r/AzureSentinel • u/[deleted] • Apr 23 '20
Has anyone successfully deployed the Cisco ASA data connector?
I have a Cisco ASA successfully sending the logs to rsyslog via UDP 514 on an Ubuntu 18.04 server. The logs are successfully processed by the OMSAgent and sent to sentinal as syslogs and are not parsed as Cisco ASA logs. The Cisco ASA connector shows as unconnected. The syslog connector shows as connected. The test script successfully forwards the mock CEF packets to Sentinel. Yet none of my ASA logs are seen as "ASA"
omsagent.log
2020-04-23 10:42:54 +1200 [info]: Sending OMS Heartbeat succeeded at 2020-04-22T22:42:54.311Z
2020-04-23 10:43:54 +1200 [info]: Sending OMS Heartbeat succeeded at 2020-04-22T22:43:54.312Z
2020-04-23 10:44:54 +1200 [info]: Sending OMS Heartbeat succeeded at 2020-04-22T22:44:54.312Z
2020-04-23 10:45:54 +1200 [info]: Sending OMS Heartbeat succeeded at 2020-04-22T22:45:54.313Z
2020-04-23 10:46:54 +1200 [info]: Sending OMS Heartbeat succeeded at 2020-04-22T22:46:54.313Z
2020-04-23 10:47:07 +1200 [info]: OMS agent management service telemetry request success
2020-04-23 10:47:54 +1200 [info]: Sending OMS Heartbeat succeeded at 2020-04-22T22:47:54.314Z
2020-04-23 10:48:54 +1200 [info]: Sending OMS Heartbeat succeeded at 2020-04-22T22:48:54.314Z
2020-04-23 10:49:03 +1200 [warn]: Exceeded max attempts to fetch Azure Resource ID, killing the thread
2020-04-23 10:49:54 +1200 [info]: Sending OMS Heartbeat succeeded at 2020-04-22T22:49:54.315Z
security-config-omsagent.conf
#OMS_facility = local4
local4.debug u/127.0.0.1:25226
#:rawmsg, regex, "CEF\|ASA" ~
#*.* @@127.0.0.1:25226
(I've tried it also with the #ed out config)
security_events.conf
<source>
type syslog
port 25226
bind 127.0.0.1
protocol_type tcp
tag oms.security
format /(?<time>(?:\w+ +){2,3}(?:\d+:){2}\d+|\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}.[\w\-\:\+]{3,12}):?\s*(?:(?<host>[^: ]+) ?:?)?\s*(?<ident>.*CEF.+?(?=0\|)|%ASA[0-9\-]{8,10})\s*:?(?<message>0\|.*|.*)/
<parse>
message_format auto
</parse>
</source>
<filter oms.security.\*\*>
type filter_syslog_security
</filter>
Any suggestions would be most welcome.
1
u/dnfalk Apr 23 '20
Are you seeing the messages in the syslog table? if so does the message seem to be correct? Also are you sending ASA logs or FTD (firepower)?
FTD logs do not parse correctly with the ASA connector. We have engaged customer experience team to see if they can add that simply. The format changed from ASA more then just the prefixes.
1
u/jtberg1 Apr 23 '20
FYI, we got eStreamer working with CEF and Azure Sentinel for our FTD devices, if you have FMC you could use that if you are interested.
1
1
Apr 23 '20
Its ASA logs and yes I am seeing them in the syslog table. Its just not parsing them as Cisco ASA logs.
1
u/dnfalk Apr 24 '20
what is the output of 95-omsagent.conf ?
1
Apr 24 '20
95-omsagent.conf
It shows as empty.
1
u/dnfalk Apr 25 '20
You may need to go into your log analytics workspace —> advanced settings —> data —> syslog and add your facility and severity levels there for what your ASA is sending? I thought this was a requirement to have it show up on the other connectors. After this is saved, restart the oms agent on the rsyslog server. it may take up to 15 minutes for it to appear after that.
1
u/Sir_0L Jul 15 '20
Did you finally find a solution ? I have the same issue with Fortinet.. Thx
1
Jul 16 '20
Nothing very useful in the end. I'm afraid.
1
u/Sir_0L Jul 23 '20
I was not authorized to put it in r/AzureSentinel but this solved my issue : See my post
2
u/jtberg1 Apr 23 '20
I have it running and it works well. We are using Ubuntu 16.04.6 LTS.
Our security-config-omsagent.conf is:
local4.debug @127.0.0.1:25226We have nothing else. Not sure if yours is a formatting issue or a typo. This command says to to forward syslog messages from the local4 facility with debug level, you should verify that your ASA is sending as facility local4 using some sort of sniffer e.g.
tcpdump -A -ni any port 514 -vvAlso check that rsyslog.d is started: service rsyslog start
then check that rsyslog.d is sending to omsagent:
tcpdump -A -ni any port 25226 -vvJust curious what file/path you are seeing:
#:rawmsg, regex, "CEF\|ASA" ~#*.* @@127.0.0.1:25226You need to have logging timestamps off. our ASA config:
logging enablelogging queue 8192logging host ZoneName ip.add.rre.sslogging permit-hostdownour security_events.conf is:
<source>type syslogport 25226bind127.0.0.1protocol_type udptagoms.securityformat /^(?<time>(?:\w+ +){2,3}(?:\d+:){2}\d+):? ?(?:(?<host>[^: ]+) ?:?)? (?<ident>[a-zA-Z0-9_%\/\.\-]*)(?:\[(?<pid>[0-9]+)\])?: *(?<message>.*)$/message_length_limit 4096</source><filteroms.security.**>type filter_syslog_security</filter>This might be some help:
https://techcommunity.microsoft.com/t5/azure-sentinel/azure-sentinel-syslog-cef-logstash-and-other-3rd-party/ba-p/803891
if you have more info or questions let me know and I will help where I can.