From a1d0ce6a72157ff4a5bf36e3adde8075ce8918d5 Mon Sep 17 00:00:00 2001 From: IE Ops Date: Wed, 5 Aug 2026 12:40:22 +0000 Subject: [PATCH 1/3] =?UTF-8?q?fix:=20#0=20=E2=80=94=20cisco=5Fftd.log=20[?= =?UTF-8?q?MISSING=5FCASE]:=20Processor=20'grok'=20with=20tag=20'grok=5F?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- packages/cisco_ftd/changelog.yml | 5 + .../log/_dev/test/pipeline/test-ftd-fix.log | 3 +- .../pipeline/test-ftd-fix.log-expected.json | 92 +++++++++++++++++++ .../elasticsearch/ingest_pipeline/default.yml | 2 +- packages/cisco_ftd/manifest.yml | 2 +- 5 files changed, 101 insertions(+), 3 deletions(-) diff --git a/packages/cisco_ftd/changelog.yml b/packages/cisco_ftd/changelog.yml index 0b68ff74bab..b44bd123ac7 100644 --- a/packages/cisco_ftd/changelog.yml +++ b/packages/cisco_ftd/changelog.yml @@ -1,4 +1,9 @@ # newer versions go on top +- version: "3.13.9" + changes: + - description: Fix grok REASON pattern for message 113005 to include Account has been locked out and other valid rejection reasons. + type: bugfix + link: https://github.com/elastic/integrations/pull/1 - version: "3.13.8" changes: - description: Convert FileSize to long instead of integer so large file sizes above the 32-bit integer limit no longer fail parsing for event.code. diff --git a/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-ftd-fix.log b/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-ftd-fix.log index 22369cb082e..60038ac0cf1 100644 --- a/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-ftd-fix.log +++ b/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-ftd-fix.log @@ -55,4 +55,5 @@ May 5 17:51:17 dev01: %FTD-4-313005: No matching connection for ICMP error mess <166>May 01 2026 09:24:32Z %FTD-6-113005: %ASA-6-113005: AAA user authentication Rejected : reason = Password is expiring : server = 192.0.2.20 : user = engineer@elastic.co : user IP = 198.51.100.30 <166>May 01 2026 09:24:32Z %FTD-6-113005: %ASA-6-113005: AAA user authentication Rejected : reason = Password malformed : server = 192.0.2.20 : user = engineer@elastic.co : user IP = 198.51.100.30 <166>May 01 2026 09:24:32Z %FTD-6-113005: %ASA-6-113005: AAA user authentication Rejected : reason = Unspecified : server = 192.0.2.20 : user = **** : user IP = 198.51.100.30 -<166>May 01 2026 09:24:32Z %FTD-6-113005: %ASA-6-113005: AAA user authentication Rejected : reason = Password has expired : server = 192.0.2.20 : user = engineer@elastic.co : user IP = 198.51.100.30 \ No newline at end of file +<166>May 01 2026 09:24:32Z %FTD-6-113005: %ASA-6-113005: AAA user authentication Rejected : reason = Password has expired : server = 192.0.2.20 : user = engineer@elastic.co : user IP = 198.51.100.30 +<182>Jul 7 11:22:54 198.51.100.10 %FTD-6-113005: AAA user authentication Rejected : reason = Account has been locked out : server = 203.0.113.20 : user = ***** : user IP = 192.0.2.30 \ No newline at end of file diff --git a/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-ftd-fix.log-expected.json b/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-ftd-fix.log-expected.json index 69daa63cf48..1e7cf24c0fc 100644 --- a/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-ftd-fix.log-expected.json +++ b/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-ftd-fix.log-expected.json @@ -4302,6 +4302,98 @@ "tags": [ "preserve_original_event" ] + }, + { + "@timestamp": "2026-07-07T11:22:54.000Z", + "destination": { + "address": "203.0.113.20", + "as": { + "number": 64502, + "organization": { + "name": "Documentation ASN" + } + }, + "geo": { + "city_name": "Madrid", + "continent_name": "Europe", + "country_iso_code": "ES", + "country_name": "Spain", + "location": { + "lat": 40.41639, + "lon": -3.7025 + }, + "region_iso_code": "ES-M", + "region_name": "Madrid" + }, + "ip": "203.0.113.20" + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": "logon-failed", + "code": "113005", + "original": "<182>Jul 7 11:22:54 198.51.100.10 %FTD-6-113005: AAA user authentication Rejected : reason = Account has been locked out : server = 203.0.113.20 : user = ***** : user IP = 192.0.2.30", + "outcome": "failure", + "reason": "Account has been locked out", + "severity": 6, + "timezone": "UTC" + }, + "host": { + "hostname": "198.51.100.10" + }, + "log": { + "level": "informational", + "syslog": { + "facility": { + "code": 22 + }, + "priority": 182, + "severity": { + "code": 6 + } + } + }, + "observer": { + "hostname": "198.51.100.10", + "product": "ftd", + "type": "idps", + "vendor": "Cisco" + }, + "related": { + "hosts": [ + "198.51.100.10" + ], + "ip": [ + "192.0.2.30", + "203.0.113.20" + ] + }, + "source": { + "address": "192.0.2.30", + "as": { + "number": 64500, + "organization": { + "name": "Documentation ASN" + } + }, + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": "192.0.2.30" + }, + "tags": [ + "preserve_original_event" + ] } ] } diff --git a/packages/cisco_ftd/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/cisco_ftd/data_stream/log/elasticsearch/ingest_pipeline/default.yml index 5fccf9ab510..33269b0b863 100644 --- a/packages/cisco_ftd/data_stream/log/elasticsearch/ingest_pipeline/default.yml +++ b/packages/cisco_ftd/data_stream/log/elasticsearch/ingest_pipeline/default.yml @@ -434,7 +434,7 @@ processors: patterns: - "AAA user (authentication|authorization) Rejected(%{SPACE})?: reason = %{REASON:event.reason}(%{SPACE})?: server = %{IP:destination.address}(%{SPACE})?: user = ?(%{CISCO_USER:source.user.name}|\\*+)(%{SPACE})?: user IP = %{IP:source.address}" pattern_definitions: - REASON: (AAA failure|Account has been disabled|Invalid password|Password has expired|Password is expiring|Password malformed|Unspecified) + REASON: (AAA failure|Account has been disabled|Account has been locked out|Invalid password|Password has expired|Password is expiring|Password malformed|Unspecified) CISCO_USER: ((LOCAL\\)?(%{HOSTNAME}\\)?%{USERNAME}(@%{HOSTNAME})?(, *%{NUMBER})?) - grok: tag: grok_message_9e29df82 diff --git a/packages/cisco_ftd/manifest.yml b/packages/cisco_ftd/manifest.yml index 317acc6384b..dfd2ce4ecca 100644 --- a/packages/cisco_ftd/manifest.yml +++ b/packages/cisco_ftd/manifest.yml @@ -1,7 +1,7 @@ format_version: "3.0.3" name: cisco_ftd title: Cisco FTD -version: "3.13.8" +version: "3.13.9" description: Collect logs from Cisco FTD with Elastic Agent. type: integration categories: From ae3c066aa4b268a83d58187d9c05e672b532747f Mon Sep 17 00:00:00 2001 From: IE Ops Date: Wed, 5 Aug 2026 12:49:32 +0000 Subject: [PATCH 2/3] Update changelog PR link --- packages/cisco_ftd/changelog.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/cisco_ftd/changelog.yml b/packages/cisco_ftd/changelog.yml index b44bd123ac7..f1f0e627be6 100644 --- a/packages/cisco_ftd/changelog.yml +++ b/packages/cisco_ftd/changelog.yml @@ -3,7 +3,7 @@ changes: - description: Fix grok REASON pattern for message 113005 to include Account has been locked out and other valid rejection reasons. type: bugfix - link: https://github.com/elastic/integrations/pull/1 + link: https://github.com/elastic/integrations/pull/20552 - version: "3.13.8" changes: - description: Convert FileSize to long instead of integer so large file sizes above the 32-bit integer limit no longer fail parsing for event.code. From 428434fff33d63aec272a5cd05fa8276657cc91d Mon Sep 17 00:00:00 2001 From: Hanna Tamoudi Date: Thu, 6 Aug 2026 09:23:02 +0200 Subject: [PATCH 3/3] add additional rejection reasons --- packages/cisco_ftd/changelog.yml | 2 +- .../log/_dev/test/pipeline/test-ftd-fix.log | 3 +- .../pipeline/test-ftd-fix.log-expected.json | 92 +++++++++++++++++++ .../elasticsearch/ingest_pipeline/default.yml | 2 +- 4 files changed, 96 insertions(+), 3 deletions(-) diff --git a/packages/cisco_ftd/changelog.yml b/packages/cisco_ftd/changelog.yml index f1f0e627be6..19b93dbbcd4 100644 --- a/packages/cisco_ftd/changelog.yml +++ b/packages/cisco_ftd/changelog.yml @@ -1,7 +1,7 @@ # newer versions go on top - version: "3.13.9" changes: - - description: Fix grok REASON pattern for message 113005 to include Account has been locked out and other valid rejection reasons. + - description: Fix grok REASON pattern for message 113005 to include Account has been locked out and Users account has expired rejection reasons. type: bugfix link: https://github.com/elastic/integrations/pull/20552 - version: "3.13.8" diff --git a/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-ftd-fix.log b/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-ftd-fix.log index 60038ac0cf1..06d1f887b8c 100644 --- a/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-ftd-fix.log +++ b/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-ftd-fix.log @@ -56,4 +56,5 @@ May 5 17:51:17 dev01: %FTD-4-313005: No matching connection for ICMP error mess <166>May 01 2026 09:24:32Z %FTD-6-113005: %ASA-6-113005: AAA user authentication Rejected : reason = Password malformed : server = 192.0.2.20 : user = engineer@elastic.co : user IP = 198.51.100.30 <166>May 01 2026 09:24:32Z %FTD-6-113005: %ASA-6-113005: AAA user authentication Rejected : reason = Unspecified : server = 192.0.2.20 : user = **** : user IP = 198.51.100.30 <166>May 01 2026 09:24:32Z %FTD-6-113005: %ASA-6-113005: AAA user authentication Rejected : reason = Password has expired : server = 192.0.2.20 : user = engineer@elastic.co : user IP = 198.51.100.30 -<182>Jul 7 11:22:54 198.51.100.10 %FTD-6-113005: AAA user authentication Rejected : reason = Account has been locked out : server = 203.0.113.20 : user = ***** : user IP = 192.0.2.30 \ No newline at end of file +<182>Jul 7 11:22:54 198.51.100.10 %FTD-6-113005: AAA user authentication Rejected : reason = Account has been locked out : server = 203.0.113.20 : user = ***** : user IP = 192.0.2.30 +<182>Jul 7 11:22:54 198.51.100.10 %FTD-6-113005: AAA user authentication Rejected : reason = Users account has expired : server = 203.0.113.20 : user = ***** : user IP = 192.0.2.30 \ No newline at end of file diff --git a/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-ftd-fix.log-expected.json b/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-ftd-fix.log-expected.json index 1e7cf24c0fc..a722bcaf4e2 100644 --- a/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-ftd-fix.log-expected.json +++ b/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-ftd-fix.log-expected.json @@ -4394,6 +4394,98 @@ "tags": [ "preserve_original_event" ] + }, + { + "@timestamp": "2026-07-07T11:22:54.000Z", + "destination": { + "address": "203.0.113.20", + "as": { + "number": 64502, + "organization": { + "name": "Documentation ASN" + } + }, + "geo": { + "city_name": "Madrid", + "continent_name": "Europe", + "country_iso_code": "ES", + "country_name": "Spain", + "location": { + "lat": 40.41639, + "lon": -3.7025 + }, + "region_iso_code": "ES-M", + "region_name": "Madrid" + }, + "ip": "203.0.113.20" + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": "logon-failed", + "code": "113005", + "original": "<182>Jul 7 11:22:54 198.51.100.10 %FTD-6-113005: AAA user authentication Rejected : reason = Users account has expired : server = 203.0.113.20 : user = ***** : user IP = 192.0.2.30", + "outcome": "failure", + "reason": "Users account has expired", + "severity": 6, + "timezone": "UTC" + }, + "host": { + "hostname": "198.51.100.10" + }, + "log": { + "level": "informational", + "syslog": { + "facility": { + "code": 22 + }, + "priority": 182, + "severity": { + "code": 6 + } + } + }, + "observer": { + "hostname": "198.51.100.10", + "product": "ftd", + "type": "idps", + "vendor": "Cisco" + }, + "related": { + "hosts": [ + "198.51.100.10" + ], + "ip": [ + "192.0.2.30", + "203.0.113.20" + ] + }, + "source": { + "address": "192.0.2.30", + "as": { + "number": 64500, + "organization": { + "name": "Documentation ASN" + } + }, + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": "192.0.2.30" + }, + "tags": [ + "preserve_original_event" + ] } ] } diff --git a/packages/cisco_ftd/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/cisco_ftd/data_stream/log/elasticsearch/ingest_pipeline/default.yml index 33269b0b863..aaadc829805 100644 --- a/packages/cisco_ftd/data_stream/log/elasticsearch/ingest_pipeline/default.yml +++ b/packages/cisco_ftd/data_stream/log/elasticsearch/ingest_pipeline/default.yml @@ -434,7 +434,7 @@ processors: patterns: - "AAA user (authentication|authorization) Rejected(%{SPACE})?: reason = %{REASON:event.reason}(%{SPACE})?: server = %{IP:destination.address}(%{SPACE})?: user = ?(%{CISCO_USER:source.user.name}|\\*+)(%{SPACE})?: user IP = %{IP:source.address}" pattern_definitions: - REASON: (AAA failure|Account has been disabled|Account has been locked out|Invalid password|Password has expired|Password is expiring|Password malformed|Unspecified) + REASON: (AAA failure|Account has been disabled|Account has been locked out|Invalid password|Password has expired|Password is expiring|Password malformed|Unspecified|Users account has expired) CISCO_USER: ((LOCAL\\)?(%{HOSTNAME}\\)?%{USERNAME}(@%{HOSTNAME})?(, *%{NUMBER})?) - grok: tag: grok_message_9e29df82