Integration of logs from Cisco ASA to Security Onion

[sergdont]

Hello community!
I ask for your help.
I have onion 2.4.70, I have Cisco ASA. Could you help with the integration of logs from Cisco ASA to onion?
I would be very grateful at least for the direction of movement.
I'm a newbie, so I asked for help. I didn't find a clear answer to this question.
I've seen #3175
But in the version 2.4.70 I didn't find /opt/so/saltstack/default/salt/elasticsearch/templates/so/so-common-template.json Accordingly, the path developed by the esteemed Mr. Gebhard73 does not do in my case

[cm-ops]

There is an integration for Cisco ASA - https://docs.securityonion.net/en/2.4/third-party-integrations.html#third-party-integrations

[sergdont]

Thank you sir. I’ll try it. I’ll report on the results.

[sergdont]

Step by step what I did:

1. Fleet / Agent policies / so-grid-nodes_general / Add integration / Cisco ASA integration

2. Collect logs from Cisco ASA via UDP / address 0.0.0.0 port 9001
   Preserve original event ON
   Preserve searchable message text ON

3. Checking port availability (well done)
   [user@securityonion ~]$ ss -tulnp | grep 9001
   udp UNCONN 0 0 *:9001 :

4. Reconfiguration of the log link from ASA (well done)
   [user@securityonion ~]$ sudo tcpdump -i eth0 port 9001
   06:26:19.658488 IP 100.123.123.1.syslog > securityonion.etlservicemgr: SYSLOG local4.info, length: 201
   06:26:19.775444 IP 100.123.123.1.syslog > securityonion.etlservicemgr: SYSLOG local4.info, length: 184

5. But nothing appears on the firewall dashboard.
   I think this is due to the fact that when I go to the settings Administration / Configuration / (Show all configurable settings, including advanced settings) / firewall / hostgroups / I do not see "customhostgroup0"

Do you have any idea what I did wrong?

Thank you very much for your support and time.

[sergdont]

About half an hour later, customhostgroup0 appeared. Added firewall IP to this group. Waiting for customportgroup0 to appear )

[sergdont]

The last thing I did was add firewall / role / fleet / chain / input / hostgroup / custogroup0 / portgroups / customportgroup0

[sergdont]

Good day. It does. Thank you sir.