Skip to content

CISCOFW106006_106007_106010 not matching  #322

@anubisg1

Description

@anubisg1

example log message:

<187>Apr 30 2013 09:23:40: %ASA-3-106010: Deny inbound sctp src INET:8.8.8.8/57997 dst INET:192.168.0.1/9000

the reason why it doesn;'t match is because INET: in front of source and dst ip address isn't accounted for (which i believe is the firewall interface name).
furthermore (?:(%{DATA:[destination][user][name]}))? (?:(?:on interface %{NOTSPACE:[observer][egress][interface][name]})|(?:due to %{CISCO_REASON:[event][reason]}))` it's supposed to be fully optional but only matches up to [destination][user][name]

another failed match

%ASA-3-106010: Deny inbound protocol 47 src INET:60.41.177.74 dst INET:217.111.247.78

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions