All Apps and Add-ons

Splunk Add-on for Cisco ESA 1.2.1: Small bug report on extractions for src_user and src_ip fields

secfrit
Explorer

I've noticed two small issues on the latest 1.2.1 app version.

  • Accordingly with the latest CIM-Email (4.3.1), the field currently extracted as sender should be named src_user instead:

    [sender_field_for_cisco_esa]
    REGEX = From:\s+<([^>]*)>
    FORMAT = src_user::$1

  • The src_ip field is not extracted properly, in the regex + should be used instead of * just before the src IP address part, otherwise the first part of the IP will not end up in the matching group.

    [src_dest_fields_for_cisco_esa]
    REGEX = (?:DCID|ICID)\s+\d+\s+interface\s+.[\s(]+(\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}).\s+(\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})(?:\s+port\s+(\d+))?
    FORMAT = src_ip::$1 dest_ip::$2 dest_port::$3

dtregonning_spl
Splunk Employee
Splunk Employee

Hi secfrit,

I looked at the second part of your request and did indeed find an issue in the way src_ip was being extracted for some log lines. I reworked your suggestion into something i believe covers all logging scenarios.

 [src_dest_fields_for_cisco_esa]
 REGEX = (?:DCID|ICID)\s+\d+\s+interface(?:[\S\s]* [\(]?)(\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}).*\s+(\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})(?:\s+port\s+(\d+))?
 FORMAT = src_ip::$1 dest_ip::$2 dest_port::$3

Happy to hear some feedback if this doesn't rectify your field extraction scenario.

Thank You Kindly
Don

0 Karma

bwooden
Splunk Employee
Splunk Employee

Thank you for this post, secfrit. I've filed an internal bug against this. If you're speaking with support, they can look it up as ADDON-7743.

Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...