Skip to content

Commit 8a31a6a

Browse files
manan-crestmanan-crest
committed
Update: minor pipeline refactoring
1 parent ee70f0f commit 8a31a6a

File tree

1 file changed

+48
-42
lines changed

1 file changed

+48
-42
lines changed

‎cisco_asa/assets/logs/cisco-asa.yaml‎

Lines changed: 48 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -160,20 +160,23 @@ pipeline:
160160
110002 OR 110003 OR 110004 OR 746001 OR 746002 OR 746003 OR 746005
161161
OR 746007 OR 746016)"
162162
name: firewall
163+
- name: other
164+
filter:
165+
query: "@message_id:*"
163166
target: service
164167
- type: service-remapper
165168
name: Define `service` as the official service of the log
166169
enabled: true
167170
sources:
168171
- service
169172
- type: pipeline
170-
name: Threat Protection
173+
name: Threat Detection
171174
enabled: true
172175
filter:
173176
query: "@message_id:(733100 OR 733102 OR 733103 OR 733104 OR 733105)"
174177
processors:
175178
- type: grok-parser
176-
name: Parse Threat Protection logs
179+
name: Parse Threat Detection Logs
177180
enabled: true
178181
source: message
179182
samples:
@@ -191,20 +194,21 @@ pipeline:
191194
(10.10.10.10/52340). Burst rate of 200 SYNs/sec exceeded the
192195
threshold of 150.
193196
grok:
194-
supportRules: _space %{regex("\\s*")}
197+
supportRules: ""
195198
matchRules: >-
196-
rule_733100 \[%{_space}%{data:object}%{_space}\] drop rate(-|
199+
rule_733100 \[\s*%{regex("[^\\]]*"):object}\] drop rate(-|
197200
)%{number:rate_id} exceeded. Current burst rate is
198-
%{number:current_burst_rate} per second, max configured rate is
199-
%{number:max_configured_burst_rate}; Current average rate is
200-
%{number:current_average_rate} per second, max configured rate is
201+
%{number:current_burst_rate} per (second, max|second_max)
202+
configured rate is %{number:max_configured_burst_rate}; Current
203+
average rate is %{number:current_average_rate} per (second,
204+
max|second_max) configured rate is
201205
%{number:max_configured_average_rate}; Cumulative total count is
202206
%{number:cumulative_total}( \(%{number:received_instances}
203207
instances received\))?
204208
205209
rule_733102_733103 Threat-detection %{word:action} host %{ipOrHost:host} (to|from) shun list
206210
207-
rule_733104_733105 %{word:protocol} Intercept SYN flood attack detected to %{ip:network.destination.ip}/%{port:network.destination.port}%{_space}\(%{ip:network.client.ip}/%{port:network.client.port}\). %{word:rate_type} rate of %{number:rate} %{notSpace:rate_unit} exceeded the threshold of %{number:rate_threshold}
211+
rule_733104_733105 %{word:protocol} Intercept SYN flood attack detected to %{ip:network.destination.ip}/%{port:network.destination.port}\s*\(%{ip:real_ip}/%{port:real_port}\). %{word:rate_type} rate of %{number:rate} %{notSpace:rate_unit} exceeded the threshold of %{number:rate_threshold}
208212
- type: pipeline
209213
name: User Authentication
210214
enabled: true
@@ -231,16 +235,16 @@ pipeline:
231235
supportRules: ""
232236
matchRules: >-
233237
rule_109005_109006 Authentication %{notSpace:evt.outcome} for user
234-
'%{data:usr.name}' from
238+
'%{regex("[^']*"):usr.name}' from
235239
%{ip:network.client.ip}/%{port:network.client.port} to
236240
%{ip:network.destination.ip}/%{port:network.destination.port} on
237241
interface %{data:interface}
238242
239-
rule_109010 Auth from %{ip:network.client.ip}/%{port:network.client.port} to %{ip:network.destination.ip}/%{port:network.destination.port} %{notSpace:evt.outcome} \(%{data:reason}\) on interface %{data:interface}
243+
rule_109010 Auth from %{ip:network.client.ip}/%{port:network.client.port} to %{ip:network.destination.ip}/%{port:network.destination.port} %{notSpace:evt.outcome} \(%{regex("[^\\)]*"):reason}\) on interface %{data:interface}
240244
241-
rule_109023 User from %{ip:network.client.ip}/%{port:network.client.port} to %{ip:network.destination.ip}/%{port:network.destination.port} on interface %{data:interface} using %{data:service_name} must authenticate before using this service
245+
rule_109023 User from %{ip:network.client.ip}/%{port:network.client.port} to %{ip:network.destination.ip}/%{port:network.destination.port} on interface %{regex(".*(?= using )"):interface} using %{regex(".*(?= must authenticate)"):service_name} must authenticate before using this service
242246
243-
rule_109033_109034 Authentication %{notSpace:evt.outcome} for %{notSpace:user_type} user %{data:usr.name} from (%{ip:network.client.ip}|%{ip:network.client.ip}/%{port:network.client.port} to %{ip:network.destination.ip}/%{port:network.destination.port}). Interactive challenge processing is not supported for %{notSpace:protocol}( connections)?
247+
rule_109033_109034 Authentication %{notSpace:evt.outcome} for %{notSpace:user_type} user %{regex(".*(?= from )"):usr.name} from (%{ip:network.client.ip}|%{ip:network.client.ip}/%{port:network.client.port} to %{ip:network.destination.ip}/%{port:network.destination.port}). Interactive challenge processing is not supported for %{notSpace:protocol}( connections)?
244248
- type: pipeline
245249
name: User Authorization
246250
enabled: true
@@ -267,12 +271,12 @@ pipeline:
267271
supportRules: ""
268272
matchRules: >-
269273
rule_109007_109008 Authorization %{word:evt.outcome} for user
270-
'%{data:usr.name}' from
274+
'%{regex("[^']*"):usr.name}' from
271275
%{ip:network.client.ip}/%{port:network.client.port} to
272276
%{ip:network.destination.ip}/%{port:network.destination.port} on
273277
interface %{data:interface}
274278
275-
rule_109024_109025 Authorization %{word:evt.outcome} (\(acl=%{data:acl_id}\) for user '%{data:usr.name}' )?from %{ip:network.client.ip}/%{port:network.client.port} to %{ip:network.destination.ip}/%{port:network.destination.port} (\(not authenticated\) )?on interface %{data:interface} using %{notSpace:protocol}( to)?
279+
rule_109024_109025 Authorization %{word:evt.outcome} (\(acl=%{regex("[^\\)]*"):acl_id}\))?( for user '%{regex("[^']*"):usr.name}' )?from %{ip:network.client.ip}/%{port:network.client.port} to %{ip:network.destination.ip}/%{port:network.destination.port} (\(not authenticated\) )?on interface %{regex(".*(?= using )"):interface} using %{notSpace:protocol}( to)?
276280
- type: pipeline
277281
name: User Management
278282
enabled: true
@@ -292,10 +296,11 @@ pipeline:
292296
privilege_level"
293297
grok:
294298
supportRules: ""
295-
matchRules: "rule_502101_502102_502103 %{data:action}: Uname: %{data:usr.name}
296-
(Priv: %{notSpace:privilege_level} %{data}|From:
299+
matchRules: 'rule_502101_502102_502103 %{regex(".*(?=: Uname)"):action}: Uname:
300+
%{regex(".*(?= (Priv:|From:))"):usr.name} (Priv:
301+
%{notSpace:privilege_level}%{data}|From:
297302
%{notSpace:previous_privilege_level} To:
298-
%{notSpace:new_privilege_level})"
303+
%{notSpace:new_privilege_level})'
299304
- type: pipeline
300305
name: Application Firewall
301306
enabled: true
@@ -324,18 +329,19 @@ pipeline:
324329
requests exceeded drop inside test:10.10.10.10/51822 to
325330
outside:10.10.10.10/443"
326331
grok:
327-
supportRules: _space %{regex("(\\s)*")}
332+
supportRules: _parse_till_colon %{regex(".*(?=\\:)")}
328333
matchRules: >-
329-
rule_415001_415002_415003_415005 HTTP - matched
330-
("%{data:matched_string}"|%{data:matched_string}) in policy-map
331-
%{data:policy_map},%{_space}%{regex("header field count
334+
rule_415001_415002_415003_415005 HTTP - matched ("%{regex(".*(?=\"
335+
in policy-map)"):matched_string}"|%{regex(".*(?= in
336+
policy-map)"):matched_string}) in policy-map
337+
%{regex("[^,]*"):policy_map},\s+%{regex("header field count
332338
exceeded|header field length exceeded|body length exceeded|URI
333339
length exceeded"):reason}
334-
%{notSpace:connection_action}%{_space}%{notSpace:source_interface}:%{ip:network.client.ip}/%{port:network.client.port}
340+
%{notSpace:connection_action}\s+%{_parse_till_colon:source_interface}:%{ip:network.client.ip}/%{port:network.client.port}
335341
to
336-
%{notSpace:destination_interface}:%{ip:network.destination.ip}/%{port:network.destination.port}
342+
%{_parse_till_colon:destination_interface}:%{ip:network.destination.ip}/%{port:network.destination.port}
337343
338-
rule_415013_415016 (HTTP - )?policy-map %{notSpace:policy_map}%{_space}:%{_space}%{regex("Maximum number of unanswered HTTP requests exceeded|Malformed chunked encoding"):reason} %{notSpace:connection_action}%{_space}%{data:source_interface}:%{ip:network.client.ip}/%{port:network.client.port} to %{data:destination_interface}:%{ip:network.destination.ip}/%{port:network.destination.port}
344+
rule_415013_415016 (HTTP - )?policy-map %{regex("[^:]*"):policy_map}\s*:\s*%{regex("Maximum number of unanswered HTTP requests exceeded|Malformed chunked encoding"):reason} %{notSpace:connection_action}\s+%{_parse_till_colon:source_interface}:%{ip:network.client.ip}/%{port:network.client.port} to %{_parse_till_colon:destination_interface}:%{ip:network.destination.ip}/%{port:network.destination.port}
339345
- type: pipeline
340346
name: Transparent Firewall
341347
enabled: true
@@ -356,16 +362,16 @@ pipeline:
356362
zone-new/eth0:192.0.2.5/443(192.0.2.2/1199 ) to
357363
zone-dest/br0:192.0.2.2/1194(192.0.2.7/443 )
358364
grok:
359-
supportRules: _space %{regex("(\\s)*")}
365+
supportRules: _parse_till_colon %{regex(".*(?=\\:)")}
360366
matchRules: >-
361367
rule_110002_110003 %{regex("Failed to locate egress
362368
interface|Routing failed to locate next-hop"):reason} for
363369
%{notSpace:protocol} from
364-
%{data:source_interface}%{_space}:%{ip:network.client.ip}/%{port:network.client.port}
370+
%{_parse_till_colon:source_interface}\s*:%{ip:network.client.ip}/%{port:network.client.port}
365371
to
366-
(%{data:destination_interface}%{_space}:)?%{ip:network.destination.ip}/%{port:network.destination.port}
372+
(%{_parse_till_colon:destination_interface}\s*:)?%{ip:network.destination.ip}/%{port:network.destination.port}
367373
368-
rule_110004 %{regex("Egress interface changed"):reason} from %{data:old_interface} to %{data:new_interface} on %{notSpace:protocol} connection %{number:connection_id} for %{notSpace:outside_interface_zone}%{_space}/%{_space}%{notSpace:outside_interface}%{_space}:%{ip:outside_ip}%{_space}/%{_space}%{port:outside_port}%{_space}\(%{ip:outside_mapped_ip}%{_space}/%{_space}%{port:outside_mapped_port}%{_space}\) to %{notSpace:inside_interface_zone}%{_space}/%{_space}%{notSpace:inside_interface}%{_space}:%{ip:inside_ip}%{_space}/%{_space}%{port:inside_port}%{_space}\(%{ip:inside_mapped_ip}%{_space}/%{_space}%{port:inside_mapped_port}%{_space}\)
374+
rule_110004 %{regex("Egress interface changed"):reason} from %{regex(".*(?= to )"):old_interface} to %{regex(".*(?= on )"):new_interface} on %{notSpace:protocol} connection %{number:connection_id} for %{notSpace:outside_interface_zone}\s*/\s*%{_parse_till_colon:outside_interface}\s*:%{ip:outside_ip}\s*/\s*%{port:outside_port}\s*\(%{ip:outside_mapped_ip}\s*/\s*%{port:outside_mapped_port}\s*\) to %{notSpace:inside_interface_zone}\s*/\s*%{_parse_till_colon:inside_interface}\s*:%{ip:inside_ip}\s*/\s*%{port:inside_port}\s*\(%{ip:inside_mapped_ip}\s*/\s*%{port:inside_mapped_port}\s*\)
369375
- type: pipeline
370376
name: Identity Firewall
371377
enabled: true
@@ -386,17 +392,17 @@ pipeline:
386392
memory"
387393
- "user-identity: identity_lookup_store started"
388394
grok:
389-
supportRules: _space %{regex("(\\s)*"):}
395+
supportRules: ""
390396
matchRules: >-
391397
rule_746005 user-identity: The AD Agent %{ip:network.client.ip}
392398
cannot be reached -
393-
(%{regex("[^\\[]*"):reason}(\[%{_space}%{regex("[^\\]]*"):action}%{_space}\])?|%{data:reason})
399+
(%{regex("[^\\[]*"):reason}(\[\s*regex("[^\\]]*"):action}\s*\])?|%{data:reason})
394400
395-
rule_746007 user-identity: NetBIOS response failed from User %{data:usr.name} at %{ip:network.client.ip}
401+
rule_746007 user-identity: NetBIOS response failed from User %{regex(".*(?= at )"):usr.name} at %{ip:network.client.ip}
396402
397-
rule_746016 user-identity: DNS lookup for %{ip:network.client.ip} failed, reason:%{_space}%{data:reason}
403+
rule_746016 user-identity: DNS lookup for %{ip:network.client.ip} failed, reason:\s+%{data:reason}
398404
399-
rule_746001_746002_746003 user-identity: %{data:database} %{notSpace:download_status}(%{_space}-%{_space}%{data:reason})?
405+
rule_746001_746002_746003 user-identity: %{data:database} %{notSpace:download_status}(\s+-\s+%{data:reason})?
400406
- type: pipeline
401407
name: ARP Collision Insights
402408
enabled: true
@@ -417,9 +423,10 @@ pipeline:
417423
grok:
418424
supportRules: ""
419425
matchRules: rule_405001 Received ARP (request|response) collision from
420-
%{ip:network.client.ip}/%{mac:source_mac_address} on interface
421-
%{data:interface} with existing ARP entry
422-
%{ip:existing_arp_ip}/%{mac:existing_arp_ip_mac_address}
426+
%{ip:network.client.ip}\s*/\s*%{mac:source_mac_address} on
427+
interface %{regex(".*(?= with existing ARP)"):interface} with
428+
existing ARP entry
429+
%{ip:existing_arp_ip}\s*/\s*%{mac:existing_arp_ip_mac_address}
423430
- type: pipeline
424431
name: Connection insights
425432
enabled: true
@@ -442,13 +449,12 @@ pipeline:
442449
- Deny inbound UDP from 192.0.2.10/1194 to 192.0.2.12/1195 on
443450
interface Ethernet0
444451
grok:
445-
supportRules: _space %{regex("\\s*")}
452+
supportRules: ""
446453
matchRules: >-
447454
rule_106001 %{regex("Inbound TCP connection denied"):reason} from
448455
%{ip:network.client.ip}/%{port:network.client.port} to
449456
%{ip:network.destination.ip}/%{port:network.destination.port}
450-
flags %{notSpace:tcp_flag}%{_space}on%{_space}interface
451-
%{data:interface}
457+
flags %{notSpace:tcp_flag}\s+on\s+interface %{data:interface}
452458
453459
rule_106002 %{notSpace:protocol} Connection denied by outbound list %{notSpace:outbound_list} src %{ip:network.client.ip} dest %{ip:network.destination.ip}
454460
@@ -491,15 +497,15 @@ pipeline:
491497
local list: mycoolapp-preview.mock, threat-level: 0, category:
492498
malware"
493499
grok:
494-
supportRules: _space %{regex("\\s*")}
500+
supportRules: _parse_till_colon %{regex(".*(?=:)")}
495501
matchRules: 'rule Dynamic (Filter|filter)
496502
%{regex("monitored|permitted|dropped|denied|action"):action}
497503
%{regex("blacklisted|black listed|whitelisted|white
498504
listed|greylisted|grey listed"):traffic_type} %{notSpace:protocol}
499505
traffic from
500-
%{data:in_interface}:%{ip:network.client.ip}/%{port:network.client.port}%{_space}\(%{ipOrHost:client_mapped_ip}/%{port:client_mapped_port}\)(\))?
506+
%{_parse_till_colon:in_interface}:%{ip:network.client.ip}/%{port:network.client.port}\s*\(%{ipOrHost:client_mapped_ip}/%{port:client_mapped_port}\)(\))?
501507
to
502-
%{data:out_interface}:%{ip:network.destination.ip}/%{port:network.destination.port}%{_space}\(%{ipOrHost:destination_mapped_ip}/%{port:destination_mapped_port}\)(\),|,\),|,)?
508+
%{_parse_till_colon:out_interface}:%{ip:network.destination.ip}/%{port:network.destination.port}\s*\(%{ipOrHost:destination_mapped_ip}/%{port:destination_mapped_port}\)(\),|,\),|,)?
503509
(source|destination)
504510
(%{ip:malicious_address}/%{notSpace:malicious_address_netmask}|%{notSpace:malicious_address})
505511
resolved from %{notSpace:list_type} list:

0 commit comments

Comments
 (0)