topic Re: ASA Firewall events IP extract in Splunk Search

ASA Firewall events IP extract

evallja — Thu, 13 Jul 2023 11:52:20 GMT

Hello everyone,

I need to extract the first IP from ASA events, after the first IP sometimes there are 3 other IPs, sometimes 2, and sometimes 1 IP, but I need only the first one without depending on how many IPs are after the first.

2023-07-13T11:24:25+02:00 FirASA : %ASA-6-302013: Built inbound TCP connection 2907550162 for dmzIB:192.168.7.7/49446 (192.168.7.7/49446) to inside:10.100.40.4/8080 (10.100.40.4/8080)

Thank you.

Re: ASA Firewall events IP extract

Simple_Search — Thu, 13 Jul 2023 12:23:30 GMT

Hello!

The following regex will start at the beginning of the event and pull the first IP address it sees. I have provided a screen capture of an example event, hope this helps!

| rex field=_raw "(?<ipaddress>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"

Re: ASA Firewall events IP extract

evallja — Thu, 13 Jul 2023 12:41:21 GMT

Hello,

The script above is very helpful, but I just need to add one more criterion:
It should recognize the first IP that comes after the string "%ASA" because sometimes it recognizes the IP of the firewall which is the first one in the event and is always before the string "%ASA".

Thank you.

Re: ASA Firewall events IP extract

Simple_Search — Thu, 13 Jul 2023 14:08:12 GMT

Try adding the following to establish the boundary of the IP and search past the ASA message. This will get the first available IP address. If this works for you please be sure to grant some karma!

| rex field=_raw "ASA\-\d\-\d+\:.+?(\b(?<ipaddress>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}))"