github-mirrors/logstash
1
0
Fork 0
mirror of https://github.com/elastic/logstash.git synced 2025-04-24 06:37:19 -04:00
Code Issues Projects Releases Packages Wiki Activity

List all matched message codes in the Grok names to help troublshoot parse failures

Browse source
This commit is contained in:
Greg Mefford 2013-09-01 08:24:36 -04:00
parent be6754fc66
commit 33f6297924
1 changed files with 7 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

14
patterns/firewalls
View file

@ -7,7 +7,7 @@ CISCOTAG [A-Z0-9]+-%{INT}-(?:[A-Z0-9_]+)
# ASA-2-106001
CISCOFW106001 (?<direction>Inbound) (?<protocol>TCP) connection (?<action>denied) from %{IP:src_ip}/%{INT:src_port} to %{IP:dst_ip}/%{INT:dst_port} flags %{GREEDYDATA:tcp_flags} on interface %{GREEDYDATA:interface}
# ASA-2-106006, ASA-2-106007, ASA-2-106010
CISCOFW106006 (?<action>Deny) (?<direction>inbound) %{WORD:protocol} (from|src) %{IP:src_ip}/%{INT:src_port}(\(%{DATA:src_fwuser}\))? (to|dst) %{IP:dst_ip}/%{INT:dst_port}(\(%{DATA:dst_fwuser}\))? (on interface %{DATA:interface}|due to (?<reason>DNS (Response|Query)))
CISCOFW106006_106007_106010 (?<action>Deny) (?<direction>inbound) %{WORD:protocol} (from|src) %{IP:src_ip}/%{INT:src_port}(\(%{DATA:src_fwuser}\))? (to|dst) %{IP:dst_ip}/%{INT:dst_port}(\(%{DATA:dst_fwuser}\))? (on interface %{DATA:interface}|due to (?<reason>DNS (Response|Query)))
# ASA-3-106014
CISCOFW106014 (?<action>Deny) (?<direction>inbound) (?<protocol>icmp) src %{DATA:src_interface}:%{IP:src_ip}(\(%{DATA:src_fwuser}\))? dst %{DATA:dst_interface}:%{IP:dst_ip}(\(%{DATA:dst_fwuser}\))? \(type %{INT:icmp_type}, code %{INT:icmp_code}\)
# ASA-6-106015
@ -23,13 +23,13 @@ CISCOFW110002 (?<action>Failed to locate egress interface) for %{WORD:protocol}
# ASA-6-302010
CISCOFW302010 %{INT:connection_count} in use, %{INT:connection_count_max} most used
# ASA-6-302013, ASA-6-302014, ASA-6-302015, ASA-6-302016
CISCOFW302013 (?<action>Built|Teardown)( (?<direction>inbound|outbound))? (?<protocol>TCP|UDP) connection %{INT:connection_id} for %{DATA:src_interface}:%{IP:src_ip}/%{INT:src_port}( \(%{IP:src_mapped_ip}/%{INT:src_mapped_port}\))?(\(%{DATA:src_fwuser}\))? to %{DATA:dst_interface}:%{IP:dst_ip}/%{INT:dst_port}( \(%{IP:dst_mapped_ip}/%{INT:dst_mapped_port}\))?(\(%{DATA:dst_fwuser}\))?( duration %{TIME:duration} bytes %{INT:bytes})?( (?<reason>%{WORD}( %{WORD})*))?( \(%{DATA:user}\))?
CISCOFW302013_302014_302015_302016 (?<action>Built|Teardown)( (?<direction>inbound|outbound))? (?<protocol>TCP|UDP) connection %{INT:connection_id} for %{DATA:src_interface}:%{IP:src_ip}/%{INT:src_port}( \(%{IP:src_mapped_ip}/%{INT:src_mapped_port}\))?(\(%{DATA:src_fwuser}\))? to %{DATA:dst_interface}:%{IP:dst_ip}/%{INT:dst_port}( \(%{IP:dst_mapped_ip}/%{INT:dst_mapped_port}\))?(\(%{DATA:dst_fwuser}\))?( duration %{TIME:duration} bytes %{INT:bytes})?( (?<reason>%{WORD}( %{WORD})*))?( \(%{DATA:user}\))?
# ASA-6-302020, ASA-6-302021
CISCOFW302020 (?<action>Built|Teardown)( (?<direction>inbound|outbound))? (?<protocol>ICMP) connection for faddr %{IP:dst_ip}/%{INT:icmp_seq_num}(?:\(%{DATA:fwuser}\))? gaddr %{IP:src_xlated_ip}/%{INT:icmp_code_xlated} laddr %{IP:src_ip}/%{INT:icmp_code}( \(%{DATA:user}\))?
CISCOFW302020_302021 (?<action>Built|Teardown)( (?<direction>inbound|outbound))? (?<protocol>ICMP) connection for faddr %{IP:dst_ip}/%{INT:icmp_seq_num}(?:\(%{DATA:fwuser}\))? gaddr %{IP:src_xlated_ip}/%{INT:icmp_code_xlated} laddr %{IP:src_ip}/%{INT:icmp_code}( \(%{DATA:user}\))?
# ASA-6-305011
CISCOFW305011 (?<action>Built|Teardown) (?<xlate_type>static|dynamic) (?<protocol>TCP|UDP|ICMP) translation from %{DATA:src_interface}:%{IP:src_ip}(/%{INT:src_port})?(\(%{DATA:src_fwuser}\))? to %{DATA:src_xlated_interface}:%{IP:src_xlated_ip}/%{DATA:src_xlated_port}
# ASA-3-313001, ASA-3-313004, ASA-3-313008
CISCOFW313001 (?<action>Denied) (?<protocol>ICMP(v6)?) type=%{INT:icmp_type}, code=%{INT:icmp_code} from %{IP:src_ip} on interface %{DATA:interface}( to %{IP:dst_ip})?
CISCOFW313001_313004_313008 (?<action>Denied) (?<protocol>ICMP(v6)?) type=%{INT:icmp_type}, code=%{INT:icmp_code} from %{IP:src_ip} on interface %{DATA:interface}( to %{IP:dst_ip})?
# ASA-4-313005
CISCOFW313005 (?<action>No matching connection) for ICMP error message: (?<err_protocol>icmp) src %{DATA:err_src_interface}:%{IP:err_src_ip}(\(%{DATA:err_src_fwuser}\))? dst %{DATA:err_dst_interface}:%{IP:err_dst_ip}(\(%{DATA:err_dst_fwuser}\))? \(type %{INT:err_icmp_type}, code %{INT:err_icmp_code}\) on %{DATA:interface} interface\. Original IP payload: %{WORD:protocol} src %{IP:orig_src_ip}/%{INT:orig_src_port}(\(%{DATA:orig_src_fwuser}\))? dst %{IP:orig_dst_ip}/%{INT:orig_dst_port}(\(%{DATA:orig_dst_fwuser}\))?
# ASA-4-402117
@ -40,12 +40,12 @@ CISCOFW402119 (?<protocol>IPSEC): Received an %{WORD:orig_protocol} packet \(SPI
CISCOFW419001 (?<action>Dropping) (?<protocol>TCP) packet from %{DATA:src_interface}:%{IP:src_ip}/%{INT:src_port} to %{DATA:dst_interface}:%{IP:dst_ip}/%{INT:dst_port}, reason: %{GREEDYDATA:reason}
# ASA-4-419002
CISCOFW419002 (?<action>Duplicate (?<protocol>TCP) SYN) from %{DATA:src_interface}:%{IP:src_ip}/%{INT:src_port} to %{DATA:dst_interface}:%{IP:dst_ip}/%{INT:dst_port} with different initial sequence number
# ASA-6-602303, ASA-6-602304
# ASA-4-500004
CISCOFW500004 (?<action>Invalid transport field) for protocol=%{WORD:protocol}, from %{IP:src_ip}/%{INT:src_port} to %{IP:dst_ip}/%{INT:dst_port}
CISCOFW602303 (?<protocol>IPSEC): An (?<direction>inbound|outbound) %{GREEDYDATA:tunnel_type} SA \(SPI= %{DATA:spi}\) between %{IP:src_ip} and %{IP:dst_ip} \(user= %{DATA:user}\) has been (?<action>created|deleted)
# ASA-6-602303, ASA-6-602304
CISCOFW602303_602304 (?<protocol>IPSEC): An (?<direction>inbound|outbound) %{GREEDYDATA:tunnel_type} SA \(SPI= %{DATA:spi}\) between %{IP:src_ip} and %{IP:dst_ip} \(user= %{DATA:user}\) has been (?<action>created|deleted)
# ASA-7-710001, ASA-7-710002, ASA-7-710003, ASA-7-710005, ASA-7-710006
CISCOFW710001 %{WORD:protocol} (?:request|access) (?<action>requested|permitted|denied by ACL|discarded) from %{IP:src_ip}/%{INT:src_port} to %{DATA:dst_interface}:%{IP:dst_ip}/%{INT:dst_port}
CISCOFW710001_710002_710003_710005_710006 %{WORD:protocol} (?:request|access) (?<action>requested|permitted|denied by ACL|discarded) from %{IP:src_ip}/%{INT:src_port} to %{DATA:dst_interface}:%{IP:dst_ip}/%{INT:dst_port}
# ASA-6-713172
CISCOFW713172 Group = %{GREEDYDATA:group}, IP = %{IP:src_ip}, Automatic NAT Detection Status:\s+Remote end\s*%{DATA:is_remote_natted}\s*behind a NAT device\s+This\s+end\s*%{DATA:is_local_natted}\s*behind a NAT device
# ASA-4-733100