Closed
Description
openedon Feb 15, 2024
Elastic, Kibana v8.12
Cisco ASA integration v2.30.1
Logs sent from ASAs v9.12, v9.18
Log messages 106023 with src or dst interface nameif with a full colon not getting source.ip and destination.ip fields parsed.
source.ip not set: Syslog message: LOCAL4.WARNING: fw-1 %ASA-4-106023: Deny udp src v1:outside:10.8.1.9/54864 dst inside:172.16.1.3/53 by access-group "outside_acl" [0x0, 0x0]\n
source.ip and destination.ip not set: Syslog message: LOCAL4.WARNING: fw-1 %ASA-4-106023: Deny udp src v1:outside:10.8.1.9/54864 dst v2:inside:172.16.1.3/53 by access-group "outside_acl" [0x0, 0x0]\n
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment