topic Field extractor for Firepower syslogs in Splunk Enterprise Security

Field extractor for Firepower syslogs

tbavarva — Thu, 16 Jul 2020 17:59:46 GMT

Hi All, I am working on Cisco Firepower field extraction.

I got 2 different patterns mentioned below:

1. For the below one, I am getting action field either "Allow" or "Block" and I am able to extract that.

Jul 16 2020 17:47:00 %FTD-1-430002: AccessControlRuleAction: Allow, SrcIP: 10.216.6.64, DstIP: 40.126.2.50, SrcPort: 57033, DstPort: 443, Protocol: tcp, IngressZone: in, EgressZone: out, ACPolicy: Azure-Policy-old, AccessControlRuleName: ASADmz_Internal_Access, Prefilter Policy: Allow_new, User: No Authentication Required, InitiatorPackets: 2, ResponderPackets: 1, InitiatorBytes: 120, ResponderBytes: 66, NAPPolicy: Unknown

2. How can I write single extractor for action field to cover below type of logs? Field action would be unknown for below pattern I believe.

Jul 16 17:47:00 UTC: %FTD-session-6-305011: Built dynamic TCP translation from Inside:10.216.6.64/57035 to Outside:10.216.3.10/57035

The same issue I am facing with ASA firewall logs also.

Any direction would be highly appreciated.

Regards,

Tejas

Re: Field extractor for Firepower syslogs

richgalloway — Thu, 16 Jul 2020 20:34:28 GMT

Have you looked the available apps in splunkbase? They may save you a lot of effort. See https://splunkbase.splunk.com/apps/#/search/firepower/

Re: Field extractor for Firepower syslogs

tbavarva — Fri, 17 Jul 2020 05:48:53 GMT

@richgalloway Thanks for your prompt response.

Sorry I missed to mention that we have latest version of Splunk i.e. 8.0 both SH and HF.

So none of these apps or add-on are compatible and cisco estreamer for Splunk app is tested on unix platform. We have installed HF on Windows server.

Can you please suggest some other solution?

Regards,

Tejas

Re: Field extractor for Firepower syslogs

richgalloway — Fri, 17 Jul 2020 12:44:06 GMT

That splunkbase doesn't say an app is compatible with a certain version does not mean that app is not compatible with that version. It's possible the app simply has not been tested. Compatibility with Splunk 8 usually hinges on which Python version the app uses. If the app does not use any Python then compatibility should not be a problem.
You can use one of the apps as a guide for building your own app.