-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[filteradd] Support Cisco Firepower MC (#659)
- Loading branch information
Ryan Faircloth
authored and
GitHub
committed
Aug 21, 2020
1 parent
e772e06
commit 87cb894
Showing
7 changed files
with
147 additions
and
16 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,3 @@ | ||
| filter f_cisco_firepower { | ||
| program('SFIMS'); | ||
| }; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,63 @@ | ||
| # cisco_firepower | ||
| {{- /* The following provides a unique port source configuration if env var(s) are set */}} | ||
| {{- $context := dict "port_id" "CISCO_FIREPOWER" "parser" "rfc3164" }} | ||
| {{- tmpl.Exec "t/source_network.t" $context }} | ||
|
|
||
| log { | ||
| junction { | ||
| {{- if or (or (getenv (print "SC4S_LISTEN_CISCO_FIREPOWER_TCP_PORT")) (getenv (print "SC4S_LISTEN_CISCO_FIREPOWER_UDP_PORT"))) (getenv (print "SC4S_LISTEN_CISCO_FIREPOWER_TLS_PORT")) }} | ||
| channel { | ||
| # Listen on the specified dedicated port(s) for CISCO_FIREPOWER traffic | ||
| source (s_CISCO_FIREPOWER); | ||
| flags (final); | ||
| }; | ||
| {{- end}} | ||
| channel { | ||
| # Listen on the default port (typically 514) for CISCO_FIREPOWER traffic | ||
| source (s_DEFAULT); | ||
| filter(f_cisco_firepower); | ||
| flags(final); | ||
| }; | ||
| }; | ||
|
|
||
| if { | ||
| filter{program("SFIMS")}; | ||
| rewrite { | ||
| set("cisco_firepower", value("fields.sc4s_vendor_product")); | ||
| r_set_splunk_dest_default(sourcetype("cisco:firepower:syslog")) | ||
| }; | ||
| parser { p_add_context_splunk(key("cisco_firepower")); }; | ||
| parser (compliance_meta_by_source); | ||
| rewrite { set("$(template ${.splunk.sc4s_template} $(template t_hdr_msg))" value("MSG")); }; | ||
| } else { | ||
| rewrite { | ||
| set("cisco_firepower", value("fields.sc4s_vendor_product")); | ||
| subst("^[^\t]+\t", "", value("MESSAGE"), flags("global")); | ||
| set("${PROGRAM}", value(".PROGRAM")); | ||
| subst('^\/(?:[^\/]+\/)+', "" , value(".PROGRAM")); | ||
| r_set_splunk_dest_default(sourcetype("cisco_firepower:${.PROGRAM}"), source("program:${.PROGRAM}")) | ||
| }; | ||
| parser { p_add_context_splunk(key("cisco_firepower")); }; | ||
| parser (compliance_meta_by_source); | ||
| rewrite { set("$(template ${.splunk.sc4s_template} $(template t_legacy_hdr_msg))" value("MSG")); }; | ||
| }; | ||
|
|
||
|
|
||
| {{- if or (conv.ToBool (getenv "SC4S_DEST_SPLUNK_HEC_GLOBAL" "yes")) (conv.ToBool (getenv "SC4S_DEST_CISCO_FIREPOWER_HEC" "no")) }} | ||
| destination(d_hec); | ||
| {{- end}} | ||
|
|
||
| {{- if or (conv.ToBool (getenv "SC4S_ARCHIVE_GLOBAL" "no")) (conv.ToBool (getenv "SC4S_ARCHIVE_CISCO_FIREPOWER" "no")) }} | ||
| destination(d_archive); | ||
| {{- end}} | ||
|
|
||
| {{- if (print (getenv "SC4S_DEST_GLOBAL_ALTERNATES")) }} | ||
| {{ getenv "SC4S_DEST_GLOBAL_ALTERNATES" | regexp.ReplaceLiteral "^" "destination(" | regexp.ReplaceLiteral "[, ]+" ");\n destination(" }}); | ||
| {{- end }} | ||
|
|
||
| {{- if (print (getenv "SC4S_DEST_CISCO_FIREPOWER_ALTERNATES")) }} | ||
| {{ getenv "SC4S_DEST_CISCO_FIREPOWER_ALTERNATES" | regexp.ReplaceLiteral "^" "destination(" | regexp.ReplaceLiteral "[, ]+" ");\n destination(" }}); | ||
| {{- end }} | ||
|
|
||
| flags(flow-control,final); | ||
| }; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,44 @@ | ||
| # Copyright 2019 Splunk, Inc. | ||
| # | ||
| # Use of this source code is governed by a BSD-2-clause-style | ||
| # license that can be found in the LICENSE-BSD2 file or at | ||
| # https://opensource.org/licenses/BSD-2-Clause | ||
| import random | ||
|
|
||
| from jinja2 import Environment | ||
|
|
||
| from .sendmessage import * | ||
| from .splunkutils import * | ||
| from .timeutils import * | ||
|
|
||
| env = Environment() | ||
|
|
||
|
|
||
| def test_cisco_firepower(record_property, setup_wordlist, setup_splunk, setup_sc4s): | ||
| host = "{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist)) | ||
|
|
||
| dt = datetime.datetime.now() | ||
| iso, bsd, time, date, tzoffset, tzname, epoch = time_operations(dt) | ||
|
|
||
| # Tune time functions | ||
| epoch = epoch[:-7] | ||
|
|
||
| mt = env.from_string( | ||
| "{{ mark }} {{ bsd }} {{ host }} SFIMS: Protocol: TCP, SrcIP: 1.1.1.1, OriginalClientIP: ::, DstIP: 2.2.2.2, SrcPort: 47097, DstPort: 33897, TCPFlags: 0x0, DE: Primary Detection Engine (asdf912a-ad91-d192-adsf-12aadf32910d), Policy: device-policy, ConnectType: Start, AccessControlRuleName: EU-NoLicense-Block-All, AccessControlRuleAction: Block with reset, Prefilter Policy: Default Prefilter Policy, InitiatorPackets: 1, ResponderPackets: 0, InitiatorBytes: 54, ResponderBytes: 0, NAPPolicy: Balanced Security and Connectivity, DNSResponseType: No Error, Sinkhole: Unknown, URLCategory: Unknown, URLReputation: Risk unknown\n" | ||
| ) | ||
| message = mt.render(mark="<111>", bsd=bsd, host=host) | ||
|
|
||
| sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) | ||
|
|
||
| st = env.from_string( | ||
| 'search _time={{ epoch }} index=netids host="{{ host }}" sourcetype="cisco:firepower:syslog"' | ||
| ) | ||
| search = st.render(epoch=epoch, host=host) | ||
|
|
||
| resultCount, eventCount = splunk_single(setup_splunk, search) | ||
|
|
||
| record_property("host", host) | ||
| record_property("resultCount", resultCount) | ||
| record_property("message", message) | ||
|
|
||
| assert resultCount == 1 |