[cisco_asa] Add missing rejection reasons to 113005 grok pattern.

[ie-ops]

Executive summary

Added 'User was not found' as a valid rejection reason in the grok pattern for Cisco ASA message code 113005. The REASON pattern definition in the ingest pipeline's parse_113005 processor previously did not include this value, causing the grok processor to fail and emit a MISSING_CASE error when ASA devices sent authorization rejection events with this reason string. The fix extends the alternation group in the REASON custom pattern definition to include this case.

Proposed commit message

[cisco_asa] Add missing rejection reasons to 113005 grok pattern.

Root cause

The REASON pattern alternation in the parse_113005 grok processor omits 'User was not found' and 'Users account has expired', which are valid vendor-emitted rejection reason strings documented in the integration's own field-schema-analysis. The sibling parse_113015 processor already supports 'User was not found', creating an inconsistency. Any 113005 event with these reason values falls through to grok's on_failure handler.

Approach

Add 'User was not found' and 'Users account has expired' to the REASON pattern alternation in the parse_113005 grok processor (line 431 of default.yml). The sibling processor parse_113015 already includes 'User was not found' in its REASON definition; parse_113005 must be brought to parity. Add a new test fixture line for the sanitized authorization-variant event and update the expected JSON output accordingly.

Implementation

1. Step 1: Edit packages/cisco_asa/data_stream/log/elasticsearch/ingest_pipeline/default.yml — in the parse_113005 processor (line 431), extend the REASON alternation from '(AAA failure|Account has been disabled|Invalid password|Password is expiring|Password has expired|Password malformed|Unspecified|Account has been locked out)' to also include '|Users account has expired|User was not found'.
2. Step 2: Add a new test input line to packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-additional-messages.log for the sanitized authorization-variant event: 'Jun 26 18:04:40 198.51.100.10 %ASA-6-113005: AAA user authorization Rejected : reason = User was not found : server = 0.0.0.0 : user = alice.johnson : user IP = 198.51.100.20'.
3. Step 3: Add the corresponding expected output block to packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-additional-messages.log-expected.json, modelling it after existing 113005 blocks, with cisco.asa.rejection_reason = 'User was not found', event.outcome = 'failure', event.code = '113005', source.user.name = 'alice.johnson', and destination.address = '0.0.0.0'.
4. Step 4: Prepend a new patch version entry to packages/cisco_asa/changelog.yml: version 2.45.3, type bugfix, description: "Add 'User was not found' and 'Users account has expired' as valid rejection reasons for ASA 113005 messages."
5. Step 5: Update the version field in packages/cisco_asa/manifest.yml from '2.45.2' to '2.45.3'.
6. Step 6: Run 'elastic-package test pipeline -v' scoped to the cisco_asa package to confirm the new fixture passes and no existing fixtures regress.

Pipeline changes

• Modify parse_113005 grok processor pattern_definitions.REASON (default.yml line 431): add '|Users account has expired|User was not found' to the alternation so the full set matches parse_113015's REASON definition.

Field / mapping changes

—

Sanitized error message

Processor 'grok' with tag 'parse_113005' in pipeline 'logs-cisco_asa.log-default' failed with message '[on_failure_message]'

Sanitized log (event_sanitized excerpt)

Jun 26 18:04:40 198.51.100.10 %ASA-6-113005: AAA user authorization Rejected : reason = User was not found : server = 0.0.0.0 : user = alice.johnson : user IP = 198.51.100.20

Reviewer concerns

• The test fixture uses 198.51.100.20 as the source IP, which resolves to GeoIP/ASN enrichment data in the expected JSON; reviewers should confirm the expected output matches their local GeoIP database version or that the fixture was generated against the canonical test stack.
• The changelog link references pull/1 as a placeholder — this should be updated to the actual PR number before merge.

Self-review findings

—

Risk and classification

• Plan risk level: low
• Tags: pipeline, processors, test-fixture, ingest
• Impact: medium

Links

• Issue: (no issue number)
• Issue title: cisco_asa.log [MISSING_CASE]: Processor 'grok' with tag 'parse_113005' in pipeline 'logs-cisco_asa.log…
• Pipeline case: 9e914042aeb5f5a3

[github-actions]

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[elastic-vault-github-plugin-prod]

✅ All changelog entries have the correct PR link.

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[infra-vault-gh-plugin-prod]

💚 Build Succeeded

• Buildkite Build
• Commit: c73d902

[infra-vault-gh-plugin-prod]

Pinging @elastic/integration-experience (Team:Integration-Experience)

[vera-review-bot]

Severity: 🟡 Medium confidence: medium path: packages/cisco_asa/data_stream/log/elasticsearch/ingest_pipeline/default.yml:432

The REASON alternation in parse_113005 is a closed list, so any rejection reason not enumerated still throws a grok failure; replace it with a delimiter-bounded %{DATA} capture so all reasons parse without further patches.

Details

The parse_113005 grok has no ignore_failure, so a 113005 message whose reason string is absent from this alternation raises a grok exception and the event is routed to the pipeline's on_failure handler with an error instead of being parsed. Extending the list one string at a time does not remove that failure mode, it only removes the strings that have already been reported: changelog.yml shows the same alternation was widened in 2.45.9 ("Users account has expired") and is widened again here in 2.45.11 ("User was not found"). The reason value is delimited unambiguously by " : server = ", so it does not need to be enumerated to be captured correctly. The same brittleness is visible in the sibling parse_113015 pattern at line 473, whose REASON list has drifted out of sync with this one (it lacks "Account has been locked out" and "Users account has expired"), which is the maintenance cost of enumerating rather than delimiting.

Recommendation:

Capture the reason with a non-greedy %{DATA} bounded by the existing : server = delimiter and drop the REASON definition. %{DATA} stops at the first : server = , so the captured value is identical to what the alternation produces today (no trailing space), and unknown reasons parse instead of failing:

  - grok:
      if: "ctx._temp_.cisco.message_id == '113005'"
      tag: parse_113005
      description: "113005"
      field: "message"
      patterns:
      - "AAA user %{AUTH} Rejected(%{SPACE})?: reason = %{DATA:_temp_.cisco.rejection_reason}(%{SPACE})?: server = %{IPORHOST:destination.address}(%{SPACE})?: user = ?(%{CISCO_USER:source.user.name}|)(%{SPACE})?: user IP = %{IPORNONE}"
      pattern_definitions:
        AUTH: (authentication|authorization)
        USERNAME: "[a-zA-Z0-9._'-]+"
        CISCO_USER: (?:\*\*\*\*\*|(?:(?:LOCAL\\)?(?:%{HOSTNAME}\\)?%{USERNAME}\$?(?:@%{HOSTNAME})?(?:, *%{NUMBER})?))
        IPORNONE: (%{IP:source.address}|None)

The same treatment applied to parse_113015 would keep the two message IDs from drifting apart again.

---

🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.

[vera-review-bot]

Review summary

Issues found across the latest commits c73d902 — 1 medium

• 🟡 The REASON alternation in parse_113005 is a closed list, so any rejection reason not enumerated still throws a grok failure (link) (Unresolved)

A new commit triggers another review — at most once every 15 minutes. I skip the PR while it's approved or has merge conflicts.

🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.

[Niceplace]

LGTM but do we want to do something about explicit REASON v.s. %{DATA} block ?

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request

[haetamoudi]

@Niceplace fair point, here is some past discussion on the topic

[elastic-vault-github-plugin-prod]

Package cisco_asa - 2.45.11 containing this change is available at https://epr.elastic.co/package/cisco_asa/2.45.11/