All Apps and Add-ons

Splunk Add-on for Cisco ESA 1.2.1: Small bug report on extractions for src_user and src_ip fields

Explorer

I've noticed two small issues on the latest 1.2.1 app version.

  • Accordingly with the latest CIM-Email (4.3.1), the field currently extracted as sender should be named src_user instead:

    [sender_field_for_cisco_esa]
    REGEX = From:\s+<([^>]*)>
    FORMAT = src_user::$1

  • The src_ip field is not extracted properly, in the regex + should be used instead of * just before the src IP address part, otherwise the first part of the IP will not end up in the matching group.

    [src_dest_fields_for_cisco_esa]
    REGEX = (?:DCID|ICID)\s+\d+\s+interface\s+.[\s(]+(\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}).\s+(\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})(?:\s+port\s+(\d+))?
    FORMAT = src_ip::$1 dest_ip::$2 dest_port::$3

Splunk Employee
Splunk Employee

Hi secfrit,

I looked at the second part of your request and did indeed find an issue in the way src_ip was being extracted for some log lines. I reworked your suggestion into something i believe covers all logging scenarios.

 [src_dest_fields_for_cisco_esa]
 REGEX = (?:DCID|ICID)\s+\d+\s+interface(?:[\S\s]* [\(]?)(\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}).*\s+(\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})(?:\s+port\s+(\d+))?
 FORMAT = src_ip::$1 dest_ip::$2 dest_port::$3

Happy to hear some feedback if this doesn't rectify your field extraction scenario.

Thank You Kindly
Don

0 Karma

Splunk Employee
Splunk Employee

Thank you for this post, secfrit. I've filed an internal bug against this. If you're speaking with support, they can look it up as ADDON-7743.

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!