[Filebeat] NetFlow: Add Cisco ASA fields #11201
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Pinging @elastic/secops |
houndci-bot
reviewed
Mar 11, 2019
| return aclIDLength | ||
| } | ||
|
|
||
| func (u ACLIDDecoder) Decode(data []byte) (interface{}, error) { |
There was a problem hiding this comment.
exported method ACLIDDecoder.Decode should have comment or be unexported
| return aclIDLength | ||
| } | ||
|
|
||
| func (u ACLIDDecoder) MaxLength() uint16 { |
There was a problem hiding this comment.
exported method ACLIDDecoder.MaxLength should have comment or be unexported
|
|
||
| const aclIDLength = 12 | ||
|
|
||
| func (u ACLIDDecoder) MinLength() uint16 { |
There was a problem hiding this comment.
exported method ACLIDDecoder.MinLength should have comment or be unexported
| @@ -322,6 +323,34 @@ func (u UnsupportedDecoder) Decode(data []byte) (interface{}, error) { | |||
|
|
|||
| var _ Decoder = (*UnsupportedDecoder)(nil) | |||
|
|
|||
| type ACLIDDecoder struct{} | |||
There was a problem hiding this comment.
exported type ACLIDDecoder should have comment or be unexported
4 tasks
adriansr
changed the title
andrewkroh
approved these changes
Mar 27, 2019
adriansr
force-pushed
the
feature-netflow-cisco-asa
branch
from
ff7d309 to
3aee8e9
Compare
Cisco ASA NetFlow implementation requires a new field datatype, ACL ID, with 12-byte length, that encodes the following information: - First four bytes are the ACL name ID. - Next four bytes are the ACL entry ID / Object-Group ID. - Final four bytes are the Extended ACL Entry ID. Following with Logstash tradition, these fields are converted to string featuring the 3 ID's in encoded in hex and separated by a hypen.
Cisco ASA uses some custom fields for NetFlow V9. From "Cisco ASA NetFlow Implementation Guide": - 33000 NF_F_INGRESS_ACL_ID, renamed to ingress_acl_id - 33001 NF_F_EGRESS_ACL_ID, renamed to egress_acl_id - 33002 NF_F_FW_EXT_EVENT, renamed to fw_ext_event - 40000 NF_F_USERNAME, renamed to username Some devices also use the following fields, from "Information Elements for Stealthwatch v7.0": - 40001 ASAXlateSourceAddressIPV4, renamed to xlate_source_address_ipv4 - 40002 ASAXlateDestinationAddressIPV4, renamed to xlate_destination_address_ipv4 - 40003 ASAXlateSourcePort, renamed to xlate_source_port - 40004 ASAXlateDestinationPort, renamed to xlate_destination_port - 40005 ASAFirewallEvent, renamed to firewall_event
adriansr
force-pushed
the
feature-netflow-cisco-asa
branch
from
3aee8e9 to
ebea41b
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Cisco ASA uses some custom fields for NetFlow V9.
From Cisco ASA NetFlow Implementation Guide:
Some devices also use the following fields,
from Information Elements for Stealthwatch v7.0:
The ACL_ID are stored in binary format, 12-byte length, encoding the following information:
Following with Logstash tradition, these fields are converted to string featuring the 3 IDs in encoded in hex and separated by a hyphen.