Splunk Search

ASA Firewall events IP extract

evallja
Path Finder

Hello everyone,

I need to extract the first IP from ASA events, after the first IP sometimes there are 3 other IPs, sometimes 2, and sometimes 1 IP, but I need only the first one without depending on how many IPs are after the first.

2023-07-13T11:24:25+02:00 FirASA : %ASA-6-302013: Built inbound TCP connection 2907550162 for dmzIB:192.168.7.7/49446 (192.168.7.7/49446) to inside:10.100.40.4/8080 (10.100.40.4/8080)

Thank you.

Labels (1)
0 Karma
1 Solution

Simple_Search
Path Finder

Try adding the following to establish the boundary of the IP and search past the ASA message. This will get the first available IP address. If this works for you please be sure to grant some karma!

| rex field=_raw "ASA\-\d\-\d+\:.+?(\b(?<ipaddress>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}))"

 

 

 

View solution in original post

Simple_Search
Path Finder

Hello!

The following regex will start at the beginning of the event and pull the first IP address it sees. I have provided a screen capture of an example event, hope this helps!

| rex field=_raw "(?<ipaddress>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"

evallja
Path Finder

Hello,

The script above is very helpful, but I just need to add one more criterion:
It should recognize the first IP that comes after the string "%ASA" because sometimes it recognizes the IP of the firewall which is the first one in the event and is always before the string "%ASA".

Thank you.

0 Karma

Simple_Search
Path Finder

Try adding the following to establish the boundary of the IP and search past the ASA message. This will get the first available IP address. If this works for you please be sure to grant some karma!

| rex field=_raw "ASA\-\d\-\d+\:.+?(\b(?<ipaddress>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}))"

 

 

 

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...