Skip to content

Commit 19643b3

Browse files
yahyaghaniyahyaghani
authored
[cisco_ftd] Add support for Security Group Tag and Endpoint Group fields (elastic#15652)
* [cisco_ftd] Add SGT/EPG field parsing for connection events for (elastic#15204) * docs: address PR review feedback for cisco_ftd SGT/EPG fields - Bump version to 3.11.0 (enhancement requires minor version bump) - Update changelog link to PR elastic#15652 - Remove pr.md file (not needed in integration packages) - Remove empty lines from test-sgt.log - Anonymize test DeviceUUID values Addresses review comments from @P1llus and @bhapas * fix: bump manifest version to 3.11.0 to match changelog * fix: improved pipeline generate output after empty line cleanup,
1 parent cdec9b1 commit 19643b3

File tree

8 files changed

+318
-5
lines changed

8 files changed

+318
-5
lines changed

‎packages/cisco_ftd/changelog.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
# newer versions go on top
2-
- version: "3.10.3"
2+
- version: "3.11.0"
33
changes:
4-
- description: Generate processor tags and normalize error handler.
4+
- description: Add support for Security Group Tag (SGT) and Endpoint Group (EPG) fields in connection events.
55
type: enhancement
6-
link: https://github.com/elastic/integrations/pull/15530
6+
link: https://github.com/elastic/integrations/pull/15652
77
- version: "3.10.2"
88
changes:
99
- description: Fix parsing for message ID 313005 to accept input type unknown.

‎packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-intrusion.log-config.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,4 +7,4 @@ fields:
77
external_zones:
88
- output-zone
99
internal_zones:
10-
- input-zone
10+
- input-zone

‎packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-sgt.log‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
2025-09-01T12:00:00Z firepower : %FTD-6-430003: EventPriority: Low, DeviceUUID: 00000000-0000-0000-0000-000000000001, InstanceID: 11, FirstPacketSecond: 2025-09-01T12:35:00Z, ConnectionID: 39416, AccessControlRuleAction: Trust, SrcIP: 10.0.100.30, DstIP: 10.0.1.20, SrcPort: 56799, DstPort: 53, Protocol: udp, IngressInterface: inside, EgressInterface: outside, SourceSecurityGroup: SGT_TEST_GROUP, SourceSecurityGroupTag: 2003, SourceSecurityGroupType: Session Directory, DestinationIP_DynamicAttribute: APIC_EPG_TEST_GROUP, IngressVRF: Global, EgressVRF: Global, Endpoint Profile: Workstation:Microsoft-Workstation:Windows11-Workstation, ACPolicy: ACP-Access, AccessControlRuleName: Test-Rule-1, Prefilter Policy: Default Prefilter Policy, User: testuser, Client: DNS, ApplicationProtocol: DNS, ConnectionDuration: 0, InitiatorPackets: 1, ResponderPackets: 1, InitiatorBytes: 31, ResponderBytes: 238, NAPPolicy: Balanced Security and Connectivity
2+
2025-09-01T14:00:00Z firepower : %FTD-6-430002: EventPriority: Low, DeviceUUID: 00000000-0000-0000-0000-000000000001, InstanceID: 4, FirstPacketSecond: 2025-09-01T14:00:03Z, ConnectionID: 36584, AccessControlRuleAction: Block, SrcIP: 10.0.100.30, DstIP: 10.0.1.20, SrcPort: 56799, DstPort: 22, Protocol: tcp, IngressInterface: inside, EgressInterface: outside, SourceSecurityGroup: 2005, SourceSecurityGroupTag: 2005, DestinationSecurityGroup: 9, DestinationSecurityGroupTag: 9, SourceSecurityGroupType: Session Directory, DestinationSecurityGroupType: SXP, IngressVRF: Global, EgressVRF: Global, Endpoint Profile: Invalid ID, ACPolicy: ACP-Management, AccessControlRuleName: Default Deny, Prefilter Policy: Management Prefilter Policy, InitiatorPackets: 1, ResponderPackets: 0, InitiatorBytes: 70, ResponderBytes: 0, NAPPolicy: Balanced Security and Connectivity

‎packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-sgt.log-expected.json‎

Lines changed: 263 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,263 @@
1+
{
2+
"expected": [
3+
{
4+
"@timestamp": "2025-09-01T12:35:00.000Z",
5+
"cisco": {
6+
"ftd": {
7+
"destination_interface": "outside",
8+
"rule_name": [
9+
"ACP-Access",
10+
"Test-Rule-1"
11+
],
12+
"security": {
13+
"endpoint_profile": "Workstation:Microsoft-Workstation:Windows11-Workstation"
14+
},
15+
"security_event": {
16+
"ac_policy": "ACP-Access",
17+
"access_control_rule_action": "Trust",
18+
"access_control_rule_name": "Test-Rule-1",
19+
"application_protocol": "DNS",
20+
"client": "DNS",
21+
"connection_duration": 0,
22+
"destination_ip_dynamic_attribute": "APIC_EPG_TEST_GROUP",
23+
"dst_ip": "10.0.1.20",
24+
"dst_port": 53,
25+
"egress_interface": "outside",
26+
"first_packet_second": "2025-09-01T12:35:00Z",
27+
"ingress_interface": "inside",
28+
"initiator_bytes": 31,
29+
"initiator_packets": 1,
30+
"nap_policy": "Balanced Security and Connectivity",
31+
"prefilter_policy": "Default Prefilter Policy",
32+
"protocol": "udp",
33+
"responder_bytes": 238,
34+
"responder_packets": 1,
35+
"source_security_group": "SGT_TEST_GROUP",
36+
"source_security_group_tag": "2003",
37+
"source_security_group_type": "Session Directory",
38+
"src_ip": "10.0.100.30",
39+
"src_port": 56799,
40+
"user": "testuser"
41+
},
42+
"source_interface": "inside"
43+
}
44+
},
45+
"destination": {
46+
"address": "10.0.1.20",
47+
"bytes": 238,
48+
"ip": "10.0.1.20",
49+
"packets": 1,
50+
"port": 53
51+
},
52+
"device": {
53+
"manufacturer": "Microsoft",
54+
"model": {
55+
"name": "Windows11"
56+
}
57+
},
58+
"ecs": {
59+
"version": "8.17.0"
60+
},
61+
"event": {
62+
"action": "connection-finished",
63+
"category": [
64+
"network"
65+
],
66+
"code": "430003",
67+
"duration": 0,
68+
"end": "2025-09-01T12:35:00.000Z",
69+
"kind": "event",
70+
"original": "2025-09-01T12:00:00Z firepower : %FTD-6-430003: EventPriority: Low, DeviceUUID: 00000000-0000-0000-0000-000000000001, InstanceID: 11, FirstPacketSecond: 2025-09-01T12:35:00Z, ConnectionID: 39416, AccessControlRuleAction: Trust, SrcIP: 10.0.100.30, DstIP: 10.0.1.20, SrcPort: 56799, DstPort: 53, Protocol: udp, IngressInterface: inside, EgressInterface: outside, SourceSecurityGroup: SGT_TEST_GROUP, SourceSecurityGroupTag: 2003, SourceSecurityGroupType: Session Directory, DestinationIP_DynamicAttribute: APIC_EPG_TEST_GROUP, IngressVRF: Global, EgressVRF: Global, Endpoint Profile: Workstation:Microsoft-Workstation:Windows11-Workstation, ACPolicy: ACP-Access, AccessControlRuleName: Test-Rule-1, Prefilter Policy: Default Prefilter Policy, User: testuser, Client: DNS, ApplicationProtocol: DNS, ConnectionDuration: 0, InitiatorPackets: 1, ResponderPackets: 1, InitiatorBytes: 31, ResponderBytes: 238, NAPPolicy: Balanced Security and Connectivity",
71+
"outcome": "success",
72+
"severity": 6,
73+
"start": "2025-09-01T12:35:00.000Z",
74+
"timezone": "UTC",
75+
"type": [
76+
"connection",
77+
"end",
78+
"allowed"
79+
]
80+
},
81+
"host": {
82+
"hostname": "firepower",
83+
"type": "Microsoft"
84+
},
85+
"log": {
86+
"level": "informational"
87+
},
88+
"network": {
89+
"application": "dns",
90+
"bytes": 269,
91+
"community_id": "1:xlmEboTK1cVSycaPD+f1Ii6nxMg=",
92+
"iana_number": "17",
93+
"protocol": "dns",
94+
"transport": "udp"
95+
},
96+
"observer": {
97+
"egress": {
98+
"interface": {
99+
"name": "outside"
100+
}
101+
},
102+
"hostname": "firepower",
103+
"ingress": {
104+
"interface": {
105+
"name": "inside"
106+
}
107+
},
108+
"product": "ftd",
109+
"type": "idps",
110+
"vendor": "Cisco"
111+
},
112+
"related": {
113+
"hosts": [
114+
"firepower"
115+
],
116+
"ip": [
117+
"10.0.100.30",
118+
"10.0.1.20"
119+
],
120+
"user": [
121+
"testuser"
122+
]
123+
},
124+
"rule": {
125+
"name": "Test-Rule-1",
126+
"ruleset": "ACP-Access"
127+
},
128+
"source": {
129+
"address": "10.0.100.30",
130+
"bytes": 31,
131+
"ip": "10.0.100.30",
132+
"packets": 1,
133+
"port": 56799
134+
},
135+
"tags": [
136+
"preserve_original_event"
137+
],
138+
"user": {
139+
"id": "testuser",
140+
"name": "testuser"
141+
}
142+
},
143+
{
144+
"@timestamp": "2025-09-01T14:00:03.000Z",
145+
"cisco": {
146+
"ftd": {
147+
"destination_interface": "outside",
148+
"rule_name": [
149+
"ACP-Management",
150+
"Default Deny"
151+
],
152+
"security": {
153+
"endpoint_profile": "Invalid ID"
154+
},
155+
"security_event": {
156+
"ac_policy": "ACP-Management",
157+
"access_control_rule_action": "Block",
158+
"access_control_rule_name": "Default Deny",
159+
"destination_security_group": "9",
160+
"destination_security_group_tag": "9",
161+
"dst_ip": "10.0.1.20",
162+
"dst_port": 22,
163+
"egress_interface": "outside",
164+
"first_packet_second": "2025-09-01T14:00:03Z",
165+
"ingress_interface": "inside",
166+
"initiator_bytes": 70,
167+
"initiator_packets": 1,
168+
"nap_policy": "Balanced Security and Connectivity",
169+
"prefilter_policy": "Management Prefilter Policy",
170+
"protocol": "tcp",
171+
"responder_bytes": 0,
172+
"responder_packets": 0,
173+
"source_security_group": "2005",
174+
"source_security_group_tag": "2005",
175+
"source_security_group_type": "Session Directory",
176+
"src_ip": "10.0.100.30",
177+
"src_port": 56799
178+
},
179+
"source_interface": "inside"
180+
}
181+
},
182+
"destination": {
183+
"address": "10.0.1.20",
184+
"bytes": 0,
185+
"ip": "10.0.1.20",
186+
"packets": 0,
187+
"port": 22
188+
},
189+
"ecs": {
190+
"version": "8.17.0"
191+
},
192+
"event": {
193+
"action": "connection-started",
194+
"category": [
195+
"network"
196+
],
197+
"code": "430002",
198+
"kind": "event",
199+
"original": "2025-09-01T14:00:00Z firepower : %FTD-6-430002: EventPriority: Low, DeviceUUID: 00000000-0000-0000-0000-000000000001, InstanceID: 4, FirstPacketSecond: 2025-09-01T14:00:03Z, ConnectionID: 36584, AccessControlRuleAction: Block, SrcIP: 10.0.100.30, DstIP: 10.0.1.20, SrcPort: 56799, DstPort: 22, Protocol: tcp, IngressInterface: inside, EgressInterface: outside, SourceSecurityGroup: 2005, SourceSecurityGroupTag: 2005, DestinationSecurityGroup: 9, DestinationSecurityGroupTag: 9, SourceSecurityGroupType: Session Directory, DestinationSecurityGroupType: SXP, IngressVRF: Global, EgressVRF: Global, Endpoint Profile: Invalid ID, ACPolicy: ACP-Management, AccessControlRuleName: Default Deny, Prefilter Policy: Management Prefilter Policy, InitiatorPackets: 1, ResponderPackets: 0, InitiatorBytes: 70, ResponderBytes: 0, NAPPolicy: Balanced Security and Connectivity",
200+
"outcome": "success",
201+
"severity": 6,
202+
"start": "2025-09-01T14:00:03Z",
203+
"timezone": "UTC",
204+
"type": [
205+
"connection",
206+
"start",
207+
"denied"
208+
]
209+
},
210+
"host": {
211+
"hostname": "firepower"
212+
},
213+
"log": {
214+
"level": "informational"
215+
},
216+
"network": {
217+
"bytes": 70,
218+
"community_id": "1:jcSnhrPf/GVREflEdymeibE8U/A=",
219+
"iana_number": "6",
220+
"transport": "tcp"
221+
},
222+
"observer": {
223+
"egress": {
224+
"interface": {
225+
"name": "outside"
226+
}
227+
},
228+
"hostname": "firepower",
229+
"ingress": {
230+
"interface": {
231+
"name": "inside"
232+
}
233+
},
234+
"product": "ftd",
235+
"type": "idps",
236+
"vendor": "Cisco"
237+
},
238+
"related": {
239+
"hosts": [
240+
"firepower"
241+
],
242+
"ip": [
243+
"10.0.100.30",
244+
"10.0.1.20"
245+
]
246+
},
247+
"rule": {
248+
"name": "Default Deny",
249+
"ruleset": "ACP-Management"
250+
},
251+
"source": {
252+
"address": "10.0.100.30",
253+
"bytes": 70,
254+
"ip": "10.0.100.30",
255+
"packets": 1,
256+
"port": 56799
257+
},
258+
"tags": [
259+
"preserve_original_event"
260+
]
261+
}
262+
]
263+
}

‎packages/cisco_ftd/data_stream/log/elasticsearch/ingest_pipeline/default.yml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1433,6 +1433,15 @@ processors:
14331433
DstPort:
14341434
target: dst_port
14351435
ecs: [destination.port]
1436+
DestinationIP_DynamicAttribute:
1437+
target: destination_ip_dynamic_attribute
1438+
id: ["430002", "430003"]
1439+
DestinationSecurityGroup:
1440+
target: destination_security_group
1441+
id: ["430002", "430003"]
1442+
DestinationSecurityGroupTag:
1443+
target: destination_security_group_tag
1444+
id: ["430002", "430003"]
14361445
EgressInterface:
14371446
target: egress_interface
14381447
id: ["430001", "430002", "430003"]
@@ -1648,6 +1657,15 @@ processors:
16481657
SperoDisposition:
16491658
target: spero_disposition
16501659
id: ["430004", "430005"]
1660+
SourceSecurityGroup:
1661+
target: source_security_group
1662+
id: ["430002", "430003"]
1663+
SourceSecurityGroupTag:
1664+
target: source_security_group_tag
1665+
id: ["430002", "430003"]
1666+
SourceSecurityGroupType:
1667+
target: source_security_group_type
1668+
id: ["430002", "430003"]
16511669
SrcIP:
16521670
target: src_ip
16531671
ecs: [source.address]
@@ -1738,6 +1756,9 @@ processors:
17381756
'dns_record_type',
17391757
'dns_response_type',
17401758
'dns_ttl',
1759+
'destination_ip_dynamic_attribute',
1760+
'destination_security_group',
1761+
'destination_security_group_tag',
17411762
'dst_ip',
17421763
'dst_port',
17431764
'egress_interface',
@@ -1768,6 +1789,9 @@ processors:
17681789
'responder_bytes',
17691790
'responder_packets',
17701791
'sha_disposition',
1792+
'source_security_group',
1793+
'source_security_group_tag',
1794+
'source_security_group_type',
17711795
'spero_disposition',
17721796
'src_ip',
17731797
'src_port',

‎packages/cisco_ftd/data_stream/log/fields/fields.yml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -201,6 +201,15 @@
201201
type: ip
202202
- name: dst_port
203203
type: integer
204+
- name: destination_ip_dynamic_attribute
205+
type: keyword
206+
description: Destination IP dynamic attribute (EPG information)
207+
- name: destination_security_group
208+
type: keyword
209+
description: Destination Security Group Tag (SGT)
210+
- name: destination_security_group_tag
211+
type: keyword
212+
description: Destination Security Group Tag number
204213
- name: egress_interface
205214
type: keyword
206215
- name: egress_zone
@@ -259,6 +268,15 @@
259268
type: keyword
260269
- name: spero_disposition
261270
type: keyword
271+
- name: source_security_group
272+
type: keyword
273+
description: Source Security Group Tag (SGT)
274+
- name: source_security_group_tag
275+
type: keyword
276+
description: Source Security Group Tag number
277+
- name: source_security_group_type
278+
type: keyword
279+
description: Source Security Group Tag type
262280
- name: src_ip
263281
type: ip
264282
- name: src_port

‎packages/cisco_ftd/docs/README.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -240,6 +240,9 @@ An example event for `log` looks as following:
240240
| cisco.ftd.security_event.client | | keyword |
241241
| cisco.ftd.security_event.client_version | | keyword |
242242
| cisco.ftd.security_event.connection_duration | | integer |
243+
| cisco.ftd.security_event.destination_ip_dynamic_attribute | Destination IP dynamic attribute (EPG information) | keyword |
244+
| cisco.ftd.security_event.destination_security_group | Destination Security Group Tag (SGT) | keyword |
245+
| cisco.ftd.security_event.destination_security_group_tag | Destination Security Group Tag number | keyword |
243246
| cisco.ftd.security_event.dns_query | | keyword |
244247
| cisco.ftd.security_event.dns_record_type | | keyword |
245248
| cisco.ftd.security_event.dns_response_type | | keyword |
@@ -274,6 +277,9 @@ An example event for `log` looks as following:
274277
| cisco.ftd.security_event.responder_bytes | | long |
275278
| cisco.ftd.security_event.responder_packets | | integer |
276279
| cisco.ftd.security_event.sha_disposition | | keyword |
280+
| cisco.ftd.security_event.source_security_group | Source Security Group Tag (SGT) | keyword |
281+
| cisco.ftd.security_event.source_security_group_tag | Source Security Group Tag number | keyword |
282+
| cisco.ftd.security_event.source_security_group_type | Source Security Group Tag type | keyword |
277283
| cisco.ftd.security_event.spero_disposition | | keyword |
278284
| cisco.ftd.security_event.src_ip | | ip |
279285
| cisco.ftd.security_event.src_port | | integer |

‎packages/cisco_ftd/manifest.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
format_version: "3.0.3"
22
name: cisco_ftd
33
title: Cisco FTD
4-
version: "3.10.3"
4+
version: "3.11.0"
55
description: Collect logs from Cisco FTD with Elastic Agent.
66
type: integration
77
categories:

0 commit comments

Comments
 (0)