Fix: Dissect Cisco ASA 302013 message usernames #21196

C0FFEEC0FFEE · 2020-09-21T10:10:07Z

Fixes ingest pipeline filebeat-7.9.1-cisco-asa-asa-ftd-pipeline to dissect messages of the following format (optional usernames):
Built inbound TCP connection 27215708 for internet:10.2.3.4/49926 (1.2.3.4/49926)(LOCAL\username) to vlan-42:1.2.3.4/80 (1.2.3.4/80) (username)\n

Currently one can only dissect this format:
Built inbound TCP connection 27215708 for internet:10.2.3.4/49926 (1.2.3.4/49926) to vlan-42:1.2.3.4/80 (1.2.3.4/80)\n

elasticmachine · 2020-09-21T10:10:09Z

Since this is a community submitted pull request, a Jenkins build has not been kicked off automatically. Can an Elastic organization member please verify the contents of this patch and then kick off a build manually?

elasticmachine · 2020-09-21T10:10:09Z

Since this is a community submitted pull request, a Jenkins build has not been kicked off automatically. Can an Elastic organization member please verify the contents of this patch and then kick off a build manually?

elasticmachine · 2020-09-21T10:15:07Z

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

Build Cause: andrewkroh commented: run tests
- Start Time: 2021-01-25T15:54:16.540+0000
Duration: 46 min 13 sec
Commit: 7d53226

Test stats 🧪

Test	Results
Failed	0
Passed	5135
Skipped	574
Total	5709

💚 Flaky test report

Tests succeeded.

Expand to view the summary

Test stats 🧪

Test	Results
Failed	0
Passed	5135
Skipped	574
Total	5709

elasticmachine · 2020-09-21T10:24:18Z

Pinging @elastic/siem (Team:SIEM)

botelastic · 2020-10-21T10:36:17Z

Hi!
We just realized that we haven't looked into this PR in a while. We're sorry!

We're labeling this issue as Stale to make it hit our filters and make sure we get back to it in as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1.
Thank you for your contribution!

C0FFEEC0FFEE · 2020-10-21T16:56:49Z

We are using this change for our ASA logs, would be nice if it gets pulled into the official releases. Let me know if you need anything else.

botelastic · 2020-11-20T17:15:34Z

Hi!
We just realized that we haven't looked into this PR in a while. We're sorry!

We're labeling this issue as Stale to make it hit our filters and make sure we get back to it in as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1.
Thank you for your contribution!

C0FFEEC0FFEE · 2020-11-20T20:53:16Z

+1

marc-gr · 2020-12-16T11:00:21Z

jenkins run tests

marc-gr · 2020-12-16T11:54:06Z

@C0FFEEC0FFEE thanks for contributing, could you please update your branch with master? it seems to be outdated

elasticmachine · 2021-01-13T02:07:03Z

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

C0FFEEC0FFEE · 2021-01-13T15:54:51Z

@C0FFEEC0FFEE thanks for contributing, could you please update your branch with master? it seems to be outdated

I updated my branch with master.

andrewkroh · 2021-01-13T21:32:20Z

jenkins run tests

andrewkroh · 2021-01-13T23:34:37Z

This is failing the test suite because it cannot parse the log sample at

module/cisco/asa/test/sample.log:43:Dec 11 2018 08:01:31 <IP>: %ASA-6-302013: Built outbound TCP connection 447236 for outside:192.0.2.222/1234 (192.0.2.222/1234) to dmz:OCSP_Server/5678 (OCSP_Server/5678)

The error is

The related error message is: ['Provided Grok expressions do not match field value: [Built outbound TCP connection 447236 for outside:192.0.2.222/1234 (192.0.2.222/1234) to dmz:OCSP_Server/5678 (OCSP_Server/5678)]']

This allows logs like this to parse %ASA-6-302013: Built outbound TCP connection 447236 for outside:192.0.2.222/1234 (192.0.2.222/1234) to dmz:OCSP_Server/5678 (OCSP_Server/5678)

andrewkroh

I pushed two updates to this PR:

Add a test case with a 302013 log that has the AAA user name.
Change the grok IP fields to NOTSPACE because there was a test case that had OCSP_server as the address value. I'm not sure of the origin of this log sample to know if it is valid.
Removed a test log that had the port value as 80port>. That looked like some kind of developer error when creating sample logs.

My only question is where client.user.name is the correct place for the user name to go.

andrewkroh · 2021-01-14T00:24:09Z

x-pack/filebeat/module/cisco/asa/test/sample.log-expected.json

+        "cisco.asa.message_id": "302013",
+        "cisco.asa.source_interface": "internet",
+        "cisco.asa.source_username": "LOCAL\\username",
+        "client.user.name": "username",


Perhaps this should go to user.name instead?

I'm not sure. Maybe this should go to both client.user.name and user.name, as well as related.user?

In my interpretation of the ECS it fits best to client.user.name since the user initiates a TCP connection:
For TCP events, the client is the initiator of the TCP connection that sends the SYN packet(s). ECS docs

According to https://www.elastic.co/guide/en/ecs/1.x/ecs-user-usage.html:

In order to align with ECS' design of having user at the root of the event as the user performing the action, all source.user fields should be copied to user at the root.

I guess it should be copied to user.name and also kept in client.user.name if we understand client is equivalent to source in here.

PS: what @C0FFEEC0FFEE said, was writing it while you posted it also 😄

Ok, I pushed an update. I think the new user name that is being parsed from this message is actually associated with the destination so I set destination.user.name. Then I set the user.name with that value if it wasn't already set. Then I setup related.user with user.name + destination.user.name (no duplicates).

Copy destination.user.name to user.name. Set related.user to user.name + destination.user.name.

andrewkroh · 2021-01-25T15:53:46Z

run tests

- Add test log containing the AAA user field - Set destination.user.name - Copy destination.user.name to user.name. - Set related.user to user.name + destination.user.name. This allows logs like this to parse %ASA-6-302013: Built outbound TCP connection 447236 for outside:192.0.2.222/1234 (192.0.2.222/1234) to dmz:OCSP_Server/5678 (OCSP_Server/5678) Co-authored-by: Andrew Kroh <andrew.kroh@elastic.co> (cherry picked from commit d6a5f17)

…pack-when-oss-changes * upstream/master: [DOCS] Add setup content to Kubernetes and Cloud Foundry docs (elastic#23580) [CI] Mandatory windows support for all the versions (elastic#23615) Add check when retrieving the worker process id using performance counters (elastic#23647) Remove 4912 evtx from testing (elastic#23669) Add missing SSL settings (elastic#23632) Update X-Pack Packetbeat config (elastic#23666) Use hostname check from verify.go to handle patterns in TLS certs (elastic#23661) Fix: Dissect Cisco ASA 302013 message usernames (elastic#21196) Add FAQ entry for MADV settings in older versions (elastic#23429) Sync fixes from Integration Package Testing (elastic#23424) [Filebeat] Add Cisco ASA message '302023' parsing (elastic#23092) [Elastic Log Driver] Change hosts config flag (elastic#23628) Audit and Authentication Policy Change Events (elastic#20684)

- Add test log containing the AAA user field - Set destination.user.name - Copy destination.user.name to user.name. - Set related.user to user.name + destination.user.name. This allows logs like this to parse %ASA-6-302013: Built outbound TCP connection 447236 for outside:192.0.2.222/1234 (192.0.2.222/1234) to dmz:OCSP_Server/5678 (OCSP_Server/5678) Co-authored-by: Andrew Kroh <andrew.kroh@elastic.co> (cherry picked from commit d6a5f17) Co-authored-by: Michael Koch <mail@kochmichael.com>

botelastic bot added the needs_team Indicates that the issue/PR needs a Team:* label label Sep 21, 2020

andresrc added the Team:SIEM label Sep 21, 2020

botelastic bot removed the needs_team Indicates that the issue/PR needs a Team:* label label Sep 21, 2020

botelastic bot added the Stalled label Oct 21, 2020

botelastic bot removed the Stalled label Oct 21, 2020

dainperkins mentioned this pull request Oct 23, 2020

[Filebeat][Cisco ASA] 7.10 Cisco ASA/FTD Module Issues #22132

Closed

5 tasks

botelastic bot added the Stalled label Nov 20, 2020

botelastic bot removed the Stalled label Nov 20, 2020

marc-gr self-assigned this Dec 16, 2020

andrewkroh added Team:Security-External Integrations and removed Team:SIEM labels Jan 13, 2021

C0FFEEC0FFEE requested review from a team as code owners January 13, 2021 23:52

botelastic bot added the Team:Automation Label for the Observability productivity team label Jan 13, 2021

Fix: Dissect Cisco ASA 302013 message usernames

6423fc2

Use NOTSPACE instead of IP in groks

f70b89a

This allows logs like this to parse %ASA-6-302013: Built outbound TCP connection 447236 for outside:192.0.2.222/1234 (192.0.2.222/1234) to dmz:OCSP_Server/5678 (OCSP_Server/5678)

andrewkroh force-pushed the C0FFEEC0FFEE-patch-1 branch from 17f17ec to f70b89a Compare January 13, 2021 23:53

Add test log containing the AAA user field

c21166d

andrewkroh reviewed Jan 14, 2021

View reviewed changes

andrewkroh added enhancement Filebeat Filebeat and removed Team:Automation Label for the Observability productivity team labels Jan 14, 2021

andrewkroh added 3 commits January 24, 2021 22:10

Set destination.user.name

3dd96c7

Copy destination.user.name to user.name. Set related.user to user.name + destination.user.name.

Add CHANGELOG

bc293a5

Merge branch 'master' into C0FFEEC0FFEE-patch-1

7d53226

andrewkroh approved these changes Jan 25, 2021

View reviewed changes

andrewkroh merged commit d6a5f17 into elastic:master Jan 25, 2021

andrewkroh mentioned this pull request Jan 25, 2021

Cherry-pick #21196 to 7.x: Fix: Dissect Cisco ASA 302013 message usernames #23664

Merged

andrewkroh added the v7.12.0 label Jan 25, 2021

andrewkroh mentioned this pull request Jan 25, 2021

[Filebeat] Fix ASA/FTD Sample Log lines #23526

Closed

1 task

C0FFEEC0FFEE deleted the C0FFEEC0FFEE-patch-1 branch January 27, 2021 08:02

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix: Dissect Cisco ASA 302013 message usernames #21196

Fix: Dissect Cisco ASA 302013 message usernames #21196

C0FFEEC0FFEE commented Sep 21, 2020

elasticmachine commented Sep 21, 2020

elasticmachine commented Sep 21, 2020

elasticmachine commented Sep 21, 2020 •

edited by jenkins-beats-ci bot

Loading

Build stats

Test stats 🧪

Test stats 🧪

elasticmachine commented Sep 21, 2020

botelastic bot commented Oct 21, 2020

C0FFEEC0FFEE commented Oct 21, 2020

botelastic bot commented Nov 20, 2020

C0FFEEC0FFEE commented Nov 20, 2020

marc-gr commented Dec 16, 2020

marc-gr commented Dec 16, 2020

elasticmachine commented Jan 13, 2021

C0FFEEC0FFEE commented Jan 13, 2021

andrewkroh commented Jan 13, 2021

andrewkroh commented Jan 13, 2021

andrewkroh left a comment

andrewkroh Jan 14, 2021

C0FFEEC0FFEE Jan 14, 2021

marc-gr Jan 14, 2021 •

edited

Loading

andrewkroh Jan 25, 2021

andrewkroh commented Jan 25, 2021

Fix: Dissect Cisco ASA 302013 message usernames #21196

Fix: Dissect Cisco ASA 302013 message usernames #21196

Conversation

C0FFEEC0FFEE commented Sep 21, 2020

elasticmachine commented Sep 21, 2020

elasticmachine commented Sep 21, 2020

elasticmachine commented Sep 21, 2020 • edited by jenkins-beats-ci bot Loading

💚 Build Succeeded

Build stats

Test stats 🧪

💚 Flaky test report

Test stats 🧪

elasticmachine commented Sep 21, 2020

botelastic bot commented Oct 21, 2020

C0FFEEC0FFEE commented Oct 21, 2020

botelastic bot commented Nov 20, 2020

C0FFEEC0FFEE commented Nov 20, 2020

marc-gr commented Dec 16, 2020

marc-gr commented Dec 16, 2020

elasticmachine commented Jan 13, 2021

C0FFEEC0FFEE commented Jan 13, 2021

andrewkroh commented Jan 13, 2021

andrewkroh commented Jan 13, 2021

andrewkroh left a comment

Choose a reason for hiding this comment

andrewkroh Jan 14, 2021

Choose a reason for hiding this comment

C0FFEEC0FFEE Jan 14, 2021

Choose a reason for hiding this comment

marc-gr Jan 14, 2021 • edited Loading

Choose a reason for hiding this comment

andrewkroh Jan 25, 2021

Choose a reason for hiding this comment

andrewkroh commented Jan 25, 2021

elasticmachine commented Sep 21, 2020 •

edited by jenkins-beats-ci bot

Loading

marc-gr Jan 14, 2021 •

edited

Loading