ASA Firewall events IP extract

[evallja]

Hello everyone,

I need to extract the first IP from ASA events, after the first IP sometimes there are 3 other IPs, sometimes 2, and sometimes 1 IP, but I need only the first one without depending on how many IPs are after the first.

2023-07-13T11:24:25+02:00 FirASA : %ASA-6-302013: Built inbound TCP connection 2907550162 for dmzIB:192.168.7.7/49446 (192.168.7.7/49446) to inside:10.100.40.4/8080 (10.100.40.4/8080)

Thank you.

[Simple_Search]

Hello!

The following regex will start at the beginning of the event and pull the first IP address it sees. I have provided a screen capture of an example event, hope this helps!

| rex field=_raw "(?<ipaddress>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"

 

[evallja]

Hello,

The script above is very helpful, but I just need to add one more criterion:
It should recognize the first IP that comes after the string "%ASA" because sometimes it recognizes the IP of the firewall which is the first one in the event and is always before the string "%ASA".

Thank you.

[Simple_Search · Accepted solution]

Try adding the following to establish the boundary of the IP and search past the ASA message. This will get the first available IP address. If this works for you please be sure to grant some karma!

| rex field=_raw "ASA\-\d\-\d+\:.+?(\b(?<ipaddress>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}))"