ASUS ROG Router Syslog Parser for Security Onion 3.1

[scweeks]

I built a custom Elasticsearch ingest pipeline for ASUS ROG router
syslog in Security Onion 3.1 and wanted to share it with the community.

Repo: https://github.com/scweeks/securityonion-asus-router

What it does

Parses and classifies every log shape produced by ASUS ROG routers
into structured ECS fields across six datasets:

• asus.firewall — kernel netfilter ACCEPT/DROP/REJECT with full
  field extraction (source/destination IP/port/MAC, community_id,
  ingress/egress interface, TCP flags)
• asus.wireless — hostapd, wlceventd, and kernel-sourced wireless
  driver messages (SBF, WLC_SCB_*, CFG80211)
• asus.roaming — AiMesh BSS transitions (roamast, bsd)
• asus.dhcp / asus.dns — dnsmasq lease events and DNS warnings
• asus.auth — dropbear SSH authentication
• asus.system — avahi-daemon, miniupnpd, and catch-all

Architecture

Six pipeline files following SO's own dispatch convention
(syslog → vendor pipeline → common), so it fits cleanly into
the platform without modifying anything outside the local salt tree.

Tested on

• Security Onion 3.1, Elasticsearch 9.3.3
• GT-BE98 Pro (primary) + GT-AXE16000 (AiMesh node)
• Should work with any ASUS router running stock firmware

Notable fixes documented in DESIGN.md

The upstream syslog pipeline's BSD header parsing is unreliable for
ASUS traffic (no <PRI> prefix, hyphenated daemon names like
dnsmasq-dhcp that %{WORD} can't match). The pipeline parses the
header fresh from the original message field with a corrected grok
pattern that eliminates the process.name misclassification that
plagued earlier versions.

Includes a Python test harness with 30 assertion-based test cases and
a GitHub Actions CI workflow.

Happy to answer questions or take feedback from anyone running ASUS
hardware with SO.