Feature/filter cisco ios (#21)

* Support Cisco ASA and misc fixes

Fixes #14
Fixes #15
Fixes #16

* Test Refactor

Fixes #18
Fixes #19

* New filter cisco IOS

Fixes #20

* Update .env.template

.env.template

@@ -16,3 +16,6 @@ SPLUNK_HEC_STATSURL=https://splunk:8088/services/collector/event
 SPLUNK_CONNECT_METHOD=hec
 SPLUNK_DEFAULT_INDEX=main
 SPLUNK_METRICS_INDEX=metrics
+SPLUNK_APPS_URL=https://splunkbase.splunk.com/app/2757/release/6.1.1/download,https://splunkbase.splunk.com/app/3245/release/1.0/download,https://splunkbase.splunk.com/app/1620/release/3.4.0/download,https://splunkbase.splunk.com/app/1467/release/2.5.8/download
+SPLUNKBASE_USERNAME=username
+SPLUNKBASE_PASSWORD=password

package/etc/conf.d/filters/cisco_asa_tradditional.conf

@@ -5,7 +5,7 @@ log {
             or message('^.{10,60} : %ASA-\d+-\d{1,10}: ')
         ;};
 
-    #Cisco ASA can send 3164 or 5424 either way we are good with basic parsing
+    #Cisco ASA can send 3264 or 5424 either way we are good with basic parsing
     parser {
         #basic parsing
         syslog-parser(time-zone(`default-timezone`));

package/etc/conf.d/filters/cisco_ios.conf

@@ -0,0 +1,16 @@
+# ===============================================================================================
+# Cisco IOS (Route/Switch)
+# ===============================================================================================
+
+log {
+
+    source(s_default-ports);
+
+    parser { cisco-parser(); };
+
+    parser {p_add_context_splunk(key("cisco:ios")); };
+    rewrite { r_set_splunk_basic(template("t_msg_only"))}; #--HEC--
+    destination(d_hec);  #--HEC--
+
+    flags(final);
+};

package/etc/context/splunk_index.csv

@@ -1,5 +1,7 @@
 cisco:asa,index,main
 cisco:asa,sourcetype,cisco:asa
+cisco:ios,index,main
+cisco:ios,sourcetype,cisco:ios
 pan:traffic,index,main
 pan:threat,index,main
 pan:system,index,main

tests/__init__.py

@@ -0,0 +1,5 @@
+# Copyright 2019 Splunk, Inc.
+#
+# Use of this source code is governed by a BSD-2-clause-style
+# license that can be found in the LICENSE-BSD2 file or at
+# https://opensource.org/licenses/BSD-2-Clause

tests/conftest.py

@@ -0,0 +1,45 @@
+# Copyright 2019 Splunk, Inc.
+#
+# Use of this source code is governed by a BSD-2-clause-style
+# license that can be found in the LICENSE-BSD2 file or at
+# https://opensource.org/licenses/BSD-2-Clause
+import os
+import random
+from time import sleep
+
+import pytest
+import splunklib.client as client
+
+
+@pytest.fixture(scope="module")
+def setup_wordlist():
+    path_to_current_file = os.path.realpath(__file__)
+    current_directory = os.path.split(path_to_current_file)[0]
+    path_to_file = os.path.join(current_directory, "data/wordlist.txt")
+
+    wordlist = [line.rstrip('\n') for line in open(path_to_file)]
+    return wordlist
+
+
+@pytest.fixture
+def get_host_key(setup_wordlist):
+    part1 = random.choice(setup_wordlist)
+    part2 = random.choice(setup_wordlist)
+    host = "{}-{}".format(part1, part2)
+
+    return host
+
+
+@pytest.fixture
+def setup_splunk():
+    tried = 0
+    while True:
+        try:
+            c = client.connect(username="admin", password="Changed@11", host="splunk", port="8089")
+            break
+        except ConnectionRefusedError:
+            tried += 1
+            if tried > 180:
+                raise
+            sleep(1)
+    return c