IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« CEF module CoreDNS module »
Elastic Docs ›Filebeat Reference [7.6] ›Modules

Cisco module

edit

Cisco module

edit

This functionality is in beta and is subject to change. The design and code is less mature than official GA features and is being provided as-is with no warranties. Beta features are not subject to the support SLA of official GA features.

This is a module for Cisco network device’s logs. It includes the following filesets for receiving logs over syslog or read from a file:

  • asa fileset: supports Cisco ASA firewall logs.
  • ftd fileset: supports Cisco Firepower Threat Defense logs.
  • ios fileset: supports Cisco IOS router and switch logs.

Cisco ASA devices also support exporting flow records using NetFlow, which is supported by the netflow module in Filebeat.

Some filesets in this module make extensive use of ingest pipeline scripts. This can cause their ingest pipelines to fail loading due to exceeding the default compilation limits:

[script] Too many dynamic script compilations within, max: [75/5m]

Check the Dynamic Script Compilations section for more information.

When you run the module, it performs a few tasks under the hood:

  • Sets the default paths to the log files (but don’t worry, you can override the defaults)
  • Makes sure each multiline log event gets sent as a single event
  • Uses ingest node to parse and process the log lines, shaping the data into a structure suitable for visualizing in Kibana
  • Deploys dashboards for visualizing the log data

Read the quick start to learn how to set up and run modules.

Configure the module

edit

You can further refine the behavior of the cisco module by specifying variable settings in the modules.d/cisco.yml file, or overriding settings at the command line.

The module is by default configured to run via syslog on port 9001 for ASA and port 9002 for IOS. However it can also be configured to read from a file path. See the following example.

- module: cisco
  asa:
    enabled: true
    var.paths: ["/var/log/cisco-asa.log"]
    var.input: "file"

Variable settings

edit

Each fileset has separate variable settings for configuring the behavior of the module. If you don’t specify variable settings, the cisco module uses the defaults.

For more information, see Configure variable settings. Also see Override input settings.

When you specify a setting at the command line, remember to prefix the setting with the module name, for example, cisco.asa.var.paths instead of asa.var.paths.

asa fileset settings

edit

Example config:

- module: cisco
  asa:
    var.syslog_host: 0.0.0.0
    var.syslog_port: 9001
    var.log_level: 5
var.paths
An array of glob-based paths that specify where to look for the log files. All patterns supported by Go Glob are also supported here. For example, you can use wildcards to fetch all files from a predefined level of subdirectories: /path/to/log/*/*.log. This fetches all .log files from the subfolders of /path/to/log. It does not fetch log files from the /path/to/log folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system.
var.log_level
An integer between 1 and 7 that allows to filter messages based on the severity level. The different severity levels supported by the Cisco ASA are:
log_level severity

1

Alert

2

Critical

3

Error

4

Warning

5

Notification

6

Informational

7

Debugging

A value of 7 (default) will not filter any messages. A lower value will drop any messages with a severity level higher than the specified value. For example, var.log_level: 3 will allow messages of level 1 (Alert), 2 (Critical) and 3 (Error). All other messages will be dropped.

var.syslog_host
The interface to listen to UDP based syslog traffic. Defaults to localhost. Set to 0.0.0.0 to bind to all available interfaces.
var.syslog_port
The UDP port to listen for syslog traffic. Defaults to 9001.

ftd fileset settings

edit

The Cisco FTD fileset primarily supports parsing IPv4 and IPv6 access list log messages similar to that of ASA devices as well as Security Event Syslog Messages for Intrusion, Connection, File and Malware events.

Field mappings

The ftd fileset maps Security Event Syslog Messages to the Elastic Common Schema (ECS) format. The following table illustrates the mapping from Security Event fields to ECS. The cisco.ftd prefix is used when there is no corresponding ECS field available.

Mappings for Intrusion events fields:

FTD Field Mapped fields

ApplicationProtocol

network.protocol

DstIP

destination.address

DstPort

destination.port

EgressInterface

cisco.ftd.destination_interface

GID

service.id

HTTPResponse

http.response.status_code

IngressInterface

cisco.ftd.source_interface

InlineResult

event.outcome

IntrusionPolicy

cisco.ftd.rule_name

Message

message

Protocol

network.transport

SrcIP

source.address

SrcPort

source.port

User

user.id, user.name

WebApplication

network.application

Mappings for Connection and Security Intelligence events fields:

FTD Field Mapped fields

ACPolicy

cisco.ftd.rule_name

AccessControlRuleAction

event.outcome

AccessControlRuleName

cisco.ftd.rule_name

ApplicationProtocol

network.protocol

ConnectionDuration

event.duration

DNSQuery

dns.question.name

DNSRecordType

dns.question.type

DNSResponseType

dns.response_code

DstIP

destination.address

DstPort

destination.port

EgressInterface

cisco.ftd.destination_interface

HTTPReferer

http.request.referrer

HTTPResponse

http.response.status_code

IngressInterface

cisco.ftd.source_interface

InitiatorBytes

source.bytes

InitiatorPackets

source.packets

NetBIOSDomain

host.hostname

Protocol

network.transport

ReferencedHost

url.domain

ResponderBytes

destination.bytes

ResponderPackets

destination.packets

SSLActualAction

event.outcome

SSLServerName

server.domain

SrcIP

source.address

SrcPort

source.port

URL

url.original

User

user.name

UserAgent

user_agent.original

WebApplication

network.application

originalClientSrcIP

client.address

Mappings for File and Malware events fields:

FTD Field Mapped fields

ApplicationProtocol

network.protocol

ArchiveFileName

file.name

ArchiveSHA256

file.hash.sha256

Client

network.application

DstIP

destination.address

DstPort

destination.port

FileName

file.name

FilePolicy

cisco.ftd.rule_name

FileSHA256

file.hash.sha256

FileSize

file.size

FirstPacketSecond

event.start

Protocol

network.transport

SrcIP

source.address

SrcPort

source.port

URI

url.original

User

user.name

WebApplication

network.application

Example configuration:

- module: cisco
  ftd:
    var.syslog_host: 0.0.0.0
    var.syslog_port: 9003
    var.log_level: 5
var.paths
An array of glob-based paths that specify where to look for the log files. All patterns supported by Go Glob are also supported here. For example, you can use wildcards to fetch all files from a predefined level of subdirectories: /path/to/log/*/*.log. This fetches all .log files from the subfolders of /path/to/log. It does not fetch log files from the /path/to/log folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system.
var.log_level
An integer between 1 and 7 that allows to filter messages based on the severity level. The different severity levels supported by the Cisco ASA are:
log_level severity

1

Alert

2

Critical

3

Error

4

Warning

5

Notification

6

Informational

7

Debugging

A value of 7 (default) will not filter any messages. A lower value will drop any messages with a severity level higher than the specified value. For example, var.log_level: 3 will allow messages of level 1 (Alert), 2 (Critical) and 3 (Error). All other messages will be dropped.

var.syslog_host
The interface to listen to UDP based syslog traffic. Defaults to localhost. Set to 0.0.0.0 to bind to all available interfaces.
var.syslog_port
The UDP port to listen for syslog traffic. Defaults to 9003.

ios fileset settings

edit

The Cisco IOS fileset primarily supports parsing IPv4 and IPv6 access list log messages.

Example config:

- module: cisco
  ios:
    var.syslog_host: 0.0.0.0
    var.syslog_port: 9002
var.paths
An array of glob-based paths that specify where to look for the log files. All patterns supported by Go Glob are also supported here. For example, you can use wildcards to fetch all files from a predefined level of subdirectories: /path/to/log/*/*.log. This fetches all .log files from the subfolders of /path/to/log. It does not fetch log files from the /path/to/log folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system.
var.syslog_host
The interface to listen to UDP based syslog traffic. Defaults to localhost. Set to 0.0.0.0 to bind to all available interfaces.
var.syslog_port
The UDP port to listen for syslog traffic. Defaults to 9002.

Timezone support

edit

This module parses logs that don’t contain timezone information. For these logs, Filebeat reads the local timezone and uses it when parsing to convert the timestamp to UTC. The timezone to be used for parsing is included in the event in the event.timezone field.

To disable this conversion, the event.timezone field can be removed with the drop_fields processor.

If logs are originated from systems or applications with a different timezone to the local one, the event.timezone field can be overwritten with the original timezone using the add_fields processor.

See Processors for information about specifying processors in your config.

Dynamic Script Compilations

edit

The asa and ftd filesets are based on Elasticsearch ingest pipelines and make extensive use of script processors and painless conditions. This can cause the pipelines to fail loading the first time the module is used, due to exceeding the maximum script compilation limits. It is recommended to tune the following parameters on your Elasticsearch cluster:

Example dashboard

edit

This module comes with a sample dashboard for ASA:

kibana cisco asa

Fields

edit

For a description of each field in the module, see the exported fields section.

« CEF module CoreDNS module »