I've noticed two small issues on the latest 1.2.1 app version.
Accordingly with the latest CIM-Email (4.3.1), the field currently extracted as sender should be named src_user instead:
[sender_field_for_cisco_esa]
REGEX = From:\s+<([^>]*)>
FORMAT = src_user::$1
The src_ip field is not extracted properly, in the regex +
should be used instead of *
just before the src IP address part, otherwise the first part of the IP will not end up in the matching group.
[src_dest_fields_for_cisco_esa]
REGEX = (?:DCID|ICID)\s+\d+\s+interface\s+.[\s(]+(\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}).\s+(\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})(?:\s+port\s+(\d+))?
FORMAT = src_ip::$1 dest_ip::$2 dest_port::$3
Hi secfrit,
I looked at the second part of your request and did indeed find an issue in the way src_ip was being extracted for some log lines. I reworked your suggestion into something i believe covers all logging scenarios.
[src_dest_fields_for_cisco_esa]
REGEX = (?:DCID|ICID)\s+\d+\s+interface(?:[\S\s]* [\(]?)(\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}).*\s+(\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})(?:\s+port\s+(\d+))?
FORMAT = src_ip::$1 dest_ip::$2 dest_port::$3
Happy to hear some feedback if this doesn't rectify your field extraction scenario.
Thank You Kindly
Don
Thank you for this post, secfrit. I've filed an internal bug against this. If you're speaking with support, they can look it up as ADDON-7743.