Skip to content

Commit fcf324c

Browse files
taylor-swansontaylor-swanson
authored
[cisco_asa] Add advanced option for time zone mapping and support parsing extra timestamp in header (#12440)
- Added an advanced option for mapping short time zone names to long time zone names - Support parsing the extra timestamp that is sometimes included in messages, often containing the time zone.
1 parent ea01b6f commit fcf324c

File tree

10 files changed

+232
-13
lines changed

10 files changed

+232
-13
lines changed

‎packages/cisco_asa/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "2.41.0"
3+
changes:
4+
- description: "Add advanced option for time zone mapping and support parsing extra timestamp in header."
5+
type: enhancement
6+
link: https://github.com/elastic/integrations/pull/12440
27
- version: "2.40.0"
38
changes:
49
- description: "Set event.outcome to failure for all denied events."

‎packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-additional-messages.log-expected.json‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11566,7 +11566,6 @@
1156611566
"original": "Sep 25 15:47:07 host1.example.com : Sep 25 15:47:07 EDT: %ASA-auth-4-113004: AAA user authentication Successful : server = myservername : user = myusername",
1156711567
"outcome": "success",
1156811568
"severity": 4,
11569-
"timezone": "UTC",
1157011569
"type": [
1157111570
"allowed",
1157211571
"info"
@@ -11628,7 +11627,6 @@
1162811627
"original": "Sep 25 12:42:21 host1.example.com : Sep 25 12:42:21 EDT: %ASA-auth-4-113005: AAA user authentication Rejected : reason = AAA failure : server = myservername : user = myusername : user IP = 10.11.74.55",
1162911628
"outcome": "failure",
1163011629
"severity": 4,
11631-
"timezone": "UTC",
1163211630
"type": [
1163311631
"denied",
1163411632
"info"
@@ -11670,7 +11668,7 @@
1167011668
]
1167111669
},
1167211670
{
11673-
"@timestamp": "2025-09-25T01:08:29.000Z",
11671+
"@timestamp": "2025-09-25T05:08:29.000Z",
1167411672
"cisco": {
1167511673
"asa": {
1167611674
"destination_interface": "GWAN",

‎packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-asa-tz-mapping.log‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
Sep 25 15:47:07 host1.example.com : Sep 25 15:47:07 EDT: %ASA-auth-4-113004: AAA user authentication Successful : server = myservername : user = myusername
2+
Jan 22 14:05:11 test.example.com : Jan 22 14:05:11 PST: %ASA-svc-4-722051: Group <GroupPolicy_NAME> User <user_NAME> IP <81.2.69.144> IPv4 Address <10.20.0.1> IPv6 address <::> assigned to session

‎packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-asa-tz-mapping.log-config.yml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
dynamic_fields:
2+
"event.ingested": ".*"
3+
fields:
4+
tags:
5+
- preserve_original_event
6+
_conf:
7+
tz_map:
8+
- tz_short: EDT
9+
tz_long: America/New_York
10+
- tz_short: PST
11+
tz_long: -08:00

‎packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-asa-tz-mapping.log-expected.json‎

Lines changed: 143 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,143 @@
1+
{
2+
"expected": [
3+
{
4+
"@timestamp": "2025-09-25T15:47:07.000-04:00",
5+
"cisco": {
6+
"asa": {
7+
"aaa_type": "authentication",
8+
"suffix": "auth"
9+
}
10+
},
11+
"destination": {
12+
"address": "myservername",
13+
"domain": "myservername"
14+
},
15+
"ecs": {
16+
"version": "8.11.0"
17+
},
18+
"event": {
19+
"action": "logged-in",
20+
"category": [
21+
"authentication",
22+
"network"
23+
],
24+
"code": "113004",
25+
"kind": "event",
26+
"original": "Sep 25 15:47:07 host1.example.com : Sep 25 15:47:07 EDT: %ASA-auth-4-113004: AAA user authentication Successful : server = myservername : user = myusername",
27+
"outcome": "success",
28+
"severity": 4,
29+
"timezone": "America/New_York",
30+
"type": [
31+
"allowed",
32+
"info"
33+
]
34+
},
35+
"host": {
36+
"hostname": "host1.example.com"
37+
},
38+
"log": {
39+
"level": "warning"
40+
},
41+
"observer": {
42+
"hostname": "host1.example.com",
43+
"product": "asa",
44+
"type": "firewall",
45+
"vendor": "Cisco"
46+
},
47+
"related": {
48+
"hosts": [
49+
"host1.example.com",
50+
"myservername"
51+
],
52+
"user": [
53+
"myusername"
54+
]
55+
},
56+
"source": {
57+
"user": {
58+
"name": "myusername"
59+
}
60+
},
61+
"tags": [
62+
"preserve_original_event"
63+
]
64+
},
65+
{
66+
"@timestamp": "2025-01-22T14:05:11.000-08:00",
67+
"cisco": {
68+
"asa": {
69+
"assigned_ip": "10.20.0.1",
70+
"suffix": "svc"
71+
}
72+
},
73+
"ecs": {
74+
"version": "8.11.0"
75+
},
76+
"event": {
77+
"action": "address-assigned",
78+
"category": [
79+
"network"
80+
],
81+
"code": "722051",
82+
"kind": "event",
83+
"original": "Jan 22 14:05:11 test.example.com : Jan 22 14:05:11 PST: %ASA-svc-4-722051: Group <GroupPolicy_NAME> User <user_NAME> IP <81.2.69.144> IPv4 Address <10.20.0.1> IPv6 address <::> assigned to session",
84+
"outcome": "success",
85+
"reason": "IPv4 Address <10.20.0.1> IPv6 address <::> assigned to session",
86+
"severity": 4,
87+
"timezone": "-08:00",
88+
"type": [
89+
"connection",
90+
"info"
91+
]
92+
},
93+
"host": {
94+
"hostname": "test.example.com"
95+
},
96+
"log": {
97+
"level": "warning"
98+
},
99+
"observer": {
100+
"hostname": "test.example.com",
101+
"product": "asa",
102+
"type": "firewall",
103+
"vendor": "Cisco"
104+
},
105+
"related": {
106+
"hosts": [
107+
"test.example.com"
108+
],
109+
"ip": [
110+
"81.2.69.144"
111+
],
112+
"user": [
113+
"user_NAME"
114+
]
115+
},
116+
"source": {
117+
"address": "81.2.69.144",
118+
"geo": {
119+
"city_name": "London",
120+
"continent_name": "Europe",
121+
"country_iso_code": "GB",
122+
"country_name": "United Kingdom",
123+
"location": {
124+
"lat": 51.5142,
125+
"lon": -0.0931
126+
},
127+
"region_iso_code": "GB-ENG",
128+
"region_name": "England"
129+
},
130+
"ip": "81.2.69.144",
131+
"user": {
132+
"group": {
133+
"name": "GroupPolicy_NAME"
134+
},
135+
"name": "user_NAME"
136+
}
137+
},
138+
"tags": [
139+
"preserve_original_event"
140+
]
141+
}
142+
]
143+
}

‎packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-common-config.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
dynamic_fields:
2-
"event.end": "^[0-9]{4}(-[0-9]{2}){2}T[0-9]{2}(:[0-9]{2}){2}\\.[0-9]{3}Z$"
3-
"event.start": "^[0-9]{4}(-[0-9]{2}){2}T[0-9]{2}(:[0-9]{2}){2}\\.[0-9]{3}Z$"
4-
"@timestamp": "^[0-9]{4}(-[0-9]{2}){2}T[0-9]{2}(:[0-9]{2}){2}\\.[0-9]{3}Z$"
2+
"event.end": "^[0-9]{4}(-[0-9]{2}){2}T[0-9]{2}(:[0-9]{2}){2}\\.[0-9]{3}(?:Z|[-+][0-9]{2}:[0-9]{2})$"
3+
"event.start": "^[0-9]{4}(-[0-9]{2}){2}T[0-9]{2}(:[0-9]{2}){2}\\.[0-9]{3}(?:Z|[-+][0-9]{2}:[0-9]{2})$"
4+
"@timestamp": "^[0-9]{4}(-[0-9]{2}){2}T[0-9]{2}(:[0-9]{2}){2}\\.[0-9]{3}(?:Z|[-+][0-9]{2}:[0-9]{2})$"
55
fields:
66
tags:
77
- preserve_original_event

‎packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-invalid-data.log-expected.json‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -314,6 +314,7 @@
314314
]
315315
},
316316
{
317+
"@timestamp": "2023-07-14T08:23:43.398Z",
317318
"cisco": {
318319
"asa": {
319320
"message_id": ""
@@ -359,6 +360,7 @@
359360
]
360361
},
361362
{
363+
"@timestamp": "2023-07-14T08:23:43.398Z",
362364
"cisco": {
363365
"asa": {
364366
"message_id": ""
@@ -533,6 +535,7 @@
533535
]
534536
},
535537
{
538+
"@timestamp": "2023-07-14T08:23:43.398Z",
536539
"cisco": {
537540
"asa": {
538541
"message_id": ""
@@ -659,7 +662,7 @@
659662
]
660663
},
661664
{
662-
"@timestamp": "2025-07-13T08:23:43.000Z",
665+
"@timestamp": "2023-07-14T08:23:43.000Z",
663666
"cisco": {
664667
"asa": {
665668
"message_id": ""
@@ -711,7 +714,7 @@
711714
]
712715
},
713716
{
714-
"@timestamp": "2025-07-13T08:23:43.000Z",
717+
"@timestamp": "2023-07-14T08:23:43.000Z",
715718
"cisco": {
716719
"asa": {
717720
"message_id": ""
@@ -754,7 +757,7 @@
754757
]
755758
},
756759
{
757-
"@timestamp": "2025-07-13T08:23:43.000Z",
760+
"@timestamp": "2023-07-14T08:23:43.000Z",
758761
"cisco": {
759762
"asa": {
760763
"message_id": ""

‎packages/cisco_asa/data_stream/log/elasticsearch/ingest_pipeline/default.yml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,15 @@ processors:
4141
# exactly match the syntax for firepower management logs
4242
PROCESS_HOST: "(?:%{PROCESS:process.name}:\\s%{SYSLOGHOST:host.name})"
4343
HOST_PROCESS: "(?:%{SYSLOGHOST:host.hostname}:?\\s+)?(?:%{PROCESS:process.name}?(?:\\[%{POSINT:process.pid:long}\\])?)?"
44+
- grok:
45+
field: _temp_.full_message
46+
tag: grok_extra_timestamp
47+
if: ctx._temp_.full_message != null
48+
patterns:
49+
- '^%{ASA_DATE:_temp_.raw_date}: %{DATA:_temp_.full_message}$'
50+
- '%{GREEDYDATA:_temp_.full_message}'
51+
pattern_definitions:
52+
ASA_DATE: "(?:%{DAY} )?%{MONTH} *%{MONTHDAY}(?: %{YEAR})? %{TIME}(?: %{TZ:_temp_.tz})?"
4453
- script:
4554
lang: painless
4655
tag: script_log_syslog
@@ -90,6 +99,18 @@ processors:
9099
value: 7
91100
if: "ctx?.event?.severity == null"
92101
102+
- script:
103+
lang: painless
104+
tag: script_tz_mapping
105+
if: ctx._temp_?.tz != null && ctx._temp_?.tz != '' && ctx._conf?.tz_map != null
106+
source: >-
107+
for (def item : ctx._conf.tz_map) {
108+
if (item.tz_short == ctx._temp_.tz) {
109+
ctx._temp_.tz = item.tz_long;
110+
break;
111+
}
112+
}
113+
93114
# Time zone can come from three sources, choose in order: log, config, locale, default to UTC.
94115
- set:
95116
field: _temp_.tz
@@ -117,6 +138,7 @@ processors:
117138
#
118139
- date:
119140
if: ctx._temp_?.raw_date != null
141+
tag: parse_raw_date
120142
timezone: "{{{ event.timezone }}}"
121143
field: "_temp_.raw_date"
122144
formats:
@@ -135,6 +157,8 @@ processors:
135157
- "EEE MMM dd yyyy HH:mm:ss"
136158
- "MMM d yyyy HH:mm:ss z"
137159
- "MMM dd yyyy HH:mm:ss z"
160+
- "MMM d yyyy HH:mm:ss.SSS z"
161+
- "MMM dd yyyy HH:mm:ss.SSS z"
138162
- "EEE MMM d yyyy HH:mm:ss z"
139163
- "EEE MMM dd yyyy HH:mm:ss z"
140164
on_failure:
@@ -144,6 +168,7 @@ processors:
144168
ignore_missing: true
145169
- date:
146170
if: ctx._temp_?.raw_date != null
171+
tag: "parse_raw_date_fallback"
147172
field: "_temp_.raw_date"
148173
formats:
149174
- "ISO8601"
@@ -161,6 +186,8 @@ processors:
161186
- "EEE MMM dd yyyy HH:mm:ss"
162187
- "MMM d yyyy HH:mm:ss z"
163188
- "MMM dd yyyy HH:mm:ss z"
189+
- "MMM d yyyy HH:mm:ss.SSS z"
190+
- "MMM dd yyyy HH:mm:ss.SSS z"
164191
- "EEE MMM d yyyy HH:mm:ss z"
165192
- "EEE MMM dd yyyy HH:mm:ss z"
166193

‎packages/cisco_asa/data_stream/log/manifest.yml‎

Lines changed: 33 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -81,12 +81,22 @@ streams:
8181
8282
- name: tz_offset
8383
type: text
84-
title: Timezone
84+
title: Default Time Zone
8585
multi: false
8686
required: false
8787
show_user: false
8888
default: UTC
8989
description: IANA time zone or time offset (e.g. `+0200`) to use when interpreting syslog timestamps without a time zone.
90+
- name: tz_map
91+
type: yaml
92+
title: Time Zone Map
93+
multi: false
94+
required: false
95+
show_user: false
96+
description: A combination of time zones as they appear in the Cisco ASA log, in combination with a proper IANA time zone or offset (for example, Australia/Sydney or +10:00).
97+
default: |
98+
#- tz_short: AEST
99+
# tz_long: Australia/Sydney
90100
- input: tcp
91101
title: Cisco ASA logs
92102
description: Collect Cisco ASA logs
@@ -177,12 +187,22 @@ streams:
177187
description: Specify custom configuration options for the TCP input. See [TCP](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-tcp.html) for details.
178188
- name: tz_offset
179189
type: text
180-
title: Timezone
190+
title: Default Time Zone
181191
multi: false
182192
required: false
183193
show_user: false
184194
default: UTC
185195
description: IANA time zone or time offset (e.g. `+0200`) to use when interpreting syslog timestamps without a time zone.
196+
- name: tz_map
197+
type: yaml
198+
title: Time Zone Map
199+
multi: false
200+
required: false
201+
show_user: false
202+
description: A combination of time zones as they appear in the Cisco ASA log, in combination with a proper IANA time zone or offset (for example, Australia/Sydney or +10:00).
203+
default: |
204+
#- tz_short: AEST
205+
# tz_long: Australia/Sydney
186206
- input: logfile
187207
enabled: false
188208
title: Cisco ASA logs
@@ -247,9 +267,19 @@ streams:
247267
Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.
248268
- name: tz_offset
249269
type: text
250-
title: Timezone
270+
title: Default Time Zone
251271
multi: false
252272
required: false
253273
show_user: false
254274
default: UTC
255275
description: IANA time zone or time offset (e.g. `+0200`) to use when interpreting syslog timestamps without a time zone.
276+
- name: tz_map
277+
type: yaml
278+
title: Time Zone Map
279+
multi: false
280+
required: false
281+
show_user: false
282+
description: A combination of time zones as they appear in the Cisco ASA log, in combination with a proper IANA time zone or offset (for example, Australia/Sydney or +10:00).
283+
default: |
284+
#- tz_short: AEST
285+
# tz_long: Australia/Sydney

0 commit comments

Comments
 (0)