The Cisco ASA (Adaptive Security Appliances) is a multipurpose firewall appliance from Cisco and is usually used for packet filtering purposes, but it supports many additional features, such as stateful filtering, application inspection, NAT, DHCP, routing, VPN, etc. This technology pack will process Cisco ASA logs, providing normalization and enrichment of common events of interest.
Supported Version(s)
- Up to version 9.x
Stream Configuration
This technology pack includes one stream:
- “Illuminate:Cisco Device Messages ”
Index Set Configuration
This technology pack includes one index set definition:
- “Cisco Devices Event Log Messages”
If this index set is already defined, then nothing will be changed. If this index set does not exist, then it will be created with retention settings of a daily rotation and 90 days of retention. These settings can be adjusted as required after installation.
Log Format Example
%ASA-6-305011: Built dynamic TCP translation from DL_172_16:x.x.x.x/1234 to L3_Internet:x.x.x.x/1234
Requirements
- Configure CISCO ASA device(s) to transmit Syslog to your Graylog server Syslog input.
What is Provided
-
Parsing rules to extract Cisco ASA logs into Graylog schema compatible fields.
-
We currently support the following event IDs:
- 106017 106021 106023 106100 106102 110002 110003 111008 111009 111010 113004 113008 113012 113019 113022 106001 106006 106016
- 302010 302014 302016 302015 302013 302020 302021 304001 305006 305011 305012 313001 313005 315011 331002
- 400010 400014 400011 400014 405001 410001
- 500004 502103
- 602304 602303 605005 607001 609001 609002 611101 611103 611102
- 710002 710005 710003 710006 713041 713049 713120 713172 713201 713257 713903 713904 713905 721018 722023 722037 716002 722012 725002 725001 725003 725007 725016 733100 737016 746014 746015 746016 750002 750003 751002 752004 752010 752012 752015 769007
