[cisco_ftd] Fix 113005 REASON pattern to include locked out and other r… - #20552
Conversation
ie-ops
added
enhancement
✅ Elastic Docs Style Checker (Vale)No issues found on modified lines! The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale. |
|
Pinging @elastic/integration-experience (Team:Integration-Experience) |
![vera-review-bot[bot]](https://avatars.githubusercontent.com/in/3297022?s=60&v=4){kind=small}
| - "AAA user (authentication|authorization) Rejected(%{SPACE})?: reason = %{REASON:event.reason}(%{SPACE})?: server = %{IP:destination.address}(%{SPACE})?: user = ?(%{CISCO_USER:source.user.name}|\\*+)(%{SPACE})?: user IP = %{IP:source.address}" | ||
| pattern_definitions: | ||
| REASON: (AAA failure|Account has been disabled|Invalid password|Password has expired|Password is expiring|Password malformed|Unspecified) | ||
| REASON: (AAA failure|Account has been disabled|Account has been locked out|Invalid password|Password has expired|Password is expiring|Password malformed|Unspecified) |
There was a problem hiding this comment.
Severity: 🟡 Medium confidence: medium path: packages/cisco_ftd/data_stream/log/elasticsearch/ingest_pipeline/default.yml:437
The REASON alternation still omits "Users account has expired", which the sibling cisco_asa package already accepts for the same 113005 message; add it so those logs parse instead of hitting the grok failure handler.
Details
cisco_asa parses the identical %ASA-6-113005 message and its REASON alternation (packages/cisco_asa/data_stream/log/elasticsearch/ingest_pipeline/default.yml:432) is (AAA failure|Account has been disabled|Invalid password|Password is expiring|Password has expired|Password malformed|Unspecified|Account has been locked out|Users account has expired). After this change the cisco_ftd list matches cisco_asa except for Users account has expired. FTD devices emit ASA-formatted 113005 records — the fixtures added by the previous release in test-ftd-fix.log lines 55-58 literally contain the %ASA-6-113005: prefix — so an FTD log with reason = Users account has expired still fails this grok today. The processor has no ignore_failure, so the document falls through to the pipeline's failure handler: event.reason, destination.address, source.user.name and source.address are all left unset and the event is tagged as a parse error. That is the same defect this PR is fixing for the locked-out reason.
Recommendation:
Add the remaining reason string so the FTD list is on par with cisco_asa:
pattern_definitions:
REASON: (AAA failure|Account has been disabled|Account has been locked out|Invalid password|Password has expired|Password is expiring|Password malformed|Unspecified|Users account has expired)
CISCO_USER: ((LOCAL\\)?(%{HOSTNAME}\\)?%{USERNAME}(@%{HOSTNAME})?(, *%{NUMBER})?)and cover it in the fixture next to the locked-out line in data_stream/log/_dev/test/pipeline/test-ftd-fix.log:
<182>Jul 7 11:22:54 198.51.100.10 %FTD-6-113005: AAA user authentication Rejected : reason = Users account has expired : server = 203.0.113.20 : user = ***** : user IP = 192.0.2.30
then regenerate the expected document with elastic-package test pipeline -g.
🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills
⚠️ Automated review — verify suggestions before applying.
There was a problem hiding this comment.
@haetamoudi The same message appears on #20567, do we want to keep an explicit list or does it make sense to move to a more flexible container for this field ?
🚀 Benchmarks reportTo see the full report comment with |
|
✅ All changelog entries have the correct PR link. |
|
No issues across the latest commits 428434f. Review summaryIssues found across earlier commits ae3c066 — 1 medium, 1 low
🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills
|
💚 Build Succeeded
History
|
|
Queued — the merge queue status continues in this comment ↓. |
Merge Queue Status
Required conditions to enter a queue
|
☑️ The pull request has been merged manuallyDetailsThe pull request has been merged manually at 8ae28fa |
|
Package cisco_ftd - 3.13.9 containing this change is available at https://epr.elastic.co/package/cisco_ftd/3.13.9/ |
4 participants
Executive summary
The fix adds 'Account has been locked out' to the REASON grok pattern for Cisco FTD message 113005. The existing pattern only matched a fixed set of rejection reasons, causing a MISSING_CASE error when the AAA server returned this particular locked-out message. Adding the new reason string to the alternation group allows the grok processor to successfully parse these events.
Proposed commit message
Root cause
The REASON pattern_definition in the grok_message_800e7540 processor only lists two rejection reasons (AAA failure|Account has been disabled), but Cisco FTD legitimately emits 'Account has been locked out' and several other valid reason strings for message 113005; the pattern was never extended to cover the full documented set.
Approach
Extend the REASON pattern_definition in the grok_message_800e7540 processor (message ID 113005) from its current two-value alternation to the full set of documented Cisco FTD rejection reasons, mirroring the complete list already present in the cisco_asa integration. Add a pipeline test fixture entry for the 'Account has been locked out' reason using the sanitized event. Bump the package version with a bugfix changelog entry.
Implementation
(AAA failure|Account has been disabled)to(AAA failure|Account has been disabled|Account has been locked out|Invalid password|Password has expired|Password is expiring|Password malformed|Unspecified)— matching the full set used in the cisco_asa integration.<182>Jul 7 11:22:54 198.51.100.10 %FTD-6-113005: AAA user authentication Rejected : reason = Account has been locked out : server = 203.0.113.20 : user = ***** : user IP = 192.0.2.30elastic-package test pipelineagainst the cisco_ftd package to confirm all existing and new test fixtures pass.Pipeline changes
(AAA failure|Account has been disabled)to(AAA failure|Account has been disabled|Account has been locked out|Invalid password|Password has expired|Password is expiring|Password malformed|Unspecified)Field / mapping changes
—
Sanitized error message
Processor 'grok' with tag 'grok_message_800e7540' in pipeline 'logs-cisco_ftd.log-default' failed with message '[on_failure_message]'Sanitized log (
event_sanitizedexcerpt)<182>Jul 7 11:22:54 198.51.100.10 %FTD-6-113005: AAA user authentication Rejected : reason = Account has been locked out : server = 203.0.113.20 : user = ***** : user IP = 192.0.2.30Reviewer concerns
[^:]+) might be more resilient, but that is a separate enhancement decision.\ No newline at end of file), which is cosmetically untidy but functionally harmless for pipeline tests.Self-review findings
—
Risk and classification
Links
046694414ff152f6