elastic / elastic/integrations

[cisco_ios.log] Further parsing for LOGIN_FAILED events

Open
#3,902 10 comments 0 reactions 0 assignees View on GitHub
enhancement Integration:cisco_ios Team:Security-Deployment and Devices
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
2d 18h
Merged PRs (30d)
182

Description

Hi
Cisco IOS module needs further parsing and samples
https://github.com/elastic/integrations/blob/main/packages/cisco_ios/data_stream/log/elasticsearch/ingest_pipeline/default.yml

In above, the LOGIN_FAILED is not captured
Please find the code and sample event for it
```
- dissect:
field: message
pattern: "%{cisco.ios.action} %{_temp_.event.action} [user: %{source.user.name}] [Source: %{source.address}] [localport: %{destination.port}] [Reason: %{event.reason}] at %{}"
if: "ctx.event?.code == 'LOGIN_FAILED'"
```

## Sample event
```
Jul 29 13:49:12 194.159.101.44 894: 000893: Jul 29 2022 12:49:11.159 UTC: %SEC_LOGIN-4-LOGIN_FAILED: Login failed [user: ABCD] [Source: 112.123.2.38] [localport: 22] [Reason: Login Authentication Failed] at 12:49:11 UTC Fri Jul 29 2022
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.