[cisco_asa] Add grok support for 722022, 722023 logs

[jrmolin]

Type of change

• Enhancement

Proposed commit message

Add grok patterns for Cisco ASA logs with message id 722022 and 722023.

Added sample data to validate the addition during pipeline tests.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.

How to test this PR locally

cd packages/cisco_asa
elastic-package test

Related issues

• Closes [Cisco ASA] Parse 722022 and 722023 message id's #9012

[elasticmachine]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[taylor-swanson]

The grok patterns aren't extracting the inner values when a field is wrapped in angle brackets. I think for now, it is sufficient to have two patterns, one with angle brackets and one without. In theory, the first pattern should exit as soon as it doesn't see the angle bracket and it will try the next one. This happens very early in the string (it's not like it has to get all the way to the end of the pattern to find that out).

The other thing to consider is that there is a pretty well established pattern in the integration with the other grok processors, where they have two patterns, one with angle brackets, one without. I say we stick to that pattern for now. I tried a few different ideas myself, but I can't get it to quite work. If you want to have one pattern with optionals, you'd have to change the NOTSPACE pattern to something more restrictive to get it to work (basically something that doesn't include < and >).

When testing grok patterns, I like to use the pipeline simulator to do rapid testing:

POST /_ingest/pipeline/_simulate?verbose=true
{
  "pipeline" :
  {
    "description": "_description",
    "processors": [
      {
        "grok": {
          "field": "message",
          "tag": "grok_message", 
          "patterns": [
            "^Group <%{NOTSPACE:source.user.group.name}> User <%{NOTSPACE:source.user.name}> IP <%{IP:source.address}> %{GREEDYDATA:event.reason}$",
            "^Group %{NOTSPACE:source.user.group.name} User %{NOTSPACE:source.user.name} IP %{IP:source.address} %{GREEDYDATA:event.reason}$"
          ]
        }
      }
    ]
  },
  "docs": [
    {
      "_index": "index",
      "_id": "id",
      "_source": {
        "message": "Group <MY-MFA> User <src_user@myorg.com> IP <67.43.156.118> TCP SVC connection established without compression"
      }
    },
    {
      "_index": "index",
      "_id": "id",
      "_source": {
        "message": "Group MY-MFA User src_user@myorg.com IP 67.43.156.118 TCP SVC connection established without compression"
      }
    }
  ]
}

One other thing to note, it is recommended to add anchors to the patterns (^ and $). I forget the exact reasons why, but it does help with performance.

[elasticmachine]

Pinging @elastic/sec-deployment-and-devices (Team:Security-Deployment and Devices)

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 20de3ef

History

• 💚 Build #9204 succeeded 87a3e9d
• 💔 Build #9197 failed f1cdea5

[elastic-sonarqube]

Quality Gate passed

Kudos, no new issues were introduced!

0 New issues
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[taylor-swanson]

LGTM

[elasticmachine]

Package cisco_asa - 2.31.0 containing this change is available at https://epr.elastic.co/search?package=cisco_asa