Getting Data In

Cisco ASA - Logging from Access-Control Entries.

kenth
Splunk Employee
Splunk Employee

Hi,

I am logging directly to Splunk from several Cisco ASA's. I have set my ASA to log ACE entries on the notifications level and I send this level to syslog (Splunk). This should send all permitted and dropped logs to the Splunk. It seems like Splunk only recognizes the syslogs with dropped packets. How come? I have checked with normal syslog and I get both log entries.

For workaround I have to send syslog level information to splunk to be able to see permitted packets. This is not what I want because information sends the build and teardown of connections and it seems like thats how Splunk considers it's a "permitted" flow.

I am using the Splunk for Cisco Security. Anyone done this?

Tags (3)
0 Karma

kenth
Splunk Employee
Splunk Employee

I've solved this in a new and packaged app that is available on Splunkbase as "Splunk for Cisco ASA".

jgauthier
Contributor

Again,

This is an old post. But I have solved it and am happy.

Filter out the data from the host to only put in the data that the add on needs to process it's reports.

So, build a regex that captures the build lines, and the deny lines. Toss the rest!

0 Karma

jgauthier
Contributor

Kenth,

This is an old post, but I am new to this add on. I'm having the same issue, and here's what I've discovered. The field extraction for the "firewall-accept" is keyed upon the words "Built", and "connection". This phrase is only available when 'logging informational' is on. This is an obscene amount of logging.

What would be ideal is if the field extraction used the words "access-list", and "permitted". Then logging level can be lower, and you can set up the ACL to include logging for those hits to the level you want.

I did this and it worked, but not all the way. The access-list log line is different than the built connection log line, and the rest of the fields are not extracted correctly.

I've been poking around and I cannot determine how to change this area. I could use some help on that. If anyone knows, that would be fantastic.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...