Cisco moduleedit

This functionality is in beta and is subject to change. The design and code is less mature than official GA features and is being provided as-is with no warranties. Beta features are not subject to the support SLA of official GA features.

This is a module for Cisco network device’s logs. It includes the following filesets for receiving logs over syslog or read from a file:

  • asa fileset: supports Cisco ASA firewall logs.
  • ftd fileset: supports Cisco Firepower Threat Defense logs.
  • ios fileset: supports Cisco IOS router and switch logs.
  • nexus fileset: supports Cisco Nexus switch logs.

Cisco ASA devices also support exporting flow records using NetFlow, which is supported by the netflow module in Filebeat.

When you run the module, it performs a few tasks under the hood:

  • Sets the default paths to the log files (but don’t worry, you can override the defaults)
  • Makes sure each multiline log event gets sent as a single event
  • Uses ingest node to parse and process the log lines, shaping the data into a structure suitable for visualizing in Kibana
  • Deploys dashboards for visualizing the log data

Read the quick start to learn how to configure and run modules.

Configure the moduleedit

You can further refine the behavior of the cisco module by specifying variable settings in the modules.d/cisco.yml file, or overriding settings at the command line.

The module is by default configured to run via syslog on port 9001 for ASA and port 9002 for IOS. However it can also be configured to read from a file path. See the following example.

- module: cisco
  asa:
    enabled: true
    var.paths: ["/var/log/cisco-asa.log"]
    var.input: "file"

Variable settingsedit

Each fileset has separate variable settings for configuring the behavior of the module. If you don’t specify variable settings, the cisco module uses the defaults.

For advanced use cases, you can also override input settings. See Override input settings.

When you specify a setting at the command line, remember to prefix the setting with the module name, for example, cisco.asa.var.paths instead of asa.var.paths.

asa fileset settingsedit

Example config:

- module: cisco
  asa:
    var.syslog_host: 0.0.0.0
    var.syslog_port: 9001
    var.log_level: 5
var.paths
An array of glob-based paths that specify where to look for the log files. All patterns supported by Go Glob are also supported here. For example, you can use wildcards to fetch all files from a predefined level of subdirectories: /path/to/log/*/*.log. This fetches all .log files from the subfolders of /path/to/log. It does not fetch log files from the /path/to/log folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system.
var.log_level
An integer between 1 and 7 that allows to filter messages based on the severity level. The different severity levels supported by the Cisco ASA are:
log_level severity

1

Alert

2

Critical

3

Error

4

Warning

5

Notification

6

Informational

7

Debugging

A value of 7 (default) will not filter any messages. A lower value will drop any messages with a severity level higher than the specified value. For example, var.log_level: 3 will allow messages of level 1 (Alert), 2 (Critical) and 3 (Error). All other messages will be dropped.

var.syslog_host
The interface to listen to UDP based syslog traffic. Defaults to localhost. Set to 0.0.0.0 to bind to all available interfaces.
var.syslog_port
The UDP port to listen for syslog traffic. Defaults to 9001.
var.tags
A list of tags to include in events. Including forwarded indicates that the events did not originate on this host and causes host.name to not be added to events. Defaults to [cisco-asa, forwarded].

ftd fileset settingsedit

The Cisco FTD fileset primarily supports parsing IPv4 and IPv6 access list log messages similar to that of ASA devices as well as Security Event Syslog Messages for Intrusion, Connection, File and Malware events.

Field mappings

The ftd fileset maps Security Event Syslog Messages to the Elastic Common Schema (ECS) format. The following table illustrates the mapping from Security Event fields to ECS. The cisco.ftd prefix is used when there is no corresponding ECS field available.

Mappings for Intrusion events fields:

FTD Field Mapped fields

ApplicationProtocol

network.protocol

DstIP

destination.address

DstPort

destination.port

EgressInterface

cisco.ftd.destination_interface

GID

service.id

HTTPResponse

http.response.status_code

IngressInterface

cisco.ftd.source_interface

InlineResult

event.outcome

IntrusionPolicy

cisco.ftd.rule_name

Message

message

Protocol

network.transport

SrcIP

source.address

SrcPort

source.port

User

user.id, user.name

WebApplication

network.application

Mappings for Connection and Security Intelligence events fields:

FTD Field Mapped fields

ACPolicy

cisco.ftd.rule_name

AccessControlRuleAction

event.outcome

AccessControlRuleName

cisco.ftd.rule_name

ApplicationProtocol

network.protocol

ConnectionDuration

event.duration

DNSQuery

dns.question.name

DNSRecordType

dns.question.type

DNSResponseType

dns.response_code

DstIP

destination.address

DstPort

destination.port

EgressInterface

cisco.ftd.destination_interface

HTTPReferer

http.request.referrer

HTTPResponse

http.response.status_code

IngressInterface

cisco.ftd.source_interface

InitiatorBytes

source.bytes

InitiatorPackets

source.packets

NetBIOSDomain

host.hostname

Protocol

network.transport

ReferencedHost

url.domain

ResponderBytes

destination.bytes

ResponderPackets

destination.packets

SSLActualAction

event.outcome

SSLServerName

server.domain

SrcIP

source.address

SrcPort

source.port

URL

url.original

User

user.name

UserAgent

user_agent.original

WebApplication

network.application

originalClientSrcIP

client.address

Mappings for File and Malware events fields:

FTD Field Mapped fields

ApplicationProtocol

network.protocol

ArchiveFileName

file.name

ArchiveSHA256

file.hash.sha256

Client

network.application

DstIP

destination.address

DstPort

destination.port

FileName

file.name

FilePolicy

cisco.ftd.rule_name

FileSHA256

file.hash.sha256

FileSize

file.size

FirstPacketSecond

event.start

Protocol

network.transport

SrcIP

source.address

SrcPort

source.port

URI

url.original

User

user.name

WebApplication

network.application

Example configuration:

- module: cisco
  ftd:
    var.syslog_host: 0.0.0.0
    var.syslog_port: 9003
    var.log_level: 5
var.paths
An array of glob-based paths that specify where to look for the log files. All patterns supported by Go Glob are also supported here. For example, you can use wildcards to fetch all files from a predefined level of subdirectories: /path/to/log/*/*.log. This fetches all .log files from the subfolders of /path/to/log. It does not fetch log files from the /path/to/log folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system.
var.log_level
An integer between 1 and 7 that allows to filter messages based on the severity level. The different severity levels supported by the Cisco ASA are:
log_level severity

1

Alert

2

Critical

3

Error

4

Warning

5

Notification

6

Informational

7

Debugging

A value of 7 (default) will not filter any messages. A lower value will drop any messages with a severity level higher than the specified value. For example, var.log_level: 3 will allow messages of level 1 (Alert), 2 (Critical) and 3 (Error). All other messages will be dropped.

var.syslog_host
The interface to listen to UDP based syslog traffic. Defaults to localhost. Set to 0.0.0.0 to bind to all available interfaces.
var.syslog_port
The UDP port to listen for syslog traffic. Defaults to 9003.
var.tags
A list of tags to include in events. Including forwarded indicates that the events did not originate on this host and causes host.name to not be added to events. Defaults to [cisco-ftd, forwarded].

ios fileset settingsedit

The Cisco IOS fileset primarily supports parsing IPv4 and IPv6 access list log messages.

Example config:

- module: cisco
  ios:
    var.syslog_host: 0.0.0.0
    var.syslog_port: 9002
var.paths
An array of glob-based paths that specify where to look for the log files. All patterns supported by Go Glob are also supported here. For example, you can use wildcards to fetch all files from a predefined level of subdirectories: /path/to/log/*/*.log. This fetches all .log files from the subfolders of /path/to/log. It does not fetch log files from the /path/to/log folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system.
var.syslog_host
The interface to listen to UDP based syslog traffic. Defaults to localhost. Set to 0.0.0.0 to bind to all available interfaces.
var.syslog_port
The UDP port to listen for syslog traffic. Defaults to 9002.
var.tags
A list of tags to include in events. Including forwarded indicates that the events did not originate on this host and causes host.name to not be added to events. Defaults to [cisco-ios, forwarded].

Time zone supportedit

This module parses logs that don’t contain time zone information. For these logs, Filebeat reads the local time zone and uses it when parsing to convert the timestamp to UTC. The time zone to be used for parsing is included in the event in the event.timezone field.

To disable this conversion, the event.timezone field can be removed with the drop_fields processor.

If logs are originated from systems or applications with a different time zone to the local one, the event.timezone field can be overwritten with the original time zone using the add_fields processor.

See Processors for information about specifying processors in your config.

nexus fileset settingsedit

This functionality is experimental and may be changed or removed completely in a future release. Elastic will take a best effort approach to fix any issues, but experimental features are not subject to the support SLA of official GA features.

This was converted from RSA NetWitness log parser XML "cisconxos" device revision 134.

var.input
The input from which messages are read. One of file, tcp or udp.
var.syslog_host
The address to listen to UDP or TCP based syslog traffic. Defaults to localhost. Set to 0.0.0.0 to bind to all available interfaces.
var.syslog_port
The port to listen for syslog traffic. Defaults to 9506

Ports below 1024 require Filebeat to run as root.

var.tz_offset
By default, datetimes in the logs will be interpreted as relative to the timezone configured in the host where Filebeat is running. If ingesting logs from a host on a different timezone, use this field to set the timezone offset so that datetimes are correctly parsed. Valid values are in the form ±HH:mm, for example, -07:00 for UTC-7.
var.rsa_fields
Flag to control the addition of non-ECS fields to the event. Defaults to true, which causes both ECS and custom fields under rsa to be are added.
var.keep_raw_fields
Flag to control the addition of the raw parser fields to the event. This fields will be found under rsa.raw. The default is false.

Example dashboardedit

This module comes with a sample dashboard for ASA:

kibana cisco asa

Fieldsedit

For a description of each field in the module, see the exported fields section.