Cisco ASA/FTD/Nexus/IOS Graylog Contentpack

From OISecWiki

This is my modified version of the NetUse AG's Cisco ASA content pack. It has been modified on the following parts:

  • Added support for Cisco FTD logs (basically changing %ASA to %(ASA|FTD) in the patterns.
  • Added support for Cisco IOS/Nexus logs (basic implementation a lot is still missing).
  • Added new Cisco FTD patterns that do not exist on ASA
  • Converted fields that where parsed as strings, but are actually integers to integers
  • Added pipelines for Cisco IOS parsing.

File:Content-pack-oisec-cisco-1.00.json

To see how it works, please check out the following page: Graylog grok pattern matching for Cisco IOS and Nexus

Retrieved from "https://wiki.oisec.net/mediawiki/index.php?title=Cisco_ASA/FTD/Nexus/IOS_Graylog_Contentpack&oldid=767"