This pack uses lookup files to help drop events, suppress events, and extract fields from surviving events. Using lookup files provides a much cleaner management of potentially hundreds, or thousands, of event types.
-
For Splunk Delivery: You can either leave (some of) the fields as index time useful for tstats, accelerated data models, etc. Or you you can re-write _raw as a JSON object with the newly extracted fields. Splunk delivery is set-up in
prep_for_splunk, a pipeline chained from thecisco_asa_cleanuppipeline by default. -
For Elastic Delivery: A lookup is used to translate field naming convention from Splunk CIM to Elastic ECS. This lookup is called from the
prep_for_ECSpipeline, which is optionally chained from thecisco_asa_cleanuppipeline. -
For OCSF Delivery: This pack has now partially incorporated support for the OCSF event schema. OCSF is a new common schema which is also a requirement for leveraging AWS Security Lake.
What to expect: Data have mapped across a variety of inputs, in some cases whole data types have been mapped, and in others only certain events. In this pack the following events have been verified to validate against the OCSF 4001 schema:
- %ASA-1-106103
- %ASA-2-106017
- %ASA-3-313008
- %ASA-4-313009
- %ASA-6-302015
- %ASA-6-302016
- %ASA-6-305012
- %ASA-6-302014
- %ASA-6-302013
- %ASA-6-305011
- %ASA-4-106023
OCSF functionality is disabled by default. To enable it edit the cisco_asa_cleanup pipeline and change the active Chained output option to the OCSF option. Only one of the 3 options should be checked!
Before you activate the Pack on live data:
- The asa_drops.csv file will need to be updated with ASA codes that you do not want
- Format is
asa_code,"comment or memo" - There are 29 codes included by default based on previous experience. YMMV.
- Format is
- The asa_parsing.csv file will need to have codes + regex extractions for the fields you require
- Format is
asa_code,"regex_with_named_capture_group(s)" - The field
_no_matcheswill be added to each event with a regex defined- If no matches are found, it will be
truemeaning the regex failed
- If no matches are found, it will be
- If a regex uses the same named group twice (eg,
(?<group>foo)|(?<group>bar)) you'll need to name the second with _ALT. Eg:group_ALT. This will be undone after extraction automatically. - There are 150+ codes included by default based on previous experience. YMMV.
- We attempted to maintain compliance with the Splunk CIM in naming fields
- Format is
- The asa_suppress.csv file contains ASA codes that should only be allowed 1 event per 30 seconds per worker process
- There are 2 codes included by default based on previous experience. YMMV.
- The splunk2elastic.csv file contains Splunk CIM to ECS field name mappings
- Not every field name in either model is covered
- This lookup is used in the prep_for_ECS pipeline
- The
prep_for_ECSpipeline will create nested objects for names with periods in them
You're encouraged to add to the included CSVs and submit a pull request.
There is a group for handling events that require special attention. These rules fall outside of what can be handled in the parsing CSV lookup file. This is includes some events that require flipping src and dest fields.
Fields extracted are placed at the top level of the event (eg, metadata or index time field). You can choose to:
- Reserialize them, replacing _raw with a JSON payload of selected events
- Leave _raw alone and keep some fields (as index time data)
- Use the
prep_for_ECSpipeline to translate them to ECS naming conventions and format
If you do not require field extractions consider adding the Final Flag to the Eval rule marked as such. You'll get the benefit of volume reduction, and the option to drop unneeded events based on the drops CSV, but you'll save resources of running extractions that go unused.
- Install (Packs -> Add New -> Add from Dispensary)
- Inspect the optional pipeline rules and select accordingly
- In particular, mind the output options at the end of the pipeline
- Download and install a GeoIP db if GeoIP enhancement is desired (see maxmind.com)
- Modify the lookup files as required for your needs (provided entries may or may not meet your needs)
- We recommend you download the lookup files to your local system and manage versioning there. Re-upload the files when modified.
- Point your Cisco ASA log stream to the Pack and an appropriate destination
- If your ASA logs come in on a dedicated source, you can apply the pack as a pre-processing pipeline
- Repaired bad regex for 106021, 106022 and 313004
- Added 302020 and 302021 (Thanks @Paul Stout)
- Grouped the dest/src flip together with other Exceptions
- Added exception for 430001-5 events which have variable formatting in "Key: Value" pairs
- Shout out to Slack user @Brenden
- For codes 302013, 302015, 302020, 302021, 602303, 602304, and 702307 we now reverse src and dest fields if the direction is outbound
- See the Flip dest/src fields group
- Shout out to Slack user @Brenden for identifying the mistake
- Fixed 419002: Cisco's docs don't match logs found in the wild, updated regex to work with both
- Added 430002 (thanks @Walter in Cribl Slack!)
- Fixed 106015 to be more permissive of optional interface field
- Fixed 305011 which had bad regex, missing a closing `>`
- host was mistakenly left out of the Splunk delivery pipeline
- Sample filename was wrong
- Added initial/test OCSF support
- Fixed patterns for 313008, 313009, 106023, 305011
- Fixed a typo in the ASA-6-305011 parsing regex
- Added ASA-6-305012 parsing regex
- Added ASA-201009 to parsing file
- Fixed typo is csv lookup file for ASA code 313009 (h/t @olauret)
- Readme file was munged up. No functional changes.
- Fixed bad regex for 106100, 106102 -- missing backslash before right bracket in last group
- The people responsible for the sacking have now been sacked
- Dummy release to fix bad packaging
- Added many codes to parsing lookup from the Elastic ASA package
- Added a pipeline to translate Splunk CIM fields to ECS fields
- Adjusted main pipeline to Chain either the pre_for_splunk or prep_for_ECS pipeline
- Added 199015,199016,199017,199018,313001,313004 to drops
- Added 111007,111008,111010,113005,315011,414003,414004,606001,606002,606003,606004,711004 to parsing
Replaced wonky aggregation function with straight suppression. So much cleaner. Version bumped to 1.0.
fixed bad extract for a few parse lookups
Cleaned up and added some new codes to drop and supress lookups; fixed bad extract for a few parse lookups; added optional aggregation based suppression; updated this doc
Fixed bad asa_code extract; added option to keep _raw as is; cleaned up docs
Serialize option added, suppression added with one sample code
Added readme, and image
1st release
To contribute to the Pack, contact Jon Rust [email protected]
To contact us please email [email protected].
This Pack uses the following license: Apache 2.0.