Add username to ASA Security negotiation log #26975

LaZyDK · 2021-07-20T09:26:01Z

What does this PR do?

I added the username user.name field to ASA Security negotiation log line.

Why is it important?

The dissect function fails without it.

Checklist

My code follows the style guidelines of this project
I have commented my code, particularly in hard-to-understand areas
I have made corresponding changes to the documentation
I have made corresponding change to the default configuration files
I have added tests that prove my fix is effective or that my feature works
I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Logs

Unable to find match for dissect pattern: Group = %{}, IP = %{source.address}, Security negotiation complete for LAN-to-LAN Group (%{}) %{}, Inbound SPI = %{}, Outbound SPI = %{} against source: Group = xxxx, Username = xxxx_xxxx, IP = 1.2.3.4, Security negotiation complete for User (xxxx_xxxx) Responder, Inbound SPI = 0x0000000, Outbound SPI = 0x0000000

I added the username user.name field to ASA Security negotiation log line.

elasticmachine · 2021-07-20T09:30:55Z

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

Start Time: 2021-10-11T17:00:17.336+0000
Duration: 94 min 51 sec
Commit: 9548236

Test stats 🧪

Test	Results
Failed	0
Passed	7679
Skipped	1201
Total	8880

💚 Flaky test report

Tests succeeded.

🤖 GitHub comments

To re-run your PR in the CI, just comment with:

/test : Re-trigger the build.
/package : Generate the packages and run the E2E tests.
/beats-tester : Run the installation tests with beats-tester.

elasticmachine · 2021-07-26T17:51:54Z

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

botelastic · 2021-08-25T17:58:04Z

Hi!
We just realized that we haven't looked into this PR in a while. We're sorry!

We're labeling this issue as Stale to make it hit our filters and make sure we get back to it in as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1.
Thank you for your contribution!

mergify · 2021-09-22T12:55:29Z

This pull request does not have a backport label. Could you fix it @LaZyDK? 🙏
To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

backport-v./d./d./d is the label to automatically backport to the 7./d branch. /d is the digit

NOTE: backport-skip has been added to this pull request.

LaZyDK · 2021-09-22T12:57:01Z

@P1llus :)

P1llus · 2021-09-22T13:27:31Z

/test

P1llus · 2021-10-11T08:43:28Z

/test

P1llus · 2021-10-11T14:51:43Z

/test

x-pack/filebeat/module/cisco/shared/ingest/asa-ftd-pipeline.yml

x-pack/filebeat/module/cisco/asa/test/additional_messages.log

x-pack/filebeat/module/cisco/asa/test/additional_messages.log-expected.json

andrewkroh

LGTM

* Add username to ASA Security negotiation log I added the username user.name field to ASA Security negotiation log line. * adding support for both formats * adding changelog entry * updating geo fields in expected output files * reverse formatting * reverting to older version of file * reverting formatting again * regenrate golden files again * remove formatting, ready for review * fixing missing message due to no newline * fix dissect pattern to fit correctly Co-authored-by: Marius Iversen <marius.iversen@elastic.co> (cherry picked from commit df6fde2)

* Add username to ASA Security negotiation log I added the username user.name field to ASA Security negotiation log line. * adding support for both formats * adding changelog entry * updating geo fields in expected output files * reverse formatting * reverting to older version of file * reverting formatting again * regenrate golden files again * remove formatting, ready for review * fixing missing message due to no newline * fix dissect pattern to fit correctly Co-authored-by: Marius Iversen <marius.iversen@elastic.co> (cherry picked from commit df6fde2) Co-authored-by: LaZyDK <dennisperto@gmail.com> Co-authored-by: Marius Iversen <marius.iversen@elastic.co>

* Add username to ASA Security negotiation log I added the username user.name field to ASA Security negotiation log line. * adding support for both formats * adding changelog entry * updating geo fields in expected output files * reverse formatting * reverting to older version of file * reverting formatting again * regenrate golden files again * remove formatting, ready for review * fixing missing message due to no newline * fix dissect pattern to fit correctly Co-authored-by: Marius Iversen <marius.iversen@elastic.co>

* singleton sysinfo host to avoid frequently collecting host info * add Host object to Stats object * update changelog * set procStats.host to nil if any error calling sysinfo.Host() * Update aws-lambda-go library version to 1.13.3 (#28236) * [cloud][docker] use the private docker namespace (#28286) * [7.x] [DOCS] Update api_key example on elasticsearch output (#28288) * packetbeat/protos/dns: don't render missing A and AAAA addresses from truncated records (#28297) * seccomp: allow clone3 syscall for x86 (#28117) clone3 is a linux syscall that is now used by glibc starting version 2.34. It is used when pthread_create() gets called. Current seccomp filters do not allow this syscall leading to crashes like runtime/cgo: pthread_create failed: Operation not permitted See elastic/apm-server#6238 for more details * Osquerybeat: Improve handling of osquery.autoload file, allow customizations (#28289) Previously the osquery.autoload file was overwritten every time on osquerybeat start and stamped with our extension. After the change we check the content of the file and do not overwrite it on each osquerybeat start. This allows the user to deploy their own extensions if their want and start osquery with that. * Osquerybeat: Runner and Fetcher unit tests (#28290) * Runner and Fetcher unit tests * Fix header formatting * Tweak test * Update go release version 1.17.1 (#27543) * format of conditional build tags has changed * matching of * in regexes was fixed, thus breaking some of our code: golang/go#46123 * iproute package was missing from the new Golang Docker image, thus, we had to add it for our tests * go.mod file contains separate require directive for transitive dependencies * Move labels and annotations under kubernetes.namespace. (#27917) * Move labels and annotations under kubernetes.namespace. * Remove GCP support from Functionbeat (#28253) * Fix build tags for Go 1.17 (#28338) * [Elastic Agent] Add ability to communicate with Kibana through service token (#28096) * Add ability to communicate with Kibana through service token. Add ability to pass service token to container subcommand. * Add changelog entry. * Fix go fmt. * Add username to ASA Security negotiation log (#26975) * Add username to ASA Security negotiation log I added the username user.name field to ASA Security negotiation log line. * adding support for both formats * adding changelog entry * updating geo fields in expected output files * reverse formatting * reverting to older version of file * reverting formatting again * regenrate golden files again * remove formatting, ready for review * fixing missing message due to no newline * fix dissect pattern to fit correctly Co-authored-by: Marius Iversen <marius.iversen@elastic.co> * x-pack/filebeat/module/cisco: loosen time parsing and add group and session type capture (#28325) * Redis: remove deprecated fields (#28246) * Redis: remove deprecated fields * Disable generator tests temporarily (#28362) * Windows/perfmon metricset - remove deprecated perfmon.counters configuration (#28282) * remove deprecated config * changelog * [Filebeat] - S3 Input - Add support for only iterating/accessing only… (#28252) * [Filebeat] - S3 Input - Add support for only iterating/accessing only specific folders or datapaths * Breaking change for 8.0, namespace_annotations replaced by namespace.annotations (#28230) * Breaking change for 8.0, namespace_annotations replaced by namespace.annotations * Take care of namespace being nil * [Heartbeat] Setuid to regular user / lower capabilities when possible (#27878) partial fix for #27648 , this PR: Detects if the user is running as root then: Checks to see if an environment variable BEAT_SETUID_AS (set in our Docker.tmpl) is present Attempts to Setuid , Setgid and Setgroups to that user / groups Invokes setcap to drop all privileges except NET_RAW+ep This PR also fixes the broken syscall filtering in heartbeat, some non-syscall strings were breaking that. With the changes here elastic-agent can still run as root, but the subprocesses can lower their privileges ASAP. This should also make it possible for heartbeat to safely run ICMP pings and synthetics. Synthetics must run as non-root, but ICMP requires NET_RAW. This lets us be consistent in our docs with the recommendation that elastic-agent run as root. * mage fmt Co-authored-by: kaiyan-sheng <kaiyan.sheng@elastic.co> Co-authored-by: Victor Martinez <victormartinezrubio@gmail.com> Co-authored-by: Ugo Sangiorgi <ugo.sangiorgi@elastic.co> Co-authored-by: Dan Kortschak <90160302+efd6@users.noreply.github.com> Co-authored-by: Arnaud Lefebvre <a.lefebvre@outlook.fr> Co-authored-by: Aleksandr Maus <aleksandr.maus@elastic.co> Co-authored-by: apmmachine <58790750+apmmachine@users.noreply.github.com> Co-authored-by: Michael Katsoulis <michaelkatsoulis88@gmail.com> Co-authored-by: Noémi Ványi <kvch@users.noreply.github.com> Co-authored-by: Blake Rouse <blake.rouse@elastic.co> Co-authored-by: LaZyDK <dennisperto@gmail.com> Co-authored-by: Marius Iversen <marius.iversen@elastic.co> Co-authored-by: Andrea Spacca <andrea.spacca@elastic.co> Co-authored-by: Mariana Dima <mariana@elastic.co> Co-authored-by: Andrew Cholakian <andrew@andrewvc.com>

* Add username to ASA Security negotiation log I added the username user.name field to ASA Security negotiation log line. * adding support for both formats * adding changelog entry * updating geo fields in expected output files * reverse formatting * reverting to older version of file * reverting formatting again * regenrate golden files again * remove formatting, ready for review * fixing missing message due to no newline * fix dissect pattern to fit correctly Co-authored-by: Marius Iversen <marius.iversen@elastic.co>

* singleton sysinfo host to avoid frequently collecting host info * add Host object to Stats object * update changelog * set procStats.host to nil if any error calling sysinfo.Host() * Update aws-lambda-go library version to 1.13.3 (elastic#28236) * [cloud][docker] use the private docker namespace (elastic#28286) * [7.x] [DOCS] Update api_key example on elasticsearch output (elastic#28288) * packetbeat/protos/dns: don't render missing A and AAAA addresses from truncated records (elastic#28297) * seccomp: allow clone3 syscall for x86 (elastic#28117) clone3 is a linux syscall that is now used by glibc starting version 2.34. It is used when pthread_create() gets called. Current seccomp filters do not allow this syscall leading to crashes like runtime/cgo: pthread_create failed: Operation not permitted See elastic/apm-server#6238 for more details * Osquerybeat: Improve handling of osquery.autoload file, allow customizations (elastic#28289) Previously the osquery.autoload file was overwritten every time on osquerybeat start and stamped with our extension. After the change we check the content of the file and do not overwrite it on each osquerybeat start. This allows the user to deploy their own extensions if their want and start osquery with that. * Osquerybeat: Runner and Fetcher unit tests (elastic#28290) * Runner and Fetcher unit tests * Fix header formatting * Tweak test * Update go release version 1.17.1 (elastic#27543) * format of conditional build tags has changed * matching of * in regexes was fixed, thus breaking some of our code: golang/go#46123 * iproute package was missing from the new Golang Docker image, thus, we had to add it for our tests * go.mod file contains separate require directive for transitive dependencies * Move labels and annotations under kubernetes.namespace. (elastic#27917) * Move labels and annotations under kubernetes.namespace. * Remove GCP support from Functionbeat (elastic#28253) * Fix build tags for Go 1.17 (elastic#28338) * [Elastic Agent] Add ability to communicate with Kibana through service token (elastic#28096) * Add ability to communicate with Kibana through service token. Add ability to pass service token to container subcommand. * Add changelog entry. * Fix go fmt. * Add username to ASA Security negotiation log (elastic#26975) * Add username to ASA Security negotiation log I added the username user.name field to ASA Security negotiation log line. * adding support for both formats * adding changelog entry * updating geo fields in expected output files * reverse formatting * reverting to older version of file * reverting formatting again * regenrate golden files again * remove formatting, ready for review * fixing missing message due to no newline * fix dissect pattern to fit correctly Co-authored-by: Marius Iversen <marius.iversen@elastic.co> * x-pack/filebeat/module/cisco: loosen time parsing and add group and session type capture (elastic#28325) * Redis: remove deprecated fields (elastic#28246) * Redis: remove deprecated fields * Disable generator tests temporarily (elastic#28362) * Windows/perfmon metricset - remove deprecated perfmon.counters configuration (elastic#28282) * remove deprecated config * changelog * [Filebeat] - S3 Input - Add support for only iterating/accessing only… (elastic#28252) * [Filebeat] - S3 Input - Add support for only iterating/accessing only specific folders or datapaths * Breaking change for 8.0, namespace_annotations replaced by namespace.annotations (elastic#28230) * Breaking change for 8.0, namespace_annotations replaced by namespace.annotations * Take care of namespace being nil * [Heartbeat] Setuid to regular user / lower capabilities when possible (elastic#27878) partial fix for elastic#27648 , this PR: Detects if the user is running as root then: Checks to see if an environment variable BEAT_SETUID_AS (set in our Docker.tmpl) is present Attempts to Setuid , Setgid and Setgroups to that user / groups Invokes setcap to drop all privileges except NET_RAW+ep This PR also fixes the broken syscall filtering in heartbeat, some non-syscall strings were breaking that. With the changes here elastic-agent can still run as root, but the subprocesses can lower their privileges ASAP. This should also make it possible for heartbeat to safely run ICMP pings and synthetics. Synthetics must run as non-root, but ICMP requires NET_RAW. This lets us be consistent in our docs with the recommendation that elastic-agent run as root. * mage fmt Co-authored-by: kaiyan-sheng <kaiyan.sheng@elastic.co> Co-authored-by: Victor Martinez <victormartinezrubio@gmail.com> Co-authored-by: Ugo Sangiorgi <ugo.sangiorgi@elastic.co> Co-authored-by: Dan Kortschak <90160302+efd6@users.noreply.github.com> Co-authored-by: Arnaud Lefebvre <a.lefebvre@outlook.fr> Co-authored-by: Aleksandr Maus <aleksandr.maus@elastic.co> Co-authored-by: apmmachine <58790750+apmmachine@users.noreply.github.com> Co-authored-by: Michael Katsoulis <michaelkatsoulis88@gmail.com> Co-authored-by: Noémi Ványi <kvch@users.noreply.github.com> Co-authored-by: Blake Rouse <blake.rouse@elastic.co> Co-authored-by: LaZyDK <dennisperto@gmail.com> Co-authored-by: Marius Iversen <marius.iversen@elastic.co> Co-authored-by: Andrea Spacca <andrea.spacca@elastic.co> Co-authored-by: Mariana Dima <mariana@elastic.co> Co-authored-by: Andrew Cholakian <andrew@andrewvc.com>

* Add username to ASA Security negotiation log I added the username user.name field to ASA Security negotiation log line. * adding support for both formats * adding changelog entry * updating geo fields in expected output files * reverse formatting * reverting to older version of file * reverting formatting again * regenrate golden files again * remove formatting, ready for review * fixing missing message due to no newline * fix dissect pattern to fit correctly Co-authored-by: Marius Iversen <marius.iversen@elastic.co> (cherry picked from commit df6fde2) # Conflicts: # x-pack/filebeat/module/cisco/asa/test/additional_messages.log # x-pack/filebeat/module/cisco/asa/test/additional_messages.log-expected.json

* Add username to ASA Security negotiation log I added the username user.name field to ASA Security negotiation log line. * adding support for both formats * adding changelog entry * updating geo fields in expected output files * reverse formatting * reverting to older version of file * reverting formatting again * regenrate golden files again * remove formatting, ready for review * fixing missing message due to no newline * fix dissect pattern to fit correctly Co-authored-by: Marius Iversen <marius.iversen@elastic.co> (cherry picked from commit df6fde2)

* Add username to ASA Security negotiation log I added the username user.name field to ASA Security negotiation log line. * adding support for both formats * adding changelog entry * updating geo fields in expected output files * reverse formatting * reverting to older version of file * reverting formatting again * regenrate golden files again * remove formatting, ready for review * fixing missing message due to no newline * fix dissect pattern to fit correctly Co-authored-by: Marius Iversen <marius.iversen@elastic.co> (cherry picked from commit df6fde2) Co-authored-by: LaZyDK <dennisperto@gmail.com>

Add username to ASA Security negotiation log

06fe38f

I added the username user.name field to ASA Security negotiation log line.

botelastic bot added the needs_team Indicates that the issue/PR needs a Team:* label label Jul 20, 2021

ChrsMark requested a review from P1llus July 26, 2021 08:33

kaiyan-sheng added the Team:Security-External Integrations label Jul 26, 2021

botelastic bot removed the needs_team Indicates that the issue/PR needs a Team:* label label Jul 26, 2021

botelastic bot added the Stalled label Aug 25, 2021

mergify bot added the backport-skip Skip notification from the automated backport with mergify label Sep 22, 2021

botelastic bot removed the Stalled label Sep 22, 2021

P1llus added 3 commits October 11, 2021 10:29

Merge branch 'master' into patch-3

88c02c3

adding support for both formats

7d6374d

adding changelog entry

04f61dd

updating geo fields in expected output files

57cac5b

P1llus approved these changes Oct 11, 2021

View reviewed changes

P1llus added the needs_integration_sync Changes in this PR need synced to elastic/integrations. label Oct 11, 2021

andrewkroh requested changes Oct 11, 2021

View reviewed changes

x-pack/filebeat/module/cisco/shared/ingest/asa-ftd-pipeline.yml Outdated Show resolved Hide resolved

x-pack/filebeat/module/cisco/asa/test/additional_messages.log Outdated Show resolved Hide resolved

P1llus added 7 commits October 11, 2021 17:52

reverse formatting

9da0a6c

reverting to older version of file

abe6699

merging master

522d853

Merge branch 'patch-3' of github.com:LaZyDK/beats into patch-3

a2c26a2

reverting formatting again

4d38d6d

regenrate golden files again

2af8965

remove formatting, ready for review

152a52b

fixing missing message due to no newline

09c8849

andrewkroh reviewed Oct 11, 2021

View reviewed changes

x-pack/filebeat/module/cisco/asa/test/additional_messages.log-expected.json Show resolved Hide resolved

fix dissect pattern to fit correctly

9548236

andrewkroh approved these changes Oct 11, 2021

View reviewed changes

P1llus added the backport-v7.16.0 Automated backport with mergify label Oct 11, 2021

mergify bot removed the backport-skip Skip notification from the automated backport with mergify label Oct 11, 2021

P1llus merged commit df6fde2 into elastic:master Oct 11, 2021

mergify bot mentioned this pull request Oct 11, 2021

[7.x](backport #26975) Add username to ASA Security negotiation log #28351

Merged

adriansr added the backport-v7.15.0 Automated backport with mergify label Nov 3, 2021

mergify bot mentioned this pull request Nov 3, 2021

[7.15](backport #26975) Add username to ASA Security negotiation log #28783

Closed

mergify bot mentioned this pull request Nov 3, 2021

[7.16](backport #26975) Add username to ASA Security negotiation log #28784

Merged

adriansr removed the backport-v7.15.0 Automated backport with mergify label Nov 3, 2021

LaZyDK deleted the patch-3 branch November 28, 2021 07:53

This was referenced Mar 10, 2022

Cisco package Needs sync with Beats module elastic/integrations#2116

Closed

[cisco_asa] sync with beats cisco module elastic/integrations#2820

Merged

andrewkroh mentioned this pull request Mar 22, 2022

[production] Promote packages from snapshot (cisco_asa-2.2.0, network_traffic-0.7.1) elastic/package-storage#3811

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add username to ASA Security negotiation log #26975

Add username to ASA Security negotiation log #26975

LaZyDK commented Jul 20, 2021

elasticmachine commented Jul 20, 2021 •

edited by jenkins-beats-ci bot

Loading

Build stats

Test stats 🧪

elasticmachine commented Jul 26, 2021

botelastic bot commented Aug 25, 2021

mergify bot commented Sep 22, 2021

LaZyDK commented Sep 22, 2021

P1llus commented Sep 22, 2021

P1llus commented Oct 11, 2021

P1llus commented Oct 11, 2021

andrewkroh left a comment

Add username to ASA Security negotiation log #26975

Add username to ASA Security negotiation log #26975

Conversation

LaZyDK commented Jul 20, 2021

What does this PR do?

Why is it important?

Checklist

Logs

elasticmachine commented Jul 20, 2021 • edited by jenkins-beats-ci bot Loading

💚 Build Succeeded

Build stats

Test stats 🧪

💚 Flaky test report

🤖 GitHub comments

elasticmachine commented Jul 26, 2021

botelastic bot commented Aug 25, 2021

mergify bot commented Sep 22, 2021

LaZyDK commented Sep 22, 2021

P1llus commented Sep 22, 2021

P1llus commented Oct 11, 2021

P1llus commented Oct 11, 2021

andrewkroh left a comment

Choose a reason for hiding this comment

elasticmachine commented Jul 20, 2021 •

edited by jenkins-beats-ci bot

Loading