Getting Data In

Cisco ASA - Logging from Access-Control Entries.

kenth
Splunk Employee
Splunk Employee

Hi,

I am logging directly to Splunk from several Cisco ASA's. I have set my ASA to log ACE entries on the notifications level and I send this level to syslog (Splunk). This should send all permitted and dropped logs to the Splunk. It seems like Splunk only recognizes the syslogs with dropped packets. How come? I have checked with normal syslog and I get both log entries.

For workaround I have to send syslog level information to splunk to be able to see permitted packets. This is not what I want because information sends the build and teardown of connections and it seems like thats how Splunk considers it's a "permitted" flow.

I am using the Splunk for Cisco Security. Anyone done this?

Tags (3)
0 Karma

kenth
Splunk Employee
Splunk Employee

I've solved this in a new and packaged app that is available on Splunkbase as "Splunk for Cisco ASA".

jgauthier
Contributor

Again,

This is an old post. But I have solved it and am happy.

Filter out the data from the host to only put in the data that the add on needs to process it's reports.

So, build a regex that captures the build lines, and the deny lines. Toss the rest!

0 Karma

jgauthier
Contributor

Kenth,

This is an old post, but I am new to this add on. I'm having the same issue, and here's what I've discovered. The field extraction for the "firewall-accept" is keyed upon the words "Built", and "connection". This phrase is only available when 'logging informational' is on. This is an obscene amount of logging.

What would be ideal is if the field extraction used the words "access-list", and "permitted". Then logging level can be lower, and you can set up the ACL to include logging for those hits to the level you want.

I did this and it worked, but not all the way. The access-list log line is different than the built connection log line, and the rest of the fields are not extracted correctly.

I've been poking around and I cannot determine how to change this area. I could use some help on that. If anyone knows, that would be fantastic.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...