Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Cisco ASA] Fix the handling of spaces in 113005 messages #7216

Merged
merged 2 commits into from Aug 2, 2023

Conversation

chemamartinez
Copy link
Contributor

What does this PR do?

It fixes the parsing of a 113005 Cisco ASA message as follows:

Jul  1 09:27:13 216.160.83.56 : %ASA-6-113005: AAA user authentication Rejected : reason = AAA failure : server = 81.2.69.142 : user = 123 : user IP = 89.160.20.112

The grok processor failed because of an unexpected space after AAA user authentication Rejected. This can potentially happen with every field so now the pattern expects that every value can be followed by spaces.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.

@chemamartinez chemamartinez marked this pull request as ready for review August 2, 2023 10:08
@chemamartinez chemamartinez requested a review from a team as a code owner August 2, 2023 10:08
@elasticmachine
Copy link

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

@elasticmachine
Copy link

elasticmachine commented Aug 2, 2023

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview preview

Expand to view the summary

Build stats

  • Start Time: 2023-08-02T10:08:30.710+0000

  • Duration: 17 min 42 sec

Test stats 🧪

Test Results
Failed 0
Passed 23
Skipped 0
Total 23

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

  • /test : Re-trigger the build.

@elasticmachine
Copy link

🌐 Coverage report

Name Metrics % (covered/total) Diff
Packages 100.0% (1/1) 💚
Files 100.0% (1/1) 💚
Classes 100.0% (1/1) 💚
Methods 94.444% (17/18) 👍 7.583
Lines 69.824% (1548/2217) 👎 -21.92
Conditionals 100.0% (0/0) 💚

Copy link
Contributor

@ShourieG ShourieG left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Lgtm

@chemamartinez chemamartinez merged commit d90d67a into elastic:main Aug 2, 2023
4 checks passed
@elasticmachine
Copy link

Package cisco_asa - 2.20.1 containing this change is available at https://epr.elastic.co/search?package=cisco_asa

gizas pushed a commit that referenced this pull request Sep 5, 2023
It fixes the parsing of 113005 Cisco ASA messages. The grok processor failed because of an unexpected space after `AAA user authentication Rejected`. This can potentially happen with every field so now the pattern expects that every value can be followed by spaces.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants