Cisco module

This is a module for Cisco network device’s logs and Cisco Umbrella. It includes the following filesets for receiving logs over syslog or read from a file:

Cisco ASA devices also support exporting flow records using NetFlow, which is supported by the netflow module in Filebeat.

When you run the module, it performs a few tasks under the hood:

You can further refine the behavior of the cisco module by specifying variable settings in the modules.d/cisco.yml file, or overriding settings at the command line.

You must enable at least one fileset in the module. Filesets are disabled by default.

The module is by default configured to run via syslog on port 9001 for ASA and port 9002 for IOS. However it can also be configured to read from a file path. See the following example.

Cisco Umbrella publishes its logs in a compressed CSV format to a S3 bucket.

- module: cisco
  asa:
    enabled: true
    var.paths: ["/var/log/cisco-asa.log"]
    var.input: "file"

Each fileset has separate variable settings for configuring the behavior of the module. If you don’t specify variable settings, the cisco module uses the defaults.

For advanced use cases, you can also override input settings. See Override input settings.

Example config:

- module: cisco
  asa:
    var.syslog_host: 0.0.0.0
    var.syslog_port: 9001
    var.log_level: 5

A value of 7 (default) will not filter any messages. A lower value will drop any messages with a severity level higher than the specified value. For example, var.log_level: 3 will allow messages of level 1 (Alert), 2 (Critical) and 3 (Error). All other messages will be dropped.

The Cisco FTD fileset primarily supports parsing IPv4 and IPv6 access list log messages similar to that of ASA devices as well as Security Event Syslog Messages for Intrusion, Connection, File and Malware events.

Field mappings

The ftd fileset maps Security Event Syslog Messages to the Elastic Common Schema (ECS) format. The following table illustrates the mapping from Security Event fields to ECS. The cisco.ftd prefix is used when there is no corresponding ECS field available.

Mappings for Intrusion events fields:

Mappings for Connection and Security Intelligence events fields:

Mappings for File and Malware events fields:

Example configuration:

- module: cisco
  ftd:
    var.syslog_host: 0.0.0.0
    var.syslog_port: 9003
    var.log_level: 5

A value of 7 (default) will not filter any messages. A lower value will drop any messages with a severity level higher than the specified value. For example, var.log_level: 3 will allow messages of level 1 (Alert), 2 (Critical) and 3 (Error). All other messages will be dropped.

The Cisco IOS fileset primarily supports parsing IPv4 and IPv6 access list log messages.

Example config:

- module: cisco
  ios:
    var.syslog_host: 0.0.0.0
    var.syslog_port: 9002

This module parses logs that don’t contain time zone information. For these logs, Filebeat reads the local time zone and uses it when parsing to convert the timestamp to UTC. The time zone to be used for parsing is included in the event in the event.timezone field.

To disable this conversion, the event.timezone field can be removed with the drop_fields processor.

If logs are originated from systems or applications with a different time zone to the local one, the event.timezone field can be overwritten with the original time zone using the add_fields processor.

See Processors for information about specifying processors in your config.

The Cisco Umbrella fileset primarily focuses on reading CSV files from an S3 bucket using the filebeat S3 input.

To configure Cisco Umbrella to log to a self-managed S3 bucket please follow the Cisco Umbrella User Guide, and the AWS S3 input documentation to setup the necessary Amazon SQS queue. Retrieving logs from a Cisco-managed S3 bucket is not currently supported.

This fileset supports all 4 log types: - Proxy - Cloud Firewall - IP Logs - DNS logs

The Cisco Umbrella fileset depends on the original file path structure being followed. This structure is documented Umbrella Log Formats and Versioning:

<subfolder>/<YYYY>-<MM>-<DD>/<YYYY>-<MM>-<DD>-<hh>-<mm>-<xxxx>.csv.gz dnslogs/<year>-<month>-<day>/<year>-<month>-<day>-<hour>-<minute>.csv.gz

Example config:

- module: cisco
  umbrella:
    enabled: true
    var.input: aws-s3
    var.queue_url: https://sqs.us-east-1.amazonaws.com/ID/CiscoQueue
    var.access_key_id: 123456
    var.secret_access_key: PASSWORD

The Cisco AMP fileset focuses on collecting events from your Cisco AMP/Cisco Secure Endpoint API.

To configure the Cisco AMP fileset you will need to retrieve your client_id and api_key from the AMP dashboard. For more information on how to retrieve these credentials, please reference the Cisco AMP API documentation.

The URL configured for the API depends on which region your AMP is located, currently there are three choices: - api.amp.cisco.com - api.apjc.amp.cisco.com - api.eu.amp.cisco.com

If new endpoints are added by Cisco in the future, please reference the API URL list located at the Cisco AMP API Docs.

Example config:

- module: cisco
  amp:
    enabled: true
    var.input: httpjson
    var.url: https://api.amp.cisco.com/v1/events
    var.client_id: 123456
    var.api_key: sfda987gdf90s0df0

When starting up the Filebeat module for the first time, you are able to configure how far back you want Filebeat to collect existing events from. It is also possible to select how often Filebeat will check the Cisco AMP API. Another example below which looks back 200 hours and have a custom timeout:

- module: cisco
  amp:
    enabled: true
    var.input: httpjson
    var.url: https://api.amp.cisco.com/v1/events
    var.client_id: 123456
    var.api_key: sfda987gdf90s0df0
    var.first_interval: 200h
    var.interval: 60m
    var.request_timeout: 120s
    var.limit: 100

This module comes with a sample dashboard for ASA:

For a description of each field in the module, see the exported fields section.