Getting Data In

Cisco ASA - Logging from Access-Control Entries.

kenth
Splunk Employee
Splunk Employee

Hi,

I am logging directly to Splunk from several Cisco ASA's. I have set my ASA to log ACE entries on the notifications level and I send this level to syslog (Splunk). This should send all permitted and dropped logs to the Splunk. It seems like Splunk only recognizes the syslogs with dropped packets. How come? I have checked with normal syslog and I get both log entries.

For workaround I have to send syslog level information to splunk to be able to see permitted packets. This is not what I want because information sends the build and teardown of connections and it seems like thats how Splunk considers it's a "permitted" flow.

I am using the Splunk for Cisco Security. Anyone done this?

Tags (3)
0 Karma

kenth
Splunk Employee
Splunk Employee

I've solved this in a new and packaged app that is available on Splunkbase as "Splunk for Cisco ASA".

jgauthier
Contributor

Again,

This is an old post. But I have solved it and am happy.

Filter out the data from the host to only put in the data that the add on needs to process it's reports.

So, build a regex that captures the build lines, and the deny lines. Toss the rest!

0 Karma

jgauthier
Contributor

Kenth,

This is an old post, but I am new to this add on. I'm having the same issue, and here's what I've discovered. The field extraction for the "firewall-accept" is keyed upon the words "Built", and "connection". This phrase is only available when 'logging informational' is on. This is an obscene amount of logging.

What would be ideal is if the field extraction used the words "access-list", and "permitted". Then logging level can be lower, and you can set up the ACL to include logging for those hits to the level you want.

I did this and it worked, but not all the way. The access-list log line is different than the built connection log line, and the rest of the fields are not extracted correctly.

I've been poking around and I cannot determine how to change this area. I could use some help on that. If anyone knows, that would be fantastic.

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...