From 832be70a098be9e498b2d4a7a678d41f4059e142 Mon Sep 17 00:00:00 2001 From: IE Ops Date: Fri, 7 Aug 2026 18:52:55 +0000 Subject: [PATCH 1/2] =?UTF-8?q?fix:=20#0=20=E2=80=94=20cisco=5Fftd.log:=20?= =?UTF-8?q?Processor=20'grok'=20with=20tag=20'grok=5Fmessage=5Fe6caac6?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- packages/cisco_ftd/changelog.yml | 5 ++ .../log/_dev/test/pipeline/test-ftd-fix.log | 3 +- .../pipeline/test-ftd-fix.log-expected.json | 61 +++++++++++++++++++ .../elasticsearch/ingest_pipeline/default.yml | 4 +- packages/cisco_ftd/manifest.yml | 2 +- 5 files changed, 71 insertions(+), 4 deletions(-) diff --git a/packages/cisco_ftd/changelog.yml b/packages/cisco_ftd/changelog.yml index 19b93dbbcd4..1f9ba241c68 100644 --- a/packages/cisco_ftd/changelog.yml +++ b/packages/cisco_ftd/changelog.yml @@ -1,4 +1,9 @@ # newer versions go on top +- version: "3.13.10" + changes: + - description: Fix grok patterns for message IDs 111008 and 111009 to correctly capture usernames containing spaces. + type: bugfix + link: https://github.com/elastic/integrations/pull/1 - version: "3.13.9" changes: - description: Fix grok REASON pattern for message 113005 to include Account has been locked out and Users account has expired rejection reasons. diff --git a/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-ftd-fix.log b/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-ftd-fix.log index 06d1f887b8c..3731a3cd241 100644 --- a/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-ftd-fix.log +++ b/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-ftd-fix.log @@ -57,4 +57,5 @@ May 5 17:51:17 dev01: %FTD-4-313005: No matching connection for ICMP error mess <166>May 01 2026 09:24:32Z %FTD-6-113005: %ASA-6-113005: AAA user authentication Rejected : reason = Unspecified : server = 192.0.2.20 : user = **** : user IP = 198.51.100.30 <166>May 01 2026 09:24:32Z %FTD-6-113005: %ASA-6-113005: AAA user authentication Rejected : reason = Password has expired : server = 192.0.2.20 : user = engineer@elastic.co : user IP = 198.51.100.30 <182>Jul 7 11:22:54 198.51.100.10 %FTD-6-113005: AAA user authentication Rejected : reason = Account has been locked out : server = 203.0.113.20 : user = ***** : user IP = 192.0.2.30 -<182>Jul 7 11:22:54 198.51.100.10 %FTD-6-113005: AAA user authentication Rejected : reason = Users account has expired : server = 203.0.113.20 : user = ***** : user IP = 192.0.2.30 \ No newline at end of file +<182>Jul 7 11:22:54 198.51.100.10 %FTD-6-113005: AAA user authentication Rejected : reason = Users account has expired : server = 203.0.113.20 : user = ***** : user IP = 192.0.2.30 +<181>Jul 7 14:12:01 198.51.100.10 %FTD-5-111008: User 'example-service account' executed the 'show running-config zero-trust' command. \ No newline at end of file diff --git a/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-ftd-fix.log-expected.json b/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-ftd-fix.log-expected.json index a722bcaf4e2..a0bc228cd2c 100644 --- a/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-ftd-fix.log-expected.json +++ b/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-ftd-fix.log-expected.json @@ -4486,6 +4486,67 @@ "tags": [ "preserve_original_event" ] + }, + { + "cisco": { + "ftd": { + "command_line_arguments": "'show running-config zero-trust' command." + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": "firewall-rule", + "category": [ + "network" + ], + "code": "111008", + "kind": "event", + "original": "<181>Jul 7 14:12:01 198.51.100.10 %FTD-5-111008: User 'example-service account' executed the 'show running-config zero-trust' command.", + "severity": 5, + "timezone": "UTC", + "type": [ + "info" + ] + }, + "host": { + "hostname": "198.51.100.10" + }, + "log": { + "level": "notification", + "syslog": { + "facility": { + "code": 22 + }, + "priority": 181, + "severity": { + "code": 5 + } + } + }, + "observer": { + "hostname": "198.51.100.10", + "product": "ftd", + "type": "idps", + "vendor": "Cisco" + }, + "related": { + "hosts": [ + "198.51.100.10" + ], + "user": [ + "example-service account" + ] + }, + "server": { + "user": { + "name": "example-service account" + } + }, + "tags": [ + "preserve_original_event" + ] } ] } diff --git a/packages/cisco_ftd/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/cisco_ftd/data_stream/log/elasticsearch/ingest_pipeline/default.yml index aaadc829805..eed1f7364ac 100644 --- a/packages/cisco_ftd/data_stream/log/elasticsearch/ingest_pipeline/default.yml +++ b/packages/cisco_ftd/data_stream/log/elasticsearch/ingest_pipeline/default.yml @@ -408,8 +408,8 @@ processors: description: "111008, 111009" field: "message" patterns: - - "^%{NOTSPACE} '%{NOTSPACE:server.user.name}' executed %{NOTSPACE} %{GREEDYDATA:_temp_.cisco.command_line_arguments}" - - "^%{NOTSPACE} '%{NOTSPACE:server.user.name}' executed the '%{DATA}' command" + - "^%{NOTSPACE} '%{DATA:server.user.name}' executed %{NOTSPACE} %{GREEDYDATA:_temp_.cisco.command_line_arguments}" + - "^%{NOTSPACE} '%{DATA:server.user.name}' executed the '%{DATA}' command" - grok: tag: grok_message_5ccd264e if: "ctx._temp_.cisco.message_id == '111010'" diff --git a/packages/cisco_ftd/manifest.yml b/packages/cisco_ftd/manifest.yml index dfd2ce4ecca..e87b8744ebd 100644 --- a/packages/cisco_ftd/manifest.yml +++ b/packages/cisco_ftd/manifest.yml @@ -1,7 +1,7 @@ format_version: "3.0.3" name: cisco_ftd title: Cisco FTD -version: "3.13.9" +version: "3.13.10" description: Collect logs from Cisco FTD with Elastic Agent. type: integration categories: From 099943c2b6047e7c78a8b8fb2e8d703a38e125f5 Mon Sep 17 00:00:00 2001 From: IE Ops Date: Fri, 7 Aug 2026 18:59:13 +0000 Subject: [PATCH 2/2] Update changelog PR link --- packages/cisco_ftd/changelog.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/cisco_ftd/changelog.yml b/packages/cisco_ftd/changelog.yml index 1f9ba241c68..ac03e6593f0 100644 --- a/packages/cisco_ftd/changelog.yml +++ b/packages/cisco_ftd/changelog.yml @@ -3,7 +3,7 @@ changes: - description: Fix grok patterns for message IDs 111008 and 111009 to correctly capture usernames containing spaces. type: bugfix - link: https://github.com/elastic/integrations/pull/1 + link: https://github.com/elastic/integrations/pull/20610 - version: "3.13.9" changes: - description: Fix grok REASON pattern for message 113005 to include Account has been locked out and Users account has expired rejection reasons.