Splunk Add-on for Cisco ESA 1.2.1: Small bug report on extractions for src_user and src_ip fields

[secfrit]

I've noticed two small issues on the latest 1.2.1 app version.

• Accordingly with the latest CIM-Email (4.3.1), the field currently extracted as sender should be named src_user instead:

  [sender_field_for_cisco_esa]
  REGEX = From:\s+<([^>]*)>
  FORMAT = src_user::$1

• The src_ip field is not extracted properly, in the regex + should be used instead of * just before the src IP address part, otherwise the first part of the IP will not end up in the matching group.

  [src_dest_fields_for_cisco_esa]
  REGEX = (?:DCID|ICID)\s+\d+\s+interface\s+.[\s(]+(\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}).\s+(\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})(?:\s+port\s+(\d+))?
  FORMAT = src_ip::$1 dest_ip::$2 dest_port::$3

[dtregonning_spl]

Hi secfrit,

I looked at the second part of your request and did indeed find an issue in the way src_ip was being extracted for some log lines. I reworked your suggestion into something i believe covers all logging scenarios.

 [src_dest_fields_for_cisco_esa]
 REGEX = (?:DCID|ICID)\s+\d+\s+interface(?:[\S\s]* [\(]?)(\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}).*\s+(\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})(?:\s+port\s+(\d+))?
 FORMAT = src_ip::$1 dest_ip::$2 dest_port::$3

Happy to hear some feedback if this doesn't rectify your field extraction scenario.

Thank You Kindly
Don

[bwooden]

Thank you for this post, secfrit. I've filed an internal bug against this. If you're speaking with support, they can look it up as ADDON-7743.