[cisco_asa] Loosen a grok pattern to allow for IPs and hostnames #11378
Conversation
andrewkroh
added
bugfix
|
Pinging @elastic/sec-deployment-and-devices (Team:Security-Deployment and Devices) |
🚀 Benchmarks reportTo see the full report comment with |
There was a problem hiding this comment.
Seems reasonable to me. Also looks like the example data is generic enough. Are those the correct numbers? 113004, 113005, 313005? Mostly the 313005. It probably is. I could look it up, but I'm just going to talk to myself in this little box here. It looks good.
packages/cisco_asa/data_stream/log/elasticsearch/ingest_pipeline/default.yml
Show resolved
Hide resolved
Those numbers were from actual logs. I only changed the IPs/Hostnames to be generic, but left those values alone. |
|
💚 Build Succeeded
History
|
|
Package cisco_asa - 2.38.1 containing this change is available at https://epr.elastic.co/search?package=cisco_asa |
…stic#11378) * Adding new logs and fixes * Adding new expected logs, as well as changelog and manifest updates
…stic#11378) * Adding new logs and fixes * Adding new expected logs, as well as changelog and manifest updates
Proposed commit message
Some of the AAA log messages can have hostnames for the
server =field. This loosens up the grok pattern to useIPORHOSTinstead of justIP.This also adds a new pattern to allow for an unhandled ICMP message with a value of
<unknown>for theOriginal IP payloadvalue.Checklist
changelog.ymlfile.Author's Checklist
How to test this PR locally
Related issues
Screenshots