Skip to content

Commit df785e4

Browse files
taylor-swansonrobester0403
taylor-swanson
authored and
robester0403
committed
[cisco_ftd] Include NAT IPs and ports from security event messages (elastic#14892)
- Include the source and destination NAT IPs and ports from security event messages (430002 and 430003)
1 parent 44c1d13 commit df785e4

File tree

5 files changed

+197
-1
lines changed

5 files changed

+197
-1
lines changed

‎packages/cisco_ftd/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "3.10.0"
3+
changes:
4+
- description: Include NAT IPs and ports from security event messages.
5+
type: enhancement
6+
link: https://github.com/elastic/integrations/pull/14892
27
- version: "3.9.4"
38
changes:
49
- description: Fix parsing for message ID 746012 and 746013.

‎packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-security-connection.log‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,3 +14,4 @@ Aug 14 2019 15:09:41 siem-ftd %FTD-1-430003: AccessControlRuleAction: Block, Ac
1414
2023-03-27T12:26:00Z : %FTD-1-430001: DeviceUUID: 00009fd0-de50-11ea-b566-e4821b710000, InstanceID: 8, FirstPacketSecond: 2023-03-27T12:26:00Z, ConnectionID: 1309, SrcIP: 10.0.1.20, DstIP: 10.0.100.30, SrcPort: 54967, DstPort: 80, Protocol: tcp, IngressInterface: Inside, EgressInterface: Outside, IngressZone: Inside, EgressZone: Outside, Priority: 3, GID: 119, SID: 6, Revision: 3, Message: (http_inspect) URI has two-byte or three-byte UTF-8 encoding, Classification: Not Suspicious Traffic, User: Not Found, IntrusionPolicy: Inline IPS Policy, ACPolicy: FTD-ACP, AccessControlRuleName: PassRule, NAPPolicy: Balanced Security and Connectivity, InlineResult: Pass, IngressVRF: Global, EgressVRF: Global
1515
2019-08-16T09:33:15Z firepower %FTD-1-430002: AccessControlRuleAction: Allow, SrcIP: 10.0.1.20, DstIP: 81.2.69.144, SrcPort: 46000, DstPort: 80, Protocol: tcp, IngressInterface: inside, EgressInterface: outside, IngressZone: input-zone, EgressZone: output-zone, ACPolicy: default, AccessControlRuleName: Rule-1, Prefilter Policy: Default Prefilter Policy, User: No Authentication Required, InitiatorPackets: 2, ResponderPackets: 1, InitiatorBytes: 3000000000, ResponderBytes: 3000000000, NAPPolicy: Balanced Security and Connectivity
1616
<118>2024-11-08T07:42:25Z : %FTD-6-430002: EventPriority: Low, DeviceUUID: abcd-1234-efgh-111-abcd1234, InstanceID: 7, FirstPacketSecond: 2024-11-08T07:42:25Z, ConnectionID: 53493, AccessControlRuleAction: Allow, SrcIP: 89.160.20.156, DstIP: 89.160.20.112, ICMPType: Echo Request, ICMPCode: No Code, Protocol: icmp, IngressInterface: GRT, EgressInterface: Azure-S2S, IngressZone: GRT, EgressZone: Azure, IngressVRF: Global, EgressVRF: Global, ACPolicy: internet-access-policy, AccessControlRuleName: LOGI -> Azure TEST, Prefilter Policy: Default Prefilter Policy, InitiatorPackets: 1, ResponderPackets: 0, InitiatorBytes: 102, ResponderBytes: 0, NAPPolicy: Balanced Security and Connectivity, ClientAppDetector: AppID, EncryptPeerIP: 67.43.156.0, VPN_Action: Encrypt
17+
2019-08-15T16:07:19Z firepower %FTD-1-430003: AccessControlRuleAction: Allow, SrcIP: 10.0.1.20, DstIP: 81.2.69.144, SrcPort: 43228, DstPort: 80, NAT_InitiatorIP: 10.1.1.1, NAT_InitiatorPort: 40000, NAT_ResponderIP: 192.168.1.1, NAT_ResponderPort: 50000, Protocol: tcp, IngressInterface: inside, EgressInterface: outside, IngressZone: input-zone, EgressZone: output-zone, ACPolicy: default, AccessControlRuleName: Rule-1, Prefilter Policy: Default Prefilter Policy, User: No Authentication Required, UserAgent: Debian APT-HTTP/1.3 (1.6.11), Client: Advanced Packaging Tool, ClientVersion: 1.3, ApplicationProtocol: HTTP, WebApplication: Ubuntu, ConnectionDuration: 1, InitiatorPackets: 1359, ResponderPackets: 29001, InitiatorBytes: 97454, ResponderBytes: 41319018, NAPPolicy: Balanced Security and Connectivity, HTTPResponse: 200, ReferencedHost: eu-central-1.ec2.archive.ubuntu.com, URL: http://eu-central-1.ec2.archive.ubuntu.com/ubuntu/pool/main/m/manpages/manpages-dev_4.15-1_all.deb

‎packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-security-connection.log-expected.json‎

Lines changed: 174 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2105,6 +2105,180 @@
21052105
"tags": [
21062106
"preserve_original_event"
21072107
]
2108+
},
2109+
{
2110+
"@timestamp": "2019-08-15T16:07:19.000Z",
2111+
"cisco": {
2112+
"ftd": {
2113+
"destination_interface": "outside",
2114+
"rule_name": [
2115+
"default",
2116+
"Rule-1"
2117+
],
2118+
"security": {
2119+
"nat_dst_ip": "192.168.1.1",
2120+
"nat_dst_port": "50000",
2121+
"nat_src_ip": "10.1.1.1",
2122+
"nat_src_port": "40000"
2123+
},
2124+
"security_event": {
2125+
"ac_policy": "default",
2126+
"access_control_rule_action": "Allow",
2127+
"access_control_rule_name": "Rule-1",
2128+
"application_protocol": "HTTP",
2129+
"client": "Advanced Packaging Tool",
2130+
"client_version": "1.3",
2131+
"connection_duration": 1,
2132+
"dst_ip": "81.2.69.144",
2133+
"dst_port": 80,
2134+
"egress_interface": "outside",
2135+
"egress_zone": "output-zone",
2136+
"http_response": 200,
2137+
"ingress_interface": "inside",
2138+
"ingress_zone": "input-zone",
2139+
"initiator_bytes": 97454,
2140+
"initiator_packets": 1359,
2141+
"nap_policy": "Balanced Security and Connectivity",
2142+
"prefilter_policy": "Default Prefilter Policy",
2143+
"protocol": "tcp",
2144+
"referenced_host": "eu-central-1.ec2.archive.ubuntu.com",
2145+
"responder_bytes": 41319018,
2146+
"responder_packets": 29001,
2147+
"src_ip": "10.0.1.20",
2148+
"src_port": 43228,
2149+
"url": "http://eu-central-1.ec2.archive.ubuntu.com/ubuntu/pool/main/m/manpages/manpages-dev_4.15-1_all.deb",
2150+
"user": "No Authentication Required",
2151+
"user_agent": "Debian APT-HTTP/1.3 (1.6.11)",
2152+
"web_application": "Ubuntu"
2153+
},
2154+
"source_interface": "inside"
2155+
}
2156+
},
2157+
"destination": {
2158+
"address": "81.2.69.144",
2159+
"bytes": 41319018,
2160+
"geo": {
2161+
"city_name": "London",
2162+
"continent_name": "Europe",
2163+
"country_iso_code": "GB",
2164+
"country_name": "United Kingdom",
2165+
"location": {
2166+
"lat": 51.5142,
2167+
"lon": -0.0931
2168+
},
2169+
"region_iso_code": "GB-ENG",
2170+
"region_name": "England"
2171+
},
2172+
"ip": "81.2.69.144",
2173+
"nat": {
2174+
"ip": "192.168.1.1",
2175+
"port": 50000
2176+
},
2177+
"packets": 29001,
2178+
"port": 80
2179+
},
2180+
"ecs": {
2181+
"version": "8.17.0"
2182+
},
2183+
"event": {
2184+
"action": "connection-finished",
2185+
"category": [
2186+
"network"
2187+
],
2188+
"code": "430003",
2189+
"duration": 1000000000,
2190+
"end": "2019-08-15T16:07:19.000Z",
2191+
"kind": "event",
2192+
"original": "2019-08-15T16:07:19Z firepower %FTD-1-430003: AccessControlRuleAction: Allow, SrcIP: 10.0.1.20, DstIP: 81.2.69.144, SrcPort: 43228, DstPort: 80, NAT_InitiatorIP: 10.1.1.1, NAT_InitiatorPort: 40000, NAT_ResponderIP: 192.168.1.1, NAT_ResponderPort: 50000, Protocol: tcp, IngressInterface: inside, EgressInterface: outside, IngressZone: input-zone, EgressZone: output-zone, ACPolicy: default, AccessControlRuleName: Rule-1, Prefilter Policy: Default Prefilter Policy, User: No Authentication Required, UserAgent: Debian APT-HTTP/1.3 (1.6.11), Client: Advanced Packaging Tool, ClientVersion: 1.3, ApplicationProtocol: HTTP, WebApplication: Ubuntu, ConnectionDuration: 1, InitiatorPackets: 1359, ResponderPackets: 29001, InitiatorBytes: 97454, ResponderBytes: 41319018, NAPPolicy: Balanced Security and Connectivity, HTTPResponse: 200, ReferencedHost: eu-central-1.ec2.archive.ubuntu.com, URL: http://eu-central-1.ec2.archive.ubuntu.com/ubuntu/pool/main/m/manpages/manpages-dev_4.15-1_all.deb",
2193+
"outcome": "success",
2194+
"severity": 1,
2195+
"start": "2019-08-15T16:07:18.000Z",
2196+
"timezone": "UTC",
2197+
"type": [
2198+
"connection",
2199+
"end",
2200+
"allowed"
2201+
]
2202+
},
2203+
"host": {
2204+
"hostname": "firepower"
2205+
},
2206+
"http": {
2207+
"response": {
2208+
"status_code": 200
2209+
}
2210+
},
2211+
"log": {
2212+
"level": "alert"
2213+
},
2214+
"network": {
2215+
"application": [
2216+
"advanced packaging tool",
2217+
"ubuntu"
2218+
],
2219+
"bytes": 41416472,
2220+
"community_id": "1:e9BEufDTrN3BbL6412GOz3SWm5w=",
2221+
"iana_number": "6",
2222+
"protocol": "http",
2223+
"transport": "tcp"
2224+
},
2225+
"observer": {
2226+
"egress": {
2227+
"interface": {
2228+
"name": "outside"
2229+
},
2230+
"zone": "output-zone"
2231+
},
2232+
"hostname": "firepower",
2233+
"ingress": {
2234+
"interface": {
2235+
"name": "inside"
2236+
},
2237+
"zone": "input-zone"
2238+
},
2239+
"product": "ftd",
2240+
"type": "idps",
2241+
"vendor": "Cisco"
2242+
},
2243+
"related": {
2244+
"hosts": [
2245+
"firepower"
2246+
],
2247+
"ip": [
2248+
"10.0.1.20",
2249+
"10.1.1.1",
2250+
"81.2.69.144",
2251+
"192.168.1.1"
2252+
]
2253+
},
2254+
"rule": {
2255+
"name": "Rule-1",
2256+
"ruleset": "default"
2257+
},
2258+
"source": {
2259+
"address": "10.0.1.20",
2260+
"bytes": 97454,
2261+
"ip": "10.0.1.20",
2262+
"nat": {
2263+
"ip": "10.1.1.1",
2264+
"port": 40000
2265+
},
2266+
"packets": 1359,
2267+
"port": 43228
2268+
},
2269+
"tags": [
2270+
"preserve_original_event"
2271+
],
2272+
"url": {
2273+
"domain": "eu-central-1.ec2.archive.ubuntu.com",
2274+
"extension": "deb",
2275+
"original": "http://eu-central-1.ec2.archive.ubuntu.com/ubuntu/pool/main/m/manpages/manpages-dev_4.15-1_all.deb",
2276+
"path": "/ubuntu/pool/main/m/manpages/manpages-dev_4.15-1_all.deb",
2277+
"scheme": "http"
2278+
},
2279+
"user_agent": {
2280+
"original": "Debian APT-HTTP/1.3 (1.6.11)"
2281+
}
21082282
}
21092283
]
21102284
}

‎packages/cisco_ftd/data_stream/log/elasticsearch/ingest_pipeline/default.yml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1367,6 +1367,22 @@ processors:
13671367
target: message
13681368
id: ["430001"]
13691369
ecs: [message]
1370+
NAT_InitiatorIP:
1371+
target: nat_src_ip
1372+
id: ["430002", "430003"]
1373+
ecs: [ source.nat.ip ]
1374+
NAT_InitiatorPort:
1375+
target: nat_src_port
1376+
id: ["430002", "430003"]
1377+
ecs: [ source.nat.port ]
1378+
NAT_ResponderIP:
1379+
target: nat_dst_ip
1380+
id: ["430002", "430003"]
1381+
ecs: [ destination.nat.ip ]
1382+
NAT_ResponderPort:
1383+
target: nat_dst_port
1384+
id: ["430002", "430003"]
1385+
ecs: [ destination.nat.port ]
13701386
NAPPolicy:
13711387
target: nap_policy
13721388
id: ["430001", "430002", "430003"]

‎packages/cisco_ftd/manifest.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
format_version: "3.0.3"
22
name: cisco_ftd
33
title: Cisco FTD
4-
version: "3.9.4"
4+
version: "3.10.0"
55
description: Collect logs from Cisco FTD with Elastic Agent.
66
type: integration
77
categories:

0 commit comments

Comments
 (0)