elastic / elastic/integrations

[pfSense]: snort pipline drops logs

Open
#13,962 2 comments 0 reactions 0 assignees View on GitHub
Integration:pfsense maintainer:Community needs:triage Stalled Team:Security-Deployment and Devices
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
2d 17h
Merged PRs (30d)
225

Description

### Integration Name

pfSense [pfsense]

### Dataset Name

pfsense.log

### Integration Version

1.22.0

### Agent Version

8.17.5

### Agent Output Type

elasticsearch

### Elasticsearch Version

8.17.5

### OS Version and Architecture

Ubuntu

### Software/API Version

pfSense 24.03 / snort package 4.1.6 (=snort version 2.9.20)

### Error Message

_No response_

### Event Original

Sample input data:

[1:2100366:8] GPL ICMP_INFO PING *NIX [Classification: Misc activity] [Priority: 3] {ICMP} 10.2.2.222 -> 10.3.3.16
[1:2402000:7376] ET DROP Dshield Block Listed Source group 1 [Classification: Misc Attack] [Priority: 2] {TCP} 20.76.20.20:36240 -> 10.3.3.8:443
[1:2400014:4348] ET DROP Spamhaus DROP Listed Traffic Inbound group 15 [Classification: Misc Attack] [Priority: 2] {TCP} 92.11.39.23:1302 -> 10.3.3.8:443

### What did you do?

Using pfsense integration, we ingest logs from pfSense/netgate devices running Snort (pfSense calls this package 4.1.6, which contains snort 2.9.20)

### What did you see?

un-parsed logs

### What did you expect to see?

Snort logs parsed correctly.

### Anything else?

The problem is in the snort pipeline patterns [here](https://github.com/elastic/integrations/blob/f6a948aea76ffb343ef0f15b94441f06be8a327c/packages/pfsense/data_stream/log/elasticsearch/ingest_pipeline/snort.yml#L7)

it does not take into account that not all fields are present at all times. A small modification is required:

`\[%{NUMBER:snort.generator_id}:%{NUMBER:snort.signature_id}:%{NUMBER:snort.signature_revision}\] (\(%{DATA:snort.preprocessor}\) )?%{GREEDYDATA:snort.alert_message} \[Classification: %{DATA:snort.classification}\] \[Priority: %{NONNEGINT:snort.priority:long}\] \{%{WORD:network.protocol}\} %{IP:source.address}(:%{NUMBER:source.port:long})? -> %{IP:destination.address}(:%{NUMBER:destination.port:long})?`

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.