elastic / elastic/integrations
[cisco_ios.log] Further parsing for LOGIN_FAILED events
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 182
Description
Hi
Cisco IOS module needs further parsing and samples
https://github.com/elastic/integrations/blob/main/packages/cisco_ios/data_stream/log/elasticsearch/ingest_pipeline/default.yml
In above, the LOGIN_FAILED is not captured
Please find the code and sample event for it
```
- dissect:
field: message
pattern: "%{cisco.ios.action} %{_temp_.event.action} [user: %{source.user.name}] [Source: %{source.address}] [localport: %{destination.port}] [Reason: %{event.reason}] at %{}"
if: "ctx.event?.code == 'LOGIN_FAILED'"
```
## Sample event
```
Jul 29 13:49:12 194.159.101.44 894: 000893: Jul 29 2022 12:49:11.159 UTC: %SEC_LOGIN-4-LOGIN_FAILED: Login failed [user: ABCD] [Source: 112.123.2.38] [localport: 22] [Reason: Login Authentication Failed] at 12:49:11 UTC Fri Jul 29 2022
```
Contributor guide
Assessment
This issue has not been assessed yet.