Graylog grok pattern matching for Cisco IOS and Nexus

From OISecWiki

I've built the following basic pipeline and grok pattern matching that is universal for Cisco IOS and Nexus.

We are using a RAW UDP input to process the syslog messages, and we expect the routers to have "logging origin-id hostname" enabled.

General Grok Patterns:

NXIOS_SYSLOG_ID 
\%%{DATA:vendor_syslog_facility}-%{INT:vendor_syslog_level}-%{DATA:vendor_syslog_id}:

For the extractor on a Raw UDP input use the following grok pattern to match:

<%{INT:ciscoios_syslog}>(%{DATA} )?%{HOSTNAME:source_hostname}: (%{YEAR} )?%{MONTH} %{MONTHDAY} %{TIME}( %{TZ})?: %{NXIOS_SYSLOG_ID} %{GREEDYDATA:parsed_message}

Pipeline: 

rule "nexus_ios_apply_grok"
when
  has_field("vendor_syslog_id") and has_field("vendor_syslog_facility") and
  has_field("ciscoios_syslog") and
  grok_exists(
    "NXIOS_" + to_string($message.vendor_syslog_facility) + "_" + to_string($message.vendor_syslog_id)
      )
then
  set_field("nxios_parsed", to_string("true"));
  set_fields(
    fields: grok(
      pattern: "%{NXIOS_"+to_string($message.vendor_syslog_facility) + "_" + to_string($message.vendor_syslog_id) + "}",
      value: to_string($message.parsed_message),
      only_named_captures: true)
  );
end

Then we can make grok patterns for all the different Cisco Syslog Messages. For example if we have the following syslog message:

<190>10704: ROUTER01: Mar 27 16:25:57: %SYS-6-LOGOUT: User admin has exited tty session 1(172.16.28.10)

We can create the following Grok pattern for it, and it will be automatically matched, no additional pipelines required.

NXIOS_SYS_LOGOUT 
User %{DATA:user_name} has exited tty session %{INT}(%{IPORHOST:remote_ip)

This is basically an IOS/Nexus re-implementation of the excellent content-pack for ASA generated by NetUse AG.

It's available on their github: https://github.com/NetUSE-AG/Grok-Based-Cisco-ASA-for-Graylog

On this site there is a new pack available, that incorporates the above, as well as the ASA pack (with FTD support). You can find it here

Retrieved from "https://wiki.oisec.net/mediawiki/index.php?title=Graylog_grok_pattern_matching_for_Cisco_IOS_and_Nexus&oldid=766"