elastic / elastic/integrations
[pfSense]: snort pipline drops logs
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 225
Description
### Integration Name
pfSense [pfsense]
### Dataset Name
pfsense.log
### Integration Version
1.22.0
### Agent Version
8.17.5
### Agent Output Type
elasticsearch
### Elasticsearch Version
8.17.5
### OS Version and Architecture
Ubuntu
### Software/API Version
pfSense 24.03 / snort package 4.1.6 (=snort version 2.9.20)
### Error Message
_No response_
### Event Original
Sample input data:
[1:2100366:8] GPL ICMP_INFO PING *NIX [Classification: Misc activity] [Priority: 3] {ICMP} 10.2.2.222 -> 10.3.3.16
[1:2402000:7376] ET DROP Dshield Block Listed Source group 1 [Classification: Misc Attack] [Priority: 2] {TCP} 20.76.20.20:36240 -> 10.3.3.8:443
[1:2400014:4348] ET DROP Spamhaus DROP Listed Traffic Inbound group 15 [Classification: Misc Attack] [Priority: 2] {TCP} 92.11.39.23:1302 -> 10.3.3.8:443
### What did you do?
Using pfsense integration, we ingest logs from pfSense/netgate devices running Snort (pfSense calls this package 4.1.6, which contains snort 2.9.20)
### What did you see?
un-parsed logs
### What did you expect to see?
Snort logs parsed correctly.
### Anything else?
The problem is in the snort pipeline patterns [here](https://github.com/elastic/integrations/blob/f6a948aea76ffb343ef0f15b94441f06be8a327c/packages/pfsense/data_stream/log/elasticsearch/ingest_pipeline/snort.yml#L7)
it does not take into account that not all fields are present at all times. A small modification is required:
`\[%{NUMBER:snort.generator_id}:%{NUMBER:snort.signature_id}:%{NUMBER:snort.signature_revision}\] (\(%{DATA:snort.preprocessor}\) )?%{GREEDYDATA:snort.alert_message} \[Classification: %{DATA:snort.classification}\] \[Priority: %{NONNEGINT:snort.priority:long}\] \{%{WORD:network.protocol}\} %{IP:source.address}(:%{NUMBER:source.port:long})? -> %{IP:destination.address}(:%{NUMBER:destination.port:long})?`
Contributor guide
Assessment
This issue has not been assessed yet.