elastic / elastic/integrations

[Cisco Secure Email Gateway]: Support for Grok parsing for logs coming from Cisco Secure Email Gateway in v 16.x

Open
#17,219 2 comments 0 reactions 1 assignee Claimed by @mjwolf View on GitHub
Integration:cisco_secure_email_gateway needs:triage Team:Integration-Experience
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
3d 4h
Merged PRs (30d)
209

Description

### Integration Name

Cisco Secure Email Gateway [cisco_secure_email_gateway]

### Dataset Name

_No response_

### Integration Version

16.x

### Agent Version

8.19

### OS Version and Architecture

Linux

### User Goal

Support for Grok parsing for logs coming from Cisco Secure Email Gateway in v 16.x
The integration worked with Cisco Secure Email Gateway server version 14.0.0; however, in 16.0.4-016  log format has changed, and processors are failing:

https://github.com/elastic/integrations/tree/main/packages/cisco_secure_email_gateway

Please add support for 16.0.4-016 log format to the integration.

This is the official guide for logging in Cisco Secure Email Gateway v16:
https://www.cisco.com/c/en/us/td/docs/security/esa/esa16-0/user_guide/b_ESA_Admin_Guide_16-0/b_ESA_Admin_Guide_12_1_chapter_0100111.html

### Existing Features

Working with version 14.0.0.

### What did you see?

After upgrading Cisco Secure Email Gateways (C695) to version 16.0.4-016, the status log messages changed.
Therefore, the grok filter in the ingest pipeline logs-cisco_secure_email_gateway.log-1.28.4-pipeline_status no longer matches.

**Log example before the update from Version 14.x:**

```
<22>Jan 21 12:47:11 host01 status: Info: Status: CPULd 100 DskIO 0 RAMUtil 1 QKUsd 5845 QKFre 71297323 CrtMID 16489343 CrtICID 16255845 CrtDCID 7670654 InjMsg 10526355 InjRcp 11030399 GenBncRcp 104192 RejRcp 683612 DrpMsg 1812 SftBncEvnt 317144 CmpRcp 11193532 HrdBncRcp 101388 DnsHrdBnc 12730 5XXHrdBnc 81837 FltrHrdBnc 0 ExpHrdBnc 6821 OtrHrdBnc 0 DlvRcp 11092050 DelRcp 94 GlbUnsbHt 0 ActvRcp 69 UnatmptRcp 50 AtmptRcp 19 CrtCncIn 0 CrtCncOut 1 DnsReq 84063667 NetReq 38886075 CchHit 87221963 CchMis 29533426 CchEct 3163403 CchExp 13749560 CPUTTm 11726 CPUETm 108140 MaxIO 74468 RAMUsd 397968752 MMLen 68 DstInMem 1201 ResCon 0 WorkQ 0 QuarMsgs 0 QuarQKUsd 0 LogUsd 2 SophLd 0 BMLd 0 CASELd 0 TotalLd 5 LogAvail 1T EuQ 0 EuqRls 0 CmrkLd 0 McafLd 0 SwIn 0 SwOut 0 SwPgIn 0 SwPgOut 0 **SwapUsage 0%** RptLd 0 QtnLd 0 EncrQ 0 InjBytes 654567997394
```

**Logs from the version 16.0.4-016:**

```
<22>Feb 02 10:31:37 host01 status: Info: Status: CPULd 13 DskIO 1 RAMUtil 1 QKUsd 3948 QKFre 71299220 CrtMID 16981659 CrtICID 16651044 CrtDCID 7883589 InjMsg 10842391 InjRcp 11359883 GenBncRcp 107129 RejRcp 697333 DrpMsg 1812 SftBncEvnt 325208 CmpRcp 11527163 HrdBncRcp 103934 DnsHrdBnc 13161 5XXHrdBnc 83745 FltrHrdBnc 0 ExpHrdBnc 7028 OtrHrdBnc 0 DlvRcp 11423132 DelRcp 97 GlbUnsbHt 0 ActvRcp 114 UnatmptRcp 99 AtmptRcp 15 CrtCncIn 2 CrtCncOut 5 DnsReq 86455318 NetReq 40002337 CchHit 89702470 CchMis 30363538 CchEct 3211676 CchExp 14136433 CPUTTm 72737 CPUETm 1027634 MaxIO 74468 RAMUsd 551857550 MMLen 115 DstInMem 1137 ResCon 0 WorkQ 0 QuarMsgs 1 QuarQKUsd 989 LogUsd 2 SophLd 0 BMLd 0 CASELd 6 TotalLd 4 LogAvail 1T EuQ 0 EuqRls 0 CmrkLd 0 McafLd 0 SwIn 0 SwOut 0 SwPgIn 0 SwPgOut 0 RptLd 2 QtnLd 0 EncrQ 0 InjBytes 884593308600
```

The **SwapUsage** is missing in the new version.

### Anything else?

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.