|
| 1 | +## Summary |
| 2 | +This PR adds support for parsing 6 Security Group Tag (SGT) and Endpoint Group (EPG) fields from Cisco FTD connection event syslog messages (message IDs 430002 and 430003). |
| 3 | + |
| 4 | +## Related Issue |
| 5 | +Fixes #15204 |
| 6 | + |
| 7 | +## Problem |
| 8 | +The Cisco FTD integration was not parsing SGT/EGT-related fields from connection event messages. These fields were present in the `event.original` field but were not being extracted into structured, queryable fields, making it difficult to search and analyze security group information in Elastic. |
| 9 | + |
| 10 | +## Solution |
| 11 | +Added parsing support for the following 6 fields: |
| 12 | + |
| 13 | +| Field | Target Field | Type | Description | |
| 14 | +|-------|---------------|------|-------------| |
| 15 | +| `SourceSecurityGroup` | `cisco.ftd.security_event.source_security_group` | keyword | Security Group of the source | |
| 16 | +| `SourceSecurityGroupTag` | `cisco.ftd.security_event.source_security_group_tag` | keyword | Numeric SGT attribute of source | |
| 17 | +| `SourceSecurityGroupType` | `cisco.ftd.security_event.source_security_group_type` | keyword | Source SGT type (Inline, Session Directory, SXP) | |
| 18 | +| `DestinationIP_DynamicAttribute` | `cisco.ftd.security_event.destination_ip_dynamic_attribute` | keyword | Destination IP dynamic attribute (EPG info) | |
| 19 | +| `DestinationSecurityGroup` | `cisco.ftd.security_event.destination_security_group` | keyword | Security Group of the destination | |
| 20 | +| `DestinationSecurityGroupTag` | `cisco.ftd.security_event.destination_security_group_tag` | keyword | Numeric SGT attribute of destination | |
| 21 | + |
| 22 | +## Changes Made |
| 23 | + |
| 24 | +### 1. Ingest Pipeline ([default.yml](data_stream/log/elasticsearch/ingest_pipeline/default.yml)) |
| 25 | +- Added 6 field mappings in the script processor params section |
| 26 | +- Added field targets to `security_event_list` array to ensure fields are placed in `cisco.ftd.security_event` group (consistent with other connection event fields) |
| 27 | +- Fields are configured for message IDs `["430002", "430003"]` |
| 28 | + |
| 29 | +### 2. Field Definitions ([fields.yml](data_stream/log/fields/fields.yml)) |
| 30 | +- Added 6 field definitions under `cisco.ftd.security_event` group |
| 31 | +- All fields typed as `keyword` to support both string and numeric values |
| 32 | +- Added descriptions based on official Cisco documentation |
| 33 | + |
| 34 | +### 3. Testing |
| 35 | +- Created new test file [test-sgt.log](data_stream/log/_dev/test/pipeline/test-sgt.log) with 2 sample connection events containing SGT/EGT fields |
| 36 | +- Test covers both 430002 (connection start) and 430003 (connection end) message types |
| 37 | +- Validates extraction of both string values (e.g., `"SGT_TEST_GROUP"`) and numeric values (e.g., `"2005"`) |
| 38 | +- All 39 pipeline tests passing ✅ |
| 39 | + |
| 40 | +## Implementation Notes |
| 41 | +Fields are placed in `cisco.ftd.security_event` rather than the legacy `cisco.ftd.security` field for consistency and maintainability. |
| 42 | +All new fields use `keyword` type to handle both string and numeric values. |
| 43 | + |
| 44 | +## Testing Performed |
| 45 | +- [x] Pipeline tests pass (39/39) |
| 46 | +- [x] Fields extract correctly |
| 47 | +- [x] Correct ECS placement |
| 48 | +- [x] No regressions |
| 49 | + |
| 50 | +## References |
| 51 | +- Issue: #15204 |
| 52 | +- Cisco Documentation: [Cisco Secure Firewall Threat Defense Syslog Messages — Connection Event Field Descriptions](https://www.cisco.com/c/en/us/td/docs/security/firepower/Syslogs/fptd_syslog_guide/security-event-syslog-messages.html#id_87692) |
| 53 | + |
| 54 | +## Checklist |
| 55 | +- [x] Field definitions added |
| 56 | +- [x] Pipeline updated |
| 57 | +- [x] Tests added |
| 58 | +- [x] Docs/links included |
| 59 | +- [x] All tests passing |
0 commit comments