Our Cisco ASA logs sometimes contain names that represent objects instead of the IP address.
Example:
Dec 18 05:37:49 10.163.19.1 %ASA-6-302013: Built outbound TCP connection 1372634579 for outside:54.235.189.180/443 (54.235.189.180/443) to inside:IND062GFP016/29631 (216.37.41.4/56892)
In this example, you'll see IND062GFP016 instead of an IP address (in this case for a src). I know that we could put in all of our Cisco configs the command "no names" to remove the names. However, when I looked at the CIM, it shows that the src/dest (Network Traffic data model) is a string that can represent an IPv4, IPv6, or a name.
I created new regex statements to pull out the name and alias it to either the src or dest fields. However, now my threatlist reports are not working correctly.
So my questions are:
1. Can we really use names instead of IPs?
2. If we can, then is the other parts like threatlist searches broke?
3. Are my fixes for the props.conf correct or should they be in transforms.conf?
props.conf:
EXTRACT-dest_name-dest_port = (?i)to\s(\S+?):(?P[a-z0-9_-]+?)\/(?P\d+)
EXTRACT-dest_name = (?i)to\s(\S+?):(?P[a-z0-9_-]+?)\s
EXTRACT-src_name-src_port = (?i)for\s(\S+?):(?P[a-z0-9_-]+?)\/(?P\d+)
FIELDALIAS-src_for_cisco_asa_name = src_name as src
FIELDALIAS-dest_for_cisco_asa_name = dest_name as dest
Sensible stanza names might be cisco_destination_hostname_port, cisco_destination and cisco_source_hostname_port or just use the regexes already in transforms.conf as a base. An easy way to test your regex is through a site like Rubular.com