[Filebeat][Cisco ASA] Ingress / Egress Interface Mappings (7.10)

[dainperkins]

Based on the test docs in the current 7.10 implementation there's an issue with ingress/egress interface mappings. Firepower may exhibit the same issues.

Message IDs: 303***, 313***, 106***
Teardown UDP connection 110577675 for Outside:10.123.123.123/53723(LOCAL\\Elastic) to Inside:10.233.123.123/53

ingress interface should be Outside, egress interface should be inside

output shows:

        "observer.egress.interface.name": "Outside",
        "observer.ingress.interface.name": "Inside",

Message ID: 313***
Denied IPv6-ICMP type=134, code=0 from fe80::1ff:fe23:4567:890a on interface ISP1'

Single interface references will almost always reference an ingress interface

output shows:

       "observer.egress.interface.name": "ISP1",

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[botelastic]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.