Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Filebeat] Module to Cisco Firepower Threat Defense Logs #12690

Closed
B4S71 opened this issue Jun 26, 2019 · 0 comments · Fixed by #13286
Closed

[Filebeat] Module to Cisco Firepower Threat Defense Logs #12690

B4S71 opened this issue Jun 26, 2019 · 0 comments · Fixed by #13286
Assignees
@adriansr

Comments

@B4S71
Copy link

B4S71 commented Jun 26, 2019

Similar to the ASA Module #9200, as a User, I'd like to ingest Firepower TD Logs and use within the Context of the SIEM-Dashboard.

As far as I know, Cisco uses the SNORT-Engine for IDS, so there might be related log formats with that. That being said, Cisco provides an excellent overview of their log-messages on their websites here and here.

Message IDS 430001 to 430005 are related to IDS/Malware Protection and FW. These are probably the ones that are the most interresting.
@B4S71 B4S71 changed the title [Filebeat] Module to Cisco Firepower Modules [Filebeat] Module to Cisco Firepower Logs Jun 26, 2019
@B4S71 B4S71 changed the title [Filebeat] Module to Cisco Firepower Logs [Filebeat] Module to Cisco Firepower Threat Defense Logs Jun 26, 2019
@adriansr adriansr self-assigned this Jul 29, 2019
@adriansr adriansr mentioned this issue Aug 19, 2019
Merged
adriansr added a commit to adriansr/beats that referenced this issue Aug 28, 2019
@adriansr
[Filebeat] [SIEM] Fileset for Cisco FTD logs
7ac9cdd 
This adds a new `ftd` fileset to the `cisco` module for parsing
Firepower Threat Defense logs.

As the FTD logs are a superset of the Cisco ASA logs, this PR
introduces a shared ingest pipeline that is used both by the new `ftd`
and the existing `asa` filesets.

As a side effect of this, it improves the existing ASA fileset so that
it uses custom syslog message decoding instead of relying on Filebeat's
syslog input, which has caused compatibility problems with some ASA
devices.

Closes elastic#12690
adriansr added a commit that referenced this issue Aug 28, 2019
@adriansr
[Filebeat] [SIEM] Fileset for Cisco FTD logs (#13286)
2a6c58f 
This adds a new `ftd` fileset to the `cisco` module for parsing
Firepower Threat Defense logs.

As the FTD logs are a superset of the Cisco ASA logs, this PR
introduces a shared ingest pipeline that is used both by the new `ftd`
and the existing `asa` filesets.

As a side effect of this, it improves the existing ASA fileset so that
it uses custom syslog message decoding instead of relying on Filebeat's
syslog input, which has caused compatibility problems with some ASA
devices.

Closes #12690
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@adriansr adriansr

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

[Filebeat] [SIEM] Fileset for Cisco FTD logs adriansr/beats
2 participants
@adriansr @B4S71