingest with filebeat-cisco-asa and unfortunately noticed, that one important cisco message is not yet ingested (correctly), the cisco.asa.message_id:734001 . These messages give information about the DAP records, which a user gets, when he connects via VPN and are very while troubleshooting VPN problems.
Describe a specific use case for the enhancement or feature:
The ID Pattern given by cisco looks like this:
%ASA-6-734001: DAP: User user, Addr ipaddr , Connection connection : The following DAP records were selected for this connection: DAP record names
https://www.cisco.com/c/en/us/td/docs/security/asa/syslog/b_syslog/syslogs9.html#con_5678113

Here is a sample event:
%ASA-6-734001: DAP: User [email protected], Addr 1.2.3.4, Connection AnyConnect: The following DAP records were selected for this connection: dap_name1, dap_name2
The Pattern and Logstash filter, I used in the past, looks like this:

Pattern:
CISCOFW734001 DAP: User %{DATA:user}, Addr %{IP:src_ip}, Connection %{GREEDYDATA:connection_type}: The following DAP records were selected for this connection: %{GREEDYDATA:dap_records}

Filter:
    if [dap_records] {
      mutate {
        split => { "dap_records" => ", " }
      }

It would be very nice, if this could be Ingested by Filebeat, too. At the moment, we are not able use elastic for this use case, because we can though search the message id, but as soon as we additionally search for a username in the event.original field, the search really takes very, very long.

As I am currently totally inexperienced in creating modules. So I don't know, if I can give constructive help here. But if sb. can lend me a hand, where I have to begin (beside the docs), I will try to help.

Also relates to #14151

Thanks in advanced!
Cheers,
Marcus

[elasticmachine]

Pinging @elastic/siem (Team:SIEM)

[MarcusCaepio]

Maybe @adriansr can help here most?

[andrewkroh]

But if sb. can lend me a hand, where I have to begin (beside the docs), I will try to help.

Hi @MarcusCaepio, the Cisco ASA module uses an Elasticsearch Ingest Node pipeline to do the parsing. This module is bundled into the Filebeat install. You can try making modification to your pipeline and testing the results. Any time you change the pipeline config on disk you need to reinstall it to Elasticsearch before indexing any log data.

Your filebeat install will have a module/cisco/shared/ingest/asa-ftd-pipeline.yml file. You probably want to insert a dissect processor for message 734001. For example this is how message 106001 is parsed:

beats/x-pack/filebeat/module/cisco/shared/ingest/asa-ftd-pipeline.yml

Lines 159 to 162 in 4b69bf2

	- dissect:
	if: "ctx._temp_.cisco.message_id == '106001'"
	field: "message"
	pattern: "%{network.direction} %{network.transport} connection %{event.outcome} from %{source.address}/%{source.port} to %{destination.address}/%{destination.port} flags %{} on interface %{_temp_.cisco.source_interface}"

After you make changes to that file you need to re-install the pipeline to ES with

filebeat setup --pipelines -E filebeat.overwrite_pipelines=true -e

so your changes take effect. Then you can send some test log lines through and check the result. If the changes work let us know and we can update the module with your changes.

[MarcusCaepio]

Hey @andrewkroh ,
Thanks a lot for the tipps. Today I tried your suggestion and I think, I have created a working pattern. Maybe you want to have a look on the commit in my fork and tell me, if this is ok for a PR?

Thanks in advance.

[adriansr]

@MarcusCaepio , go ahead with the PR. You'll have to make sure that the new fields under cisco are added to module/cisco/asa/_meta/fields.yml and module/cisco/ftd/_meta/fields.yml and maybe you can add an example log line to module/cisco/asa/test.

Instead of cisco.user I think you can use one of the ECS fields, user.name or user.email.

[MarcusCaepio]

Hi @adriansr ,
PR is done. Please ignore my last comment, I just had a thinking mistake :)