Skip to content

Commit 557e2ee

Browse files
qcorporationqcorporation
authored
[ER] Enhancement for Cisco IOS XR Integration (#15865)
# Rationale - able to isolate message and a dedicated grok pattern for pulling out hostname - generated pipeline tests for the new message formats - handled the space/no space separation for the dissect_login scenario - fixed missing ecs fields, related.hosts and source.domain
1 parent 77fbb14 commit 557e2ee

File tree

7 files changed

+207
-4
lines changed

7 files changed

+207
-4
lines changed

‎packages/cisco_ios/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "1.33.0"
3+
changes:
4+
- description: Enhancements to parse 4 addition log formats with hostname
5+
type: enhancement
6+
link: https://github.com/elastic/integrations/pull/15865
27
- version: "1.32.1"
38
changes:
49
- description: Generate processor tags and normalize error handler.

‎packages/cisco_ios/data_stream/log/_dev/test/pipeline/test-syslog.log‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,3 +18,7 @@
1818
<182>: host-1: 84526125: Jan 23 14:53:33.953 CET: %FMANFP-6-IPV6ACCESSLOGP: R0/0: fman_fp_image: list ACL-IPv6-OUTSIDE-2-AS51871 permitted tcp 2a02:cf40::(443) -> 2a02:cf41::(53652), 8 packets
1919
<190>Oct 7 07:19:44 internet-primary-mgmt RP/0/RP0/CPU0:Oct 7 07:19:43.630 UTC: ipv4_acl_mgr[310]: %ACL-IPV4_ACL-6-IPACCESSLOGP : access-list outgoing-to-VCS-GW deny tcp 89.160.20.128(39527) -> 89.160.20.128(1830), 1 packet
2020
<190>Oct 7 08:16:04 irgendwo12-mgmt LC/0/0/CPU0:Oct 7 08:16:04.041 UTC: nfsvr[244]: %MGBL-NETFLOW-6-INFO_CACHE_SIZE_EXCEEDED : Cache size of 10000 for monitor FM has been exceeded
21+
<181>3102: hostname: Sep 30 08:14:33.148: %SECLOGIN-5-LOGIN_SUCCESS: Login Success [user: _username] [Source: IP][localport: 22] at 08:14:33 UTC Tue Sep 30 2025
22+
<182>864: hostname RP/0/RP0/CPU0:Sep 30 08:19:30.593 UTC: SSHD_[67004]: %SECURITY-SSHD-6-INFO_GENERAL : Data is tampered, Integrity check failed
23+
<182>2300: hostname RP/0/RP0/CPU0:Sep 30 08:17:43.664 UTC: SSHD_[68399]: %SECURITY-SSHD-6-INFO_GENERAL : Data is tampered, Integrity check failed
24+
<179>7626: hostname RP/0/RP0/CPU0:Sep 30 07:59:58.665 UTC: plat_sl_client[313]: %LICENSE-PLAT_CLIENT-3-NOT_IN_FCM : Not in FCM. SLR is available only for FCM license. Please enable FCM from config to start using SLR.

‎packages/cisco_ios/data_stream/log/_dev/test/pipeline/test-syslog.log-expected.json‎

Lines changed: 186 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -884,6 +884,7 @@
884884
]
885885
},
886886
{
887+
"@timestamp": "2025-10-07T07:19:43.630Z",
887888
"cisco": {
888889
"ios": {
889890
"access_list": "outgoing-to-VCS-GW",
@@ -981,6 +982,7 @@
981982
]
982983
},
983984
{
985+
"@timestamp": "2025-10-07T08:16:04.041Z",
984986
"cisco": {
985987
"ios": {
986988
"facility": "MGBL-NETFLOW"
@@ -1017,6 +1019,190 @@
10171019
"tags": [
10181020
"preserve_original_event"
10191021
]
1022+
},
1023+
{
1024+
"@timestamp": "2025-09-30T08:14:33.148Z",
1025+
"cisco": {
1026+
"ios": {
1027+
"action": "Login",
1028+
"facility": "SECLOGIN",
1029+
"message_count": 3102
1030+
}
1031+
},
1032+
"destination": {
1033+
"port": 22
1034+
},
1035+
"ecs": {
1036+
"version": "8.17.0"
1037+
},
1038+
"event": {
1039+
"category": [
1040+
"network"
1041+
],
1042+
"code": "LOGIN_SUCCESS",
1043+
"original": "<181>3102: hostname: Sep 30 08:14:33.148: %SECLOGIN-5-LOGIN_SUCCESS: Login Success [user: _username] [Source: IP][localport: 22] at 08:14:33 UTC Tue Sep 30 2025",
1044+
"provider": "firewall",
1045+
"sequence": 3102,
1046+
"severity": 5,
1047+
"timezone": "UTC",
1048+
"type": [
1049+
"info"
1050+
]
1051+
},
1052+
"log": {
1053+
"level": "notification",
1054+
"syslog": {
1055+
"hostname": "hostname",
1056+
"priority": 181
1057+
}
1058+
},
1059+
"message": "Login Success [user: _username] [Source: IP][localport: 22] at 08:14:33 UTC Tue Sep 30 2025",
1060+
"observer": {
1061+
"product": "IOS",
1062+
"type": "firewall",
1063+
"vendor": "Cisco"
1064+
},
1065+
"related": {
1066+
"hosts": [
1067+
"IP"
1068+
],
1069+
"user": [
1070+
"_username"
1071+
]
1072+
},
1073+
"source": {
1074+
"address": "IP",
1075+
"domain": "IP",
1076+
"user": {
1077+
"name": "_username"
1078+
}
1079+
},
1080+
"tags": [
1081+
"preserve_original_event"
1082+
]
1083+
},
1084+
{
1085+
"@timestamp": "2025-09-30T08:19:30.593Z",
1086+
"cisco": {
1087+
"ios": {
1088+
"facility": "SECURITY-SSHD",
1089+
"message_count": 864
1090+
}
1091+
},
1092+
"ecs": {
1093+
"version": "8.17.0"
1094+
},
1095+
"event": {
1096+
"category": [
1097+
"network"
1098+
],
1099+
"code": "INFO_GENERAL",
1100+
"original": "<182>864: hostname RP/0/RP0/CPU0:Sep 30 08:19:30.593 UTC: SSHD_[67004]: %SECURITY-SSHD-6-INFO_GENERAL : Data is tampered, Integrity check failed",
1101+
"provider": "firewall",
1102+
"sequence": 864,
1103+
"severity": 6,
1104+
"type": [
1105+
"info"
1106+
]
1107+
},
1108+
"log": {
1109+
"level": "informational",
1110+
"syslog": {
1111+
"hostname": "hostname",
1112+
"priority": 182
1113+
}
1114+
},
1115+
"message": "Data is tampered, Integrity check failed",
1116+
"observer": {
1117+
"product": "IOS",
1118+
"type": "firewall",
1119+
"vendor": "Cisco"
1120+
},
1121+
"tags": [
1122+
"preserve_original_event"
1123+
]
1124+
},
1125+
{
1126+
"@timestamp": "2025-09-30T08:17:43.664Z",
1127+
"cisco": {
1128+
"ios": {
1129+
"facility": "SECURITY-SSHD",
1130+
"message_count": 2300
1131+
}
1132+
},
1133+
"ecs": {
1134+
"version": "8.17.0"
1135+
},
1136+
"event": {
1137+
"category": [
1138+
"network"
1139+
],
1140+
"code": "INFO_GENERAL",
1141+
"original": "<182>2300: hostname RP/0/RP0/CPU0:Sep 30 08:17:43.664 UTC: SSHD_[68399]: %SECURITY-SSHD-6-INFO_GENERAL : Data is tampered, Integrity check failed",
1142+
"provider": "firewall",
1143+
"sequence": 2300,
1144+
"severity": 6,
1145+
"type": [
1146+
"info"
1147+
]
1148+
},
1149+
"log": {
1150+
"level": "informational",
1151+
"syslog": {
1152+
"hostname": "hostname",
1153+
"priority": 182
1154+
}
1155+
},
1156+
"message": "Data is tampered, Integrity check failed",
1157+
"observer": {
1158+
"product": "IOS",
1159+
"type": "firewall",
1160+
"vendor": "Cisco"
1161+
},
1162+
"tags": [
1163+
"preserve_original_event"
1164+
]
1165+
},
1166+
{
1167+
"@timestamp": "2025-09-30T07:59:58.665Z",
1168+
"cisco": {
1169+
"ios": {
1170+
"facility": "LICENSE-PLAT_CLIENT",
1171+
"message_count": 7626
1172+
}
1173+
},
1174+
"ecs": {
1175+
"version": "8.17.0"
1176+
},
1177+
"event": {
1178+
"category": [
1179+
"network"
1180+
],
1181+
"code": "NOT_IN_FCM",
1182+
"original": "<179>7626: hostname RP/0/RP0/CPU0:Sep 30 07:59:58.665 UTC: plat_sl_client[313]: %LICENSE-PLAT_CLIENT-3-NOT_IN_FCM : Not in FCM. SLR is available only for FCM license. Please enable FCM from config to start using SLR.",
1183+
"provider": "firewall",
1184+
"sequence": 7626,
1185+
"severity": 3,
1186+
"type": [
1187+
"info"
1188+
]
1189+
},
1190+
"log": {
1191+
"level": "error",
1192+
"syslog": {
1193+
"hostname": "hostname",
1194+
"priority": 179
1195+
}
1196+
},
1197+
"message": "Not in FCM. SLR is available only for FCM license. Please enable FCM from config to start using SLR.",
1198+
"observer": {
1199+
"product": "IOS",
1200+
"type": "firewall",
1201+
"vendor": "Cisco"
1202+
},
1203+
"tags": [
1204+
"preserve_original_event"
1205+
]
10201206
}
10211207
]
10221208
}

‎packages/cisco_ios/data_stream/log/elasticsearch/ingest_pipeline/default.yml‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,7 @@ processors:
6060
- '^%{CISCO_PRIORITY_MSGCOUNT}?%{SYSLOGTIMESTAMP} %{IP} (?:%{CISCO_HOSTNAME:log.syslog.hostname}: )?(?:%{NUMBER:cisco.ios.sequence}: )?(?:%{CISCO_UPTIME:cisco.ios.uptime}|%{CISCO_TIMESTAMP}): %{GREEDYDATA:_temp_.message}$'
6161
- '^%{CISCO_PRIORITY_MSGCOUNT}?%{SYSLOGTIMESTAMP} (?:%{IP}|%{CISCO_HOSTNAME:log.syslog.hostname}) %{NUMBER:cisco.ios.sequence}: (?:%{CISCO_UPTIME:cisco.ios.uptime}|%{CISCO_TIMESTAMP}): %{GREEDYDATA:_temp_.message}$'
6262
- '^%{CISCO_PRIORITY_MSGCOUNT}?%{CISCO_TIMESTAMP:_temp_.timestamp}: %{GREEDYDATA:_temp_.message}$'
63+
- '^%{CISCO_PRIORITY_MSGCOUNT}?(?:%{SYSLOGTIMESTAMP} )?(%{IP}|%{CISCO_HOSTNAME:log.syslog.hostname}) %{DATA}:%{CISCO_TIMESTAMP}%{GREEDYDATA}%%{GREEDYDATA:message}$'
6364
- '^%{CISCO_PRIORITY_MSGCOUNT}?(?:(?:%{IP}|%{CISCO_HOSTNAME:log.syslog.hostname})(?:: \*%{DATA}:|:?)? )?(?:%{NUMBER:cisco.ios.sequence}: )?(?:%{CISCO_UPTIME:cisco.ios.uptime}|%{CISCO_TIMESTAMP:_temp_.timestamp}): %{GREEDYDATA:_temp_.message}$'
6465
- '^%{SYSLOGTIMESTAMP} (?:%{IP}|%{HOSTNAME:log.syslog.hostname}) %{CISCO_PRIORITY_MSGCOUNT}?(?:%{NUMBER:cisco.ios.sequence}: )(?:(?:%{CISCO_UPTIME:cisco.ios.uptime}|%{CISCO_TIMESTAMP}): )?%{GREEDYDATA:_temp_.message}$'
6566
- '^%{CISCO_PRIORITY_MSGCOUNT}?%{SYSLOGTIMESTAMP} (?:%{IP:log.syslog.hostname}|%{CISCO_HOSTNAME:log.syslog.hostname}) %{GREEDYDATA:_temp_.message}$'
@@ -284,10 +285,11 @@ processors:
284285
tag: dissect_gnp
285286
pattern: "list %{cisco.ios.access_list} %{_temp_.event.action} %{network.iana_number} %{source.address} %{} %{destination.address}, %{source.packets} packet"
286287
if: "['IPACCESSLOGNP', 'ACCESSLOGNP'].contains(ctx.event?.code)"
287-
- dissect:
288+
- grok:
288289
field: message
289-
tag: dissect_login
290-
pattern: "%{cisco.ios.action} %{_temp_.event.action} [user: %{source.user.name}] [Source: %{source.address}] [localport: %{destination.port}] at %{}"
290+
tag: grok_login
291+
patterns:
292+
- "%{DATA:cisco.ios.action} %{WORD:_temp_.event.action} \\[user: %{DATA:source.user.name}\\] \\[Source: %{DATA:source.address}\\]\\s*\\[localport: %{INT:destination.port}\\]"
291293
if: "ctx.event?.code == 'LOGIN_SUCCESS'"
292294
- dissect:
293295
field: message

‎packages/cisco_ios/data_stream/log/fields/ecs.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -82,6 +82,8 @@
8282
name: observer.type
8383
- external: ecs
8484
name: observer.vendor
85+
- external: ecs
86+
name: related.hosts
8587
- external: ecs
8688
name: related.ip
8789
- external: ecs
@@ -90,6 +92,8 @@
9092
name: source.address
9193
- external: ecs
9294
name: source.bytes
95+
- external: ecs
96+
name: source.domain
9397
- external: ecs
9498
name: source.ip
9599
- external: ecs

‎packages/cisco_ios/docs/README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -203,13 +203,15 @@ An example event for `log` looks as following:
203203
| observer.type | The type of the observer the data is coming from. There is no predefined list of observer types. Some examples are `forwarder`, `firewall`, `ids`, `ips`, `proxy`, `poller`, `sensor`, `APM server`. | keyword |
204204
| observer.vendor | Vendor name of the observer. | keyword |
205205
| process.program | Process from syslog header. | keyword |
206+
| related.hosts | All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. | keyword |
206207
| related.ip | All of the IPs seen on your event. | ip |
207208
| related.user | All the user names or other user identifiers seen on the event. | keyword |
208209
| source.address | Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword |
209210
| source.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long |
210211
| source.as.organization.name | Organization name. | keyword |
211212
| source.as.organization.name.text | Multi-field of `source.as.organization.name`. | match_only_text |
212213
| source.bytes | Bytes sent from the source to the destination. | long |
214+
| source.domain | The domain name of the source system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | keyword |
213215
| source.geo.city_name | City name. | keyword |
214216
| source.geo.continent_name | Name of the continent. | keyword |
215217
| source.geo.country_iso_code | Country ISO code. | keyword |

‎packages/cisco_ios/manifest.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
format_version: "3.0.3"
22
name: cisco_ios
33
title: Cisco IOS
4-
version: "1.32.1"
4+
version: "1.33.0"
55
description: Collect logs from Cisco IOS with Elastic Agent.
66
type: integration
77
categories:

0 commit comments

Comments
 (0)