Skip to content

Commit 3cf5c09

Browse files
mjwolfagithomas
mjwolf
authored and
agithomas
committed
[citrix_adc] Parse addition message formats (elastic#15598)
Add grok parsing patterns for grok_sslvpn_clisec_check and grok_sslvpn_clisec_exp_eval to handle additional message formats, and add test cases to cover the additional formats.
1 parent 1375638 commit 3cf5c09

File tree

5 files changed

+258
-1
lines changed

5 files changed

+258
-1
lines changed

‎packages/citrix_adc/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "1.17.3"
3+
changes:
4+
- description: "Add support for additional log format patterns in sslvpn_clisec"
5+
type: bugfix
6+
link: https://github.com/elastic/integrations/pull/15598
27
- version: "1.17.2"
38
changes:
49
- description: "Fix grok processing for HTTPREQUEST and UDPFLOWSTAT in sslvpn_and_aaatm_feature pipeline with optional patterns."

‎packages/citrix_adc/data_stream/log/_dev/test/pipeline/test-citrix-waf-native-14-1.log‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,5 @@
11
<134> 11/18/2024:11:11:00 GMT DCLVNSGP001 0-PPE-1 : default SSLVPN HTTPREQUEST 12345678 0 : [TECHSUPPORT][ENUMERATION] some.url.com User [email protected] : Group(s) N/A : Vserver 0.0.0.0:300 - 09/04/2025:18:24:45 GMT : Message = SSO is OFF : GET /path/path.xml - -
22
<134> 09/04/2025:18:24:36 GMT DCLVNSGP001 0-PPE-6 : default SSLVPN UDPFLOWSTAT 58680561 0 : [TECHSUPPORT] User username.example.com - Client_ip 175.16.199.1 - Nat_ip 89.160.20.129 - Vserver 67.43.156.1:443 - Source 81.2.69.194:63685 - Destination 1.128.0.1:53 - Start_time "09/09/2024:20:44:03 GMT" - End_time "09/09/2024:20:46:06 GMT" - Duration 00:05:53 - Total_bytes_send 656 - Total_bytes_recv 2456 - Access Allowed - Group(s) "N/A"
3+
<135> 10/03/2025:14:06:57 GMT PRODSYST001 0-PPE-4 : default SSLVPN CLISEC_EXP_EVAL 249891628 0 : CaseID cbed1: - Client IP 192.0.2.0 - Vserver 198.51.100.2:443 - Client security check CLIENT.APPLICATION('ANTIVIR_9398_3882_RTP_==_TRUE[COMMENT: Cortex XDR]') EXISTS PASSED(0) on the client machine
4+
<135> 10/03/2025:14:06:57 GMT PRODSYST001 0-PPE-4 : default SSLVPN CLISEC_EXP_EVAL 249891629 0 : CaseID cbed1: - Client IP 192.0.2.0 - Vserver 198.51.100.2:443 - Client security check CLIENT.SYSTEM('DOMAIN_SUFFIX_anyof_example.com.jp[COMMENT: Domain check]') EXISTS PASSED(0) on the client machine
5+
<135> 10/03/2025:13:52:23 GMT PRODSYST001 0-PPE-7 : default SSLVPN CLISEC_CHECK 248708109 0 : CaseID: f0ce9 - Client IP 192.0.2.0 - Vserver 198.51.100.2:443 - Client_security_expression "CLIENT.SYSTEM('DOMAIN_SUFFIX_anyof_example.com.jp[COMMENT: Domain check]') EXISTS && CLIENT.APPLICATION('ANTIVIR_1346_3064_RTP_==_TRUE[COMMENT: Cortex XDR]') EXISTS" - Client_security_check passed

‎packages/citrix_adc/data_stream/log/_dev/test/pipeline/test-citrix-waf-native-14-1.log-expected.json‎

Lines changed: 247 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -216,6 +216,253 @@
216216
"user": {
217217
"name": "username.example.com"
218218
}
219+
},
220+
{
221+
"@timestamp": "2025-10-03T14:06:57.000Z",
222+
"citrix": {
223+
"cef_format": false,
224+
"default_class": true,
225+
"detail": "<135> 10/03/2025:14:06:57 GMT PRODSYST001 0-PPE-4 : default SSLVPN CLISEC_EXP_EVAL 249891628 0 : CaseID cbed1: - Client IP 192.0.2.0 - Vserver 198.51.100.2:443 - Client security check CLIENT.APPLICATION('ANTIVIR_9398_3882_RTP_==_TRUE[COMMENT: Cortex XDR]') EXISTS PASSED(0) on the client machine",
226+
"device_event_class_id": "SSLVPN",
227+
"extended": {
228+
"message": "CaseID cbed1: - Client IP 192.0.2.0 - Vserver 198.51.100.2:443 - Client security check CLIENT.APPLICATION('ANTIVIR_9398_3882_RTP_==_TRUE[COMMENT: Cortex XDR]') EXISTS PASSED(0) on the client machine"
229+
},
230+
"host": "PRODSYST001",
231+
"name": "CLISEC_EXP_EVAL"
232+
},
233+
"citrix_adc": {
234+
"log": {
235+
"client_ip": "192.0.2.0",
236+
"client_security_check_status": "PASSED(0)",
237+
"message": "CaseID cbed1: - Client IP 192.0.2.0 - Vserver 198.51.100.2:443 - Client security check CLIENT.APPLICATION('ANTIVIR_9398_3882_RTP_==_TRUE[COMMENT: Cortex XDR]') EXISTS PASSED(0) on the client machine",
238+
"vserver": {
239+
"ip": "198.51.100.2",
240+
"port": 443
241+
}
242+
}
243+
},
244+
"client": {
245+
"as": {
246+
"number": 64500,
247+
"organization": {
248+
"name": "Documentation ASN"
249+
}
250+
},
251+
"geo": {
252+
"city_name": "Las Vegas",
253+
"continent_name": "North America",
254+
"country_iso_code": "US",
255+
"country_name": "United States",
256+
"location": {
257+
"lat": 36.17497,
258+
"lon": -115.13722
259+
},
260+
"region_iso_code": "US-NV",
261+
"region_name": "Nevada"
262+
},
263+
"ip": "192.0.2.0"
264+
},
265+
"ecs": {
266+
"version": "8.11.0"
267+
},
268+
"event": {
269+
"category": [
270+
"authentication"
271+
],
272+
"id": "249891628",
273+
"kind": "event",
274+
"original": "<135> 10/03/2025:14:06:57 GMT PRODSYST001 0-PPE-4 : default SSLVPN CLISEC_EXP_EVAL 249891628 0 : CaseID cbed1: - Client IP 192.0.2.0 - Vserver 198.51.100.2:443 - Client security check CLIENT.APPLICATION('ANTIVIR_9398_3882_RTP_==_TRUE[COMMENT: Cortex XDR]') EXISTS PASSED(0) on the client machine",
275+
"severity": 0,
276+
"timezone": "GMT",
277+
"type": [
278+
"info"
279+
]
280+
},
281+
"observer": {
282+
"hostname": "PRODSYST001",
283+
"product": "Netscaler",
284+
"type": "firewall",
285+
"vendor": "Citrix"
286+
},
287+
"related": {
288+
"ip": [
289+
"198.51.100.2",
290+
"192.0.2.0"
291+
]
292+
},
293+
"server": {
294+
"ip": "198.51.100.2",
295+
"port": 443
296+
},
297+
"tags": [
298+
"preserve_original_event",
299+
"preserve_duplicate_custom_fields"
300+
]
301+
},
302+
{
303+
"@timestamp": "2025-10-03T14:06:57.000Z",
304+
"citrix": {
305+
"cef_format": false,
306+
"default_class": true,
307+
"detail": "<135> 10/03/2025:14:06:57 GMT PRODSYST001 0-PPE-4 : default SSLVPN CLISEC_EXP_EVAL 249891629 0 : CaseID cbed1: - Client IP 192.0.2.0 - Vserver 198.51.100.2:443 - Client security check CLIENT.SYSTEM('DOMAIN_SUFFIX_anyof_example.com.jp[COMMENT: Domain check]') EXISTS PASSED(0) on the client machine",
308+
"device_event_class_id": "SSLVPN",
309+
"extended": {
310+
"message": "CaseID cbed1: - Client IP 192.0.2.0 - Vserver 198.51.100.2:443 - Client security check CLIENT.SYSTEM('DOMAIN_SUFFIX_anyof_example.com.jp[COMMENT: Domain check]') EXISTS PASSED(0) on the client machine"
311+
},
312+
"host": "PRODSYST001",
313+
"name": "CLISEC_EXP_EVAL"
314+
},
315+
"citrix_adc": {
316+
"log": {
317+
"client_ip": "192.0.2.0",
318+
"client_security_check_status": "PASSED(0)",
319+
"message": "CaseID cbed1: - Client IP 192.0.2.0 - Vserver 198.51.100.2:443 - Client security check CLIENT.SYSTEM('DOMAIN_SUFFIX_anyof_example.com.jp[COMMENT: Domain check]') EXISTS PASSED(0) on the client machine",
320+
"vserver": {
321+
"ip": "198.51.100.2",
322+
"port": 443
323+
}
324+
}
325+
},
326+
"client": {
327+
"as": {
328+
"number": 64500,
329+
"organization": {
330+
"name": "Documentation ASN"
331+
}
332+
},
333+
"geo": {
334+
"city_name": "Las Vegas",
335+
"continent_name": "North America",
336+
"country_iso_code": "US",
337+
"country_name": "United States",
338+
"location": {
339+
"lat": 36.17497,
340+
"lon": -115.13722
341+
},
342+
"region_iso_code": "US-NV",
343+
"region_name": "Nevada"
344+
},
345+
"ip": "192.0.2.0"
346+
},
347+
"ecs": {
348+
"version": "8.11.0"
349+
},
350+
"event": {
351+
"category": [
352+
"authentication"
353+
],
354+
"id": "249891629",
355+
"kind": "event",
356+
"original": "<135> 10/03/2025:14:06:57 GMT PRODSYST001 0-PPE-4 : default SSLVPN CLISEC_EXP_EVAL 249891629 0 : CaseID cbed1: - Client IP 192.0.2.0 - Vserver 198.51.100.2:443 - Client security check CLIENT.SYSTEM('DOMAIN_SUFFIX_anyof_example.com.jp[COMMENT: Domain check]') EXISTS PASSED(0) on the client machine",
357+
"severity": 0,
358+
"timezone": "GMT",
359+
"type": [
360+
"info"
361+
]
362+
},
363+
"observer": {
364+
"hostname": "PRODSYST001",
365+
"product": "Netscaler",
366+
"type": "firewall",
367+
"vendor": "Citrix"
368+
},
369+
"related": {
370+
"ip": [
371+
"198.51.100.2",
372+
"192.0.2.0"
373+
]
374+
},
375+
"server": {
376+
"ip": "198.51.100.2",
377+
"port": 443
378+
},
379+
"tags": [
380+
"preserve_original_event",
381+
"preserve_duplicate_custom_fields"
382+
]
383+
},
384+
{
385+
"@timestamp": "2025-10-03T13:52:23.000Z",
386+
"citrix": {
387+
"cef_format": false,
388+
"default_class": true,
389+
"detail": "<135> 10/03/2025:13:52:23 GMT PRODSYST001 0-PPE-7 : default SSLVPN CLISEC_CHECK 248708109 0 : CaseID: f0ce9 - Client IP 192.0.2.0 - Vserver 198.51.100.2:443 - Client_security_expression \"CLIENT.SYSTEM('DOMAIN_SUFFIX_anyof_example.com.jp[COMMENT: Domain check]') EXISTS && CLIENT.APPLICATION('ANTIVIR_1346_3064_RTP_==_TRUE[COMMENT: Cortex XDR]') EXISTS\" - Client_security_check passed",
390+
"device_event_class_id": "SSLVPN",
391+
"extended": {
392+
"message": "CaseID: f0ce9 - Client IP 192.0.2.0 - Vserver 198.51.100.2:443 - Client_security_expression \"CLIENT.SYSTEM('DOMAIN_SUFFIX_anyof_example.com.jp[COMMENT: Domain check]') EXISTS && CLIENT.APPLICATION('ANTIVIR_1346_3064_RTP_==_TRUE[COMMENT: Cortex XDR]') EXISTS\" - Client_security_check passed"
393+
},
394+
"host": "PRODSYST001",
395+
"name": "CLISEC_CHECK"
396+
},
397+
"citrix_adc": {
398+
"log": {
399+
"client_ip": "192.0.2.0",
400+
"client_security_check_status": "passed",
401+
"client_security_expression": "CLIENT.SYSTEM('DOMAIN_SUFFIX_anyof_example.com.jp[COMMENT: Domain check]') EXISTS && CLIENT.APPLICATION('ANTIVIR_1346_3064_RTP_==_TRUE[COMMENT: Cortex XDR]') EXISTS",
402+
"message": "CaseID: f0ce9 - Client IP 192.0.2.0 - Vserver 198.51.100.2:443 - Client_security_expression \"CLIENT.SYSTEM('DOMAIN_SUFFIX_anyof_example.com.jp[COMMENT: Domain check]') EXISTS && CLIENT.APPLICATION('ANTIVIR_1346_3064_RTP_==_TRUE[COMMENT: Cortex XDR]') EXISTS\" - Client_security_check passed",
403+
"vserver": {
404+
"ip": "198.51.100.2",
405+
"port": 443
406+
}
407+
}
408+
},
409+
"client": {
410+
"as": {
411+
"number": 64500,
412+
"organization": {
413+
"name": "Documentation ASN"
414+
}
415+
},
416+
"geo": {
417+
"city_name": "Las Vegas",
418+
"continent_name": "North America",
419+
"country_iso_code": "US",
420+
"country_name": "United States",
421+
"location": {
422+
"lat": 36.17497,
423+
"lon": -115.13722
424+
},
425+
"region_iso_code": "US-NV",
426+
"region_name": "Nevada"
427+
},
428+
"ip": "192.0.2.0"
429+
},
430+
"ecs": {
431+
"version": "8.11.0"
432+
},
433+
"event": {
434+
"category": [
435+
"authentication"
436+
],
437+
"id": "248708109",
438+
"kind": "event",
439+
"original": "<135> 10/03/2025:13:52:23 GMT PRODSYST001 0-PPE-7 : default SSLVPN CLISEC_CHECK 248708109 0 : CaseID: f0ce9 - Client IP 192.0.2.0 - Vserver 198.51.100.2:443 - Client_security_expression \"CLIENT.SYSTEM('DOMAIN_SUFFIX_anyof_example.com.jp[COMMENT: Domain check]') EXISTS && CLIENT.APPLICATION('ANTIVIR_1346_3064_RTP_==_TRUE[COMMENT: Cortex XDR]') EXISTS\" - Client_security_check passed",
440+
"severity": 0,
441+
"timezone": "GMT",
442+
"type": [
443+
"info"
444+
]
445+
},
446+
"observer": {
447+
"hostname": "PRODSYST001",
448+
"product": "Netscaler",
449+
"type": "firewall",
450+
"vendor": "Citrix"
451+
},
452+
"related": {
453+
"ip": [
454+
"198.51.100.2",
455+
"192.0.2.0"
456+
]
457+
},
458+
"server": {
459+
"ip": "198.51.100.2",
460+
"port": 443
461+
},
462+
"tags": [
463+
"preserve_original_event",
464+
"preserve_duplicate_custom_fields"
465+
]
219466
}
220467
]
221468
}

‎packages/citrix_adc/data_stream/log/elasticsearch/ingest_pipeline/sslvpn_and_aaatm_feature.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -121,6 +121,7 @@ processors:
121121
field: citrix.extended.message
122122
patterns:
123123
- '^%{WORD:citrix_adc.log.alert_type} ?: %{WORD:citrix_adc.log.alert_level} - ClientIP %{IP:citrix_adc.log.client_ip} - Vserver %{IP:citrix_adc.log.vserver.ip}:%{INT:citrix_adc.log.vserver.port} - Client_security_expression "%{DATA:citrix_adc.log.client_security_expression}" - ?$'
124+
- "^CaseID: %{WORD} - Client IP %{IP:citrix_adc.log.client_ip} - Vserver %{IP:citrix_adc.log.vserver.ip}:%{INT:citrix_adc.log.vserver.port} - Client_security_expression \"%{GREEDYDATA:citrix_adc.log.client_security_expression}\" - Client_security_check %{WORD:citrix_adc.log.client_security_check_status}$"
124125

125126
- grok:
126127
tag: grok_sslvpn_sta_validate_resp
@@ -142,6 +143,7 @@ processors:
142143
field: citrix.extended.message
143144
patterns:
144145
- '^User %{USER:citrix_adc.log.user}%{SPACE}:%{SPACE}- Client%{SPACE}IP %{IP:citrix_adc.log.client_ip} - Vserver %{IP:citrix_adc.log.vserver.ip}:%{INT:citrix_adc.log.vserver.port} - Client%{SPACE}security%{SPACE}check%{SPACE}Passed\(%{NUMBER:citrix_adc.log.client_security_check_status:int}\)%{SPACE}on%{SPACE}the%{SPACE}client%{SPACE}machine$'
146+
- "^CaseID %{WORD}: - Client IP %{IP:citrix_adc.log.client_ip} - Vserver %{IP:citrix_adc.log.vserver.ip}:%{INT:citrix_adc.log.vserver.port} - Client security check %{GREEDYDATA} EXISTS %{GREEDYDATA:citrix_adc.log.client_security_check_status} on the client machine$"
145147

146148
- grok:
147149
tag: grok_sslvpn_message

‎packages/citrix_adc/manifest.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
format_version: "3.0.2"
22
name: citrix_adc
33
title: Citrix ADC
4-
version: "1.17.2"
4+
version: "1.17.3"
55
description: This Elastic integration collects logs and metrics from Citrix ADC product.
66
type: integration
77
categories:

0 commit comments

Comments
 (0)