Skip to content

Commit d6a5f17

Browse files
C0FFEEC0FFEEandrewkroh
C0FFEEC0FFEE
and
andrewkroh
authored
Fix: Dissect Cisco ASA 302013 message usernames (#21196)
- Add test log containing the AAA user field - Set destination.user.name - Copy destination.user.name to user.name. - Set related.user to user.name + destination.user.name. This allows logs like this to parse %ASA-6-302013: Built outbound TCP connection 447236 for outside:192.0.2.222/1234 (192.0.2.222/1234) to dmz:OCSP_Server/5678 (OCSP_Server/5678) Co-authored-by: Andrew Kroh <andrew.kroh@elastic.co>
1 parent 364da7c commit d6a5f17

6 files changed

Lines changed: 147 additions & 66 deletions

File tree

‎CHANGELOG.next.asciidoc‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -823,6 +823,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
823823
- Added support for first_event context in filebeat httpjson input {pull}23437[23437]
824824
- Add parsing of tcp flags to AWS vpcflow fileset {issue}228020[22820] {pull}23157[23157]
825825
- Added `alternative_host` option to google pubsub input {pull}23215[23215]
826+
- Added username parsing from Cisco ASA message 302013. {pull}21196[21196]
826827
- Added `encode_as` and `decode_as` options to httpjson along with pluggable encoders/decoders {pull}23478[23478]
827828
- Added `application/x-ndjson` as decode option for httpjson input {pull}23521[23521]
828829
- Added `application/x-www-form-urlencoded` as encode option for httpjson input {pull}23521[23521]

‎x-pack/filebeat/module/cisco/asa/test/sample.log‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,6 @@ Apr 30 2013 09:23:43: %ASA-5-106100: access-list acl_in est-allowed tcp inside/1
3838
Apr 30 2013 09:23:43: %ASA-5-106100: access-list acl_in est-allowed tcp inside/10.0.0.16(2013) -> outside/192.0.0.89(2000) hit-cnt 1 first hit [0x71a87d94, 0x0]
3939
Apr 15 2018 09:34:34 EDT: %ASA-session-5-106100: access-list acl_in permitted tcp inside/10.0.0.16(2241) -> outside/192.0.0.99(2000) hit-cnt 1 first hit [0x71a87d94, 0x0]
4040
Dec 11 2018 08:01:24 <IP>: %ASA-6-302015: Built outbound UDP connection 447235 for outside:192.168.77.12/11180 (192.168.77.12/11180) to identity:10.0.13.13/80 (10.0.13.13/80)
41-
Dec 11 2018 08:01:24 <IP>: %ASA-6-302015: Built outbound UDP connection 447235 for outside:192.168.77.12/11180 (192.168.77.12/11180) to identity:10.0.13.13/80port> (10.0.13.13/80)
4241
Dec 11 2018 08:01:24 <IP>: %ASA-4-106023: Deny udp src dmz:192.168.1.33/5555 dst outside:192.0.0.12/53 by access-group "dmz" [0x123a465e, 0x4c7bf613]
4342
Dec 11 2018 08:01:24 <IP>: %ASA-4-106023: Deny udp src dmz:192.168.1.33/5555 dst outside:192.0.0.12/53 by access-group "dmz" [0x123a465e, 0x4c7bf613]
4443
Dec 11 2018 08:01:31 <IP>: %ASA-6-302013: Built outbound TCP connection 447236 for outside:192.0.2.222/1234 (192.0.2.222/1234) to dmz:OCSP_Server/5678 (OCSP_Server/5678)
@@ -70,3 +69,4 @@ Jan 14 2015 13:16:14: %ASA-4-338008: Dynamic Filter dropped blacklisted TCP traf
7069
Nov 16 2009 14:12:35: %ASA-5-304001: 10.30.30.30 Accessed URL 192.0.2.1:/app
7170
Nov 16 2009 14:12:36: %ASA-5-304001: 10.5.111.32 Accessed URL 192.0.2.32:http://example.com
7271
Nov 16 2009 14:12:37: %ASA-5-304002: Access denied URL http://www.example.net/images/favicon.ico SRC 10.69.6.39 DEST 192.0.0.19 on interface inside
72+
Jan 13 2021 19:12:37: %ASA-6-302013: Built inbound TCP connection 27215708 for internet:10.2.3.4/49926 (1.2.3.4/49926)(LOCAL\username) to vlan-42:1.2.3.4/80 (1.2.3.4/80) (username)

‎x-pack/filebeat/module/cisco/asa/test/sample.log-expected.json‎

Lines changed: 99 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -2049,7 +2049,7 @@
20492049
"input.type": "log",
20502050
"log.file.path": "sample.log",
20512051
"log.level": "warning",
2052-
"log.offset": 6318,
2052+
"log.offset": 6138,
20532053
"network.iana_number": 17,
20542054
"network.transport": "udp",
20552055
"observer.egress.interface.name": "dmz",
@@ -2100,7 +2100,7 @@
21002100
"input.type": "log",
21012101
"log.file.path": "sample.log",
21022102
"log.level": "warning",
2103-
"log.offset": 6468,
2103+
"log.offset": 6288,
21042104
"network.iana_number": 17,
21052105
"network.transport": "udp",
21062106
"observer.egress.interface.name": "dmz",
@@ -2153,7 +2153,7 @@
21532153
"input.type": "log",
21542154
"log.file.path": "sample.log",
21552155
"log.level": "informational",
2156-
"log.offset": 6618,
2156+
"log.offset": 6438,
21572157
"network.direction": "outbound",
21582158
"network.iana_number": 6,
21592159
"network.transport": "tcp",
@@ -2209,7 +2209,7 @@
22092209
"input.type": "log",
22102210
"log.file.path": "sample.log",
22112211
"log.level": "informational",
2212-
"log.offset": 6788,
2212+
"log.offset": 6608,
22132213
"network.direction": "outbound",
22142214
"network.iana_number": 6,
22152215
"network.transport": "tcp",
@@ -2265,7 +2265,7 @@
22652265
"input.type": "log",
22662266
"log.file.path": "sample.log",
22672267
"log.level": "informational",
2268-
"log.offset": 6958,
2268+
"log.offset": 6778,
22692269
"network.bytes": 14804,
22702270
"network.iana_number": 6,
22712271
"network.transport": "tcp",
@@ -2319,7 +2319,7 @@
23192319
"input.type": "log",
23202320
"log.file.path": "sample.log",
23212321
"log.level": "informational",
2322-
"log.offset": 7123,
2322+
"log.offset": 6943,
23232323
"network.bytes": 134781,
23242324
"network.iana_number": 6,
23252325
"network.transport": "tcp",
@@ -2373,7 +2373,7 @@
23732373
"input.type": "log",
23742374
"log.file.path": "sample.log",
23752375
"log.level": "informational",
2376-
"log.offset": 7289,
2376+
"log.offset": 7109,
23772377
"network.bytes": 134781,
23782378
"network.iana_number": 6,
23792379
"network.transport": "tcp",
@@ -2422,7 +2422,7 @@
24222422
"input.type": "log",
24232423
"log.file.path": "sample.log",
24242424
"log.level": "informational",
2425-
"log.offset": 7455,
2425+
"log.offset": 7275,
24262426
"network.transport": "(no",
24272427
"observer.egress.interface.name": "outside",
24282428
"observer.product": "asa",
@@ -2468,7 +2468,7 @@
24682468
"input.type": "log",
24692469
"log.file.path": "sample.log",
24702470
"log.level": "informational",
2471-
"log.offset": 7597,
2471+
"log.offset": 7417,
24722472
"network.transport": "(no",
24732473
"observer.egress.interface.name": "outside",
24742474
"observer.product": "asa",
@@ -2517,7 +2517,7 @@
25172517
"input.type": "log",
25182518
"log.file.path": "sample.log",
25192519
"log.level": "warning",
2520-
"log.offset": 7739,
2520+
"log.offset": 7559,
25212521
"network.iana_number": 17,
25222522
"network.transport": "udp",
25232523
"observer.egress.interface.name": "dmz",
@@ -2570,7 +2570,7 @@
25702570
"input.type": "log",
25712571
"log.file.path": "sample.log",
25722572
"log.level": "informational",
2573-
"log.offset": 7890,
2573+
"log.offset": 7710,
25742574
"network.direction": "outbound",
25752575
"network.iana_number": 6,
25762576
"network.transport": "tcp",
@@ -2624,7 +2624,7 @@
26242624
"input.type": "log",
26252625
"log.file.path": "sample.log",
26262626
"log.level": "informational",
2627-
"log.offset": 8064,
2627+
"log.offset": 7884,
26282628
"network.direction": "outbound",
26292629
"network.iana_number": 6,
26302630
"network.transport": "tcp",
@@ -2678,7 +2678,7 @@
26782678
"input.type": "log",
26792679
"log.file.path": "sample.log",
26802680
"log.level": "informational",
2681-
"log.offset": 8238,
2681+
"log.offset": 8058,
26822682
"network.bytes": 11420,
26832683
"network.iana_number": 6,
26842684
"network.transport": "tcp",
@@ -2732,7 +2732,7 @@
27322732
"input.type": "log",
27332733
"log.file.path": "sample.log",
27342734
"log.level": "informational",
2735-
"log.offset": 8403,
2735+
"log.offset": 8223,
27362736
"network.bytes": 1416,
27372737
"network.iana_number": 17,
27382738
"network.transport": "udp",
@@ -2781,7 +2781,7 @@
27812781
"input.type": "log",
27822782
"log.file.path": "sample.log",
27832783
"log.level": "critical",
2784-
"log.offset": 8545,
2784+
"log.offset": 8365,
27852785
"observer.egress.interface.name": "Mobile_Traffic",
27862786
"observer.hostname": "GIFRCHN01",
27872787
"observer.product": "asa",
@@ -2829,7 +2829,7 @@
28292829
"input.type": "log",
28302830
"log.file.path": "sample.log",
28312831
"log.level": "critical",
2832-
"log.offset": 8666,
2832+
"log.offset": 8486,
28332833
"observer.egress.interface.name": "Mobile_Traffic",
28342834
"observer.hostname": "GIFRCHN01",
28352835
"observer.product": "asa",
@@ -2877,7 +2877,7 @@
28772877
"input.type": "log",
28782878
"log.file.path": "sample.log",
28792879
"log.level": "critical",
2880-
"log.offset": 8787,
2880+
"log.offset": 8607,
28812881
"observer.egress.interface.name": "Mobile_Traffic",
28822882
"observer.hostname": "GIFRCHN01",
28832883
"observer.product": "asa",
@@ -2925,7 +2925,7 @@
29252925
"input.type": "log",
29262926
"log.file.path": "sample.log",
29272927
"log.level": "critical",
2928-
"log.offset": 8908,
2928+
"log.offset": 8728,
29292929
"observer.egress.interface.name": "Mobile_Traffic",
29302930
"observer.hostname": "GIFRCHN01",
29312931
"observer.product": "asa",
@@ -2973,7 +2973,7 @@
29732973
"input.type": "log",
29742974
"log.file.path": "sample.log",
29752975
"log.level": "critical",
2976-
"log.offset": 9029,
2976+
"log.offset": 8849,
29772977
"observer.egress.interface.name": "Mobile_Traffic",
29782978
"observer.hostname": "GIFRCHN01",
29792979
"observer.product": "asa",
@@ -3021,7 +3021,7 @@
30213021
"input.type": "log",
30223022
"log.file.path": "sample.log",
30233023
"log.level": "critical",
3024-
"log.offset": 9150,
3024+
"log.offset": 8970,
30253025
"observer.egress.interface.name": "Mobile_Traffic",
30263026
"observer.hostname": "GIFRCHN01",
30273027
"observer.product": "asa",
@@ -3069,7 +3069,7 @@
30693069
"input.type": "log",
30703070
"log.file.path": "sample.log",
30713071
"log.level": "critical",
3072-
"log.offset": 9271,
3072+
"log.offset": 9091,
30733073
"observer.egress.interface.name": "Mobile_Traffic",
30743074
"observer.hostname": "GIFRCHN01",
30753075
"observer.product": "asa",
@@ -3117,7 +3117,7 @@
31173117
"input.type": "log",
31183118
"log.file.path": "sample.log",
31193119
"log.level": "critical",
3120-
"log.offset": 9393,
3120+
"log.offset": 9213,
31213121
"observer.egress.interface.name": "Mobile_Traffic",
31223122
"observer.hostname": "GIFRCHN01",
31233123
"observer.product": "asa",
@@ -3168,7 +3168,7 @@
31683168
"input.type": "log",
31693169
"log.file.path": "sample.log",
31703170
"log.level": "warning",
3171-
"log.offset": 9515,
3171+
"log.offset": 9335,
31723172
"network.iana_number": 6,
31733173
"network.transport": "tcp",
31743174
"observer.egress.interface.name": "outside",
@@ -3220,7 +3220,7 @@
32203220
"input.type": "log",
32213221
"log.file.path": "sample.log",
32223222
"log.level": "error",
3223-
"log.offset": 9669,
3223+
"log.offset": 9489,
32243224
"network.iana_number": 1,
32253225
"network.transport": "icmp",
32263226
"observer.egress.interface.name": "Outside",
@@ -3269,7 +3269,7 @@
32693269
"input.type": "log",
32703270
"log.file.path": "sample.log",
32713271
"log.level": "warning",
3272-
"log.offset": 9779,
3272+
"log.offset": 9599,
32733273
"network.iana_number": 1,
32743274
"network.transport": "icmp",
32753275
"observer.egress.interface.name": "inside",
@@ -3322,7 +3322,7 @@
33223322
"input.type": "log",
33233323
"log.file.path": "sample.log",
33243324
"log.level": "warning",
3325-
"log.offset": 9915,
3325+
"log.offset": 9735,
33263326
"network.iana_number": 6,
33273327
"network.transport": "tcp",
33283328
"observer.egress.interface.name": "inside",
@@ -3383,7 +3383,7 @@
33833383
"input.type": "log",
33843384
"log.file.path": "sample.log",
33853385
"log.level": "warning",
3386-
"log.offset": 10166,
3386+
"log.offset": 9986,
33873387
"network.iana_number": 6,
33883388
"network.transport": "tcp",
33893389
"observer.egress.interface.name": "inside",
@@ -3440,7 +3440,7 @@
34403440
"input.type": "log",
34413441
"log.file.path": "sample.log",
34423442
"log.level": "warning",
3443-
"log.offset": 10465,
3443+
"log.offset": 10285,
34443444
"network.iana_number": 6,
34453445
"network.transport": "tcp",
34463446
"observer.egress.interface.name": "inside",
@@ -3487,7 +3487,7 @@
34873487
"input.type": "log",
34883488
"log.file.path": "sample.log",
34893489
"log.level": "notification",
3490-
"log.offset": 10762,
3490+
"log.offset": 10582,
34913491
"observer.product": "asa",
34923492
"observer.type": "firewall",
34933493
"observer.vendor": "Cisco",
@@ -3529,7 +3529,7 @@
35293529
"input.type": "log",
35303530
"log.file.path": "sample.log",
35313531
"log.level": "notification",
3532-
"log.offset": 10839,
3532+
"log.offset": 10659,
35333533
"observer.product": "asa",
35343534
"observer.type": "firewall",
35353535
"observer.vendor": "Cisco",
@@ -3572,7 +3572,7 @@
35723572
"input.type": "log",
35733573
"log.file.path": "sample.log",
35743574
"log.level": "notification",
3575-
"log.offset": 10931,
3575+
"log.offset": 10751,
35763576
"observer.egress.interface.name": "inside",
35773577
"observer.product": "asa",
35783578
"observer.type": "firewall",
@@ -3589,5 +3589,73 @@
35893589
"forwarded"
35903590
],
35913591
"url.original": "http://www.example.net/images/favicon.ico"
3592+
},
3593+
{
3594+
"@timestamp": "2021-01-13T19:12:37.000-02:00",
3595+
"cisco.asa.connection_id": "27215708",
3596+
"cisco.asa.destination_interface": "vlan-42",
3597+
"cisco.asa.mapped_destination_ip": "1.2.3.4",
3598+
"cisco.asa.mapped_destination_port": 80,
3599+
"cisco.asa.mapped_source_ip": "1.2.3.4",
3600+
"cisco.asa.mapped_source_port": 49926,
3601+
"cisco.asa.message_id": "302013",
3602+
"cisco.asa.source_interface": "internet",
3603+
"cisco.asa.source_username": "LOCAL\\username",
3604+
"destination.address": "1.2.3.4",
3605+
"destination.geo.city_name": "Moscow",
3606+
"destination.geo.continent_name": "Europe",
3607+
"destination.geo.country_iso_code": "RU",
3608+
"destination.geo.country_name": "Russia",
3609+
"destination.geo.location.lat": 55.7527,
3610+
"destination.geo.location.lon": 37.6172,
3611+
"destination.geo.region_iso_code": "RU-MOW",
3612+
"destination.geo.region_name": "Moscow",
3613+
"destination.ip": "1.2.3.4",
3614+
"destination.port": 80,
3615+
"destination.user.name": "username",
3616+
"event.action": "firewall-rule",
3617+
"event.category": [
3618+
"network"
3619+
],
3620+
"event.code": 302013,
3621+
"event.dataset": "cisco.asa",
3622+
"event.kind": "event",
3623+
"event.module": "cisco",
3624+
"event.original": "%ASA-6-302013: Built inbound TCP connection 27215708 for internet:10.2.3.4/49926 (1.2.3.4/49926)(LOCAL\\username) to vlan-42:1.2.3.4/80 (1.2.3.4/80) (username)",
3625+
"event.severity": 6,
3626+
"event.timezone": "-02:00",
3627+
"event.type": [
3628+
"info"
3629+
],
3630+
"fileset.name": "asa",
3631+
"input.type": "log",
3632+
"log.file.path": "sample.log",
3633+
"log.level": "informational",
3634+
"log.offset": 10899,
3635+
"network.direction": "inbound",
3636+
"network.iana_number": 6,
3637+
"network.transport": "tcp",
3638+
"observer.egress.interface.name": "internet",
3639+
"observer.ingress.interface.name": "vlan-42",
3640+
"observer.product": "asa",
3641+
"observer.type": "firewall",
3642+
"observer.vendor": "Cisco",
3643+
"related.ip": [
3644+
"10.2.3.4",
3645+
"1.2.3.4"
3646+
],
3647+
"related.user": [
3648+
"username"
3649+
],
3650+
"service.type": "cisco",
3651+
"source.address": "10.2.3.4",
3652+
"source.ip": "10.2.3.4",
3653+
"source.nat.ip": "1.2.3.4",
3654+
"source.port": 49926,
3655+
"tags": [
3656+
"cisco-asa",
3657+
"forwarded"
3658+
],
3659+
"user.name": "username"
35923660
}
35933661
]

‎x-pack/filebeat/module/cisco/ftd/test/sample.log‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,6 @@ Apr 30 2013 09:23:43: %FTD-5-106100: access-list acl_in est-allowed tcp inside/1
3838
Apr 30 2013 09:23:43: %FTD-5-106100: access-list acl_in est-allowed tcp inside/10.0.0.16(2013) -> outside/192.0.0.89(2000) hit-cnt 1 first hit [0x71a87d94, 0x0]
3939
Apr 15 2018 09:34:34 EDT: %FTD-session-5-106100: access-list acl_in permitted tcp inside/10.0.0.16(2241) -> outside/192.0.0.99(2000) hit-cnt 1 first hit [0x71a87d94, 0x0]
4040
Dec 11 2018 08:01:24 127.0.0.1: %FTD-6-302015: Built outbound UDP connection 447235 for outside:192.168.77.12/11180 (192.168.77.12/11180) to identity:10.0.13.13/80 (10.0.13.13/80)
41-
Dec 11 2018 08:01:24 127.0.0.1: %FTD-6-302015: Built outbound UDP connection 447235 for outside:192.168.77.12/11180 (192.168.77.12/11180) to identity:10.0.13.13/80port> (10.0.13.13/80)
4241
Dec 11 2018 08:01:24 127.0.0.1: %FTD-4-106023: Deny udp src dmz:192.168.1.33/5555 dst outside:192.0.0.12/53 by access-group "dmz" [0x123a465e, 0x4c7bf613]
4342
Dec 11 2018 08:01:24 127.0.0.1: %FTD-4-106023: Deny udp src dmz:192.168.1.33/5555 dst outside:192.0.0.12/53 by access-group "dmz" [0x123a465e, 0x4c7bf613]
4443
Dec 11 2018 08:01:31 127.0.0.1: %FTD-6-302013: Built outbound TCP connection 447236 for outside:192.0.2.222/1234 (192.0.2.222/1234) to dmz:OCSP_Server/5678 (OCSP_Server/5678)

0 commit comments

Comments
 (0)