Fix/change sourcetype for NX-OS to cisco:ios (#64)

Completes support with docs
CSVD · Aug 27, 2019 · c1c84fe · c1c84fe
1 parent ef63b1b
commit c1c84fe
Show file tree

Hide file tree

Showing 7 changed files with 85 additions and 28 deletions.
diff --git a/docs/sources.md b/docs/sources.md
@@ -8,19 +8,19 @@
 | Product Manual | https://www.cisco.com/c/en/us/td/docs/security/asa/asa82/configuration/guide/config/monitor_syslog.html |
 
 
-## Sourcetypes
+### Sourcetypes
 
 | sourcetype     | notes                                                                                                   |
 |----------------|---------------------------------------------------------------------------------------------------------|
 | cisco:asa      | None                                                                                                    |
 | cisco:pix      | Not supported                                                                                           |
 | cisco:fwsm     | Not supported                                                                                           |
 
-## Filter type
+### Filter type
 
 MSG Parse: This filter parses message content
 
-## Setup and Configuration
+### Setup and Configuration
 
 * Install the Splunk Add-on on the search head(s) for the user communities interested in this data source. If SC4S is exclusively used the addon is not required on the indexer.
 * Review and update the splunk_index.csv file and set the index as required.
@@ -31,14 +31,71 @@ MSG Parse: This filter parses message content
     * device-id is hostname and included
     * timestamp is included
 
-## Verification
+### Verification
 
 Use the following search to validate events are present
 
 ```
 index=<asconfigured> sourcetype=cisco:asa
 ```
 
+Verify timestamp, and host values match as expected    
+
+## Product - IOS and NX-OS based equipment
+
+| Ref            | Link                                                                                                    |
+|----------------|---------------------------------------------------------------------------------------------------------|
+| Splunk Add-on  | https://splunkbase.splunk.com/app/1467/                                                                 |
+| IOS Manual     | https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960/software/release/12-2_55_se/configuration/guide/scg_2960/swlog.html |
+| NX-OS Manual   | https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus9000/sw/6-x/system_management/configuration/guide/b_Cisco_Nexus_9000_Series_NX-OS_System_Management_Configuration_Guide/sm_5syslog.html|
+| Cisco ACI      | https://community.cisco.com/legacyfs/online/attachments/document/technote-aci-syslog_external-v1.pdf |
+| Cisco WLC & AP | https://www.cisco.com/c/en/us/support/docs/wireless/4100-series-wireless-lan-controllers/107252-WLC-Syslog-Server.html#anc8 |
+### Sourcetypes
+
+| sourcetype     | notes                                                                                                   |
+|----------------|---------------------------------------------------------------------------------------------------------|
+| cisco:ios      | This source type is also used for NX-OS, ACI and WLC product lines                                                                                                    |
+
+### Filter type
+
+* Cisco IOS products can be identified by message parsing alone
+* Cisco NX OS, WLC, and ACI products must be identified by host or ip assignment update the filter `f_cisco_nx_os` as required
+
+### Setup and Configuration
+
+* Install the Splunk Add-on on the search head(s) for the user communities interested in this data source. If SC4S is exclusively used the addon is not required on the indexer.
+* Review and update the splunk_index.csv file and set the index as required.
+* IOS Follow vendor configuration steps per Product Manual above ensure:
+    * Ensure a reliable NTP server is set and synced
+    * Log Level is 6 "Informational"
+    * Protocol is TCP/IP
+    * permit-hostdown is on
+    * device-id is hostname and included
+    * timestamp is included
+* NX-OS Follow vendor configuration steps per Product Manual above ensure:
+    * Ensure a reliable NTP server is set and synced
+    * Log Level is 6 "Informational" user may select alternate levels by module based on use cases
+    * Protocol is TCP/IP
+    * device-id is hostname and included
+    * timestamp is included and milisecond accuracy selected
+* ACI Logging configuration of the ACI product often varies by use case. 
+    * Ensure NTP sync is configured and active
+    * Ensure proper host names are configured
+* WLC 
+    * Ensure NTP sync is configured and active
+    * Ensure proper host names are configured
+    * For security use cases per AP logging is required
+
+
+### Verification
+
+Use the following search to validate events are present, for NX-OS, WLC and ACI products ensure each host filter condition is verified
+
+```
+index=<asconfigured> sourcetype=cisco:ios | stats count by host
+```
+
+
 Verify timestamp, and host values match as expected    
 
 # Vendor - Fortinet
@@ -51,7 +108,7 @@ Verify timestamp, and host values match as expected
 | Product Manual | https://docs.fortinet.com/product/fortigate/6.2                                                         |
 
 
-## Sourcetypes
+### Sourcetypes
 
 | sourcetype     | notes                                                                                                   |
 |----------------|---------------------------------------------------------------------------------------------------------|
@@ -60,11 +117,11 @@ Verify timestamp, and host values match as expected
 | fgt_utm        | None                                                                                          |
 | fgt_event      | None 
 
-## Filter type
+### Filter type
 
 MSG Parse: This filter parses message content
 
-## Setup and Configuration
+### Setup and Configuration
 
 * Install the Splunk Add-on on the search head(s) for the user communities interested in this data source. If SC4S is exclusively used the addon is not required on the indexer.
 * Review and update the splunk_index.csv file and set the index as required.
@@ -103,7 +160,7 @@ end
 
 ```
 
-## Verification
+### Verification
 
 An active firewall will generate frequent events, in addition fortigate has the ability to test logging functionality using a build in command
 
@@ -117,7 +174,7 @@ Verify timestamp, and host values match as expected
 index=<asconfigured> (sourcetype=fgt_log OR sourcetype=fgt_traffic OR sourcetype=fgt_utm) 
 ```
 
-###UTM Message type
+### UTM Message type
 
 ![FortiGate UTM message](FortiGate_utm.png)
 
@@ -140,19 +197,19 @@ Verify timestamp, and host values match as expected
 | Product Manual | https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/monitoring/use-syslog-for-monitoring/configure-syslog-monitoring.html                                                         |
 
 
-## Sourcetypes
+### Sourcetypes
 
 | sourcetype     | notes                                                                                                   |
 |----------------|---------------------------------------------------------------------------------------------------------|
 | pan:log        | None                                                                                                    |
 | pan:traffic    | None                                                                                         |
 | pan:threat     | None                                                                                          |
 
-## Filter type
+### Filter type
 
 MSG Parse: This filter parses message content
 
-## Setup and Configuration
+### Setup and Configuration
 
 * Install the Splunk Add-on on the search head(s) for the user communities interested in this data source. If SC4S is exclusively used the addon is not required on the indexer.
 * Review and update the splunk_index.csv file and set the index as required.
@@ -161,7 +218,7 @@ MSG Parse: This filter parses message content
     * Select IETF Format
     * Ensure the format of the event is not customized
 
-## Verification
+### Verification
 
 An active firewall will generate frequent events use the following search to validate events are present per source device
 
@@ -179,25 +236,25 @@ index=<asconfigured> sourcetype=pan:*| stats count by host
 | Product Manual | https://support.symantec.com/us/en/article.tech242216.html                                                        |
 
 
-## Sourcetypes
+### Sourcetypes
 
 | sourcetype     | notes                                                                                                   |
 |----------------|---------------------------------------------------------------------------------------------------------|
 | bluecoat:proxysg:access:kv        | Requires version 3.6                                                                                                    |
 
-## Filter type
+### Filter type
 
 MSG Parse: This filter parses message content
 
-## Setup and Configuration
+### Setup and Configuration
 
 * Install the Splunk Add-on on the search head(s) for the user communities interested in this data source. If SC4S is exclusively used the addon is not required on the indexer.
 * Review and update the splunk_index.csv file and set the index as required.
 * Refer to the Splunk TA documentation for the specific customer format required for proxy configuration
     * Select TCP or SSL transport option
     * Ensure the format of the event is customized per Splunk documentation
 
-## Verification
+### Verification
 
 An active proxy will generate frequent events use the following search to validate events are present per source device
 

diff --git a/package/etc/conf.d/conflib/vendor_cisco/nx-os.conf b/package/etc/conf.d/conflib/vendor_cisco/nx-os.conf
@@ -1,3 +1,3 @@
-filter f_cisco_nx-os {
-    match("cisco_nx-os", value("fields.sc4s_vendor_product") type(glob) );
+filter f_cisco_nx_os {
+    match("cisco_nx_os", value("fields.sc4s_vendor_product") type(glob) );
 };
diff --git a/package/etc/conf.d/log_paths/p_rfc3164-cisco-nx-os.conf b/package/etc/conf.d/log_paths/p_rfc3164-cisco-nx-os.conf
@@ -1,13 +1,13 @@
 log {
 
     source(s_default-ports);
-    filter(f_cisco_nx-os);
+    filter(f_cisco_nx_os);
 
     parser {
             p_add_context_splunk(key("cisco:nx-os"));
     };
     rewrite {
-        r_set_splunk(template("t_standard"))
+        r_set_splunk(template("t_hdr_msg"))
     };
     destination(d_hec);  #--HEC--
     flags(flow-control);

diff --git a/package/etc/context-local/splunk_index.csv b/package/etc/context-local/splunk_index.csv
@@ -4,8 +4,8 @@ cisco:asa,index,netfw
 cisco:asa,sourcetype,cisco:asa
 cisco:ios,index,netops
 cisco:ios,sourcetype,cisco:ios
-cisco:nx-os,index,main
-cisco:nx-os,sourcetype,cisco:nx-os
+cisco:nx-os,index,netops
+cisco:nx-os,sourcetype,cisco:ios
 fgt_event,sourcetype,fgt_event
 fgt_event,index,netops
 fgt_log,sourcetype,fgt_log

diff --git a/package/etc/context-local/vendor_product_by_source.conf b/package/etc/context-local/vendor_product_by_source.conf
@@ -23,7 +23,7 @@ filter f_juniper_netscreen {
     host("jnpns-*" type(glob) )
     or match("juniper_netscreen" value("fields.sc4s_presume"))
 };
-filter f_cisco_nx-os {
+filter f_cisco_nx_os {
     host("csconx-*" type(glob) )
-    or match("cisco_nx-os" value("fields.sc4s_presume"))
+    or match("cisco_nx_os" value("fields.sc4s_presume"))
 };
diff --git a/package/etc/context-local/vendor_product_by_source.csv b/package/etc/context-local/vendor_product_by_source.csv
@@ -3,4 +3,4 @@ f_juniper_nsm,sc4s_vendor_product,"juniper_nsm"
 f_juniper_nsm_idp,sc4s_vendor_product,"juniper_nsm_idp"
 f_juniper_idp,sc4s_vendor_product,"juniper_idp"
 f_juniper_netscreen,sc4s_vendor_product,"juniper_netscreen"
-f_cisco_nx-os,sc4s_vendor_product,"cisco_nx-os"
+f_cisco_nx_os,sc4s_vendor_product,"cisco_nx_os"
diff --git a/tests/test_cisco_nx_os.py b/tests/test_cisco_nx_os.py
@@ -21,7 +21,7 @@ def test_cisco_nx_os(record_property, setup_wordlist, get_host_key, setup_splunk
 
     sendsingle(message)
 
-    st = env.from_string("search index=main host=\"csconx-{{ host }}\" sourcetype=\"cisco:nx-os\" | head 2")
+    st = env.from_string("search index=netops host=\"csconx-{{ host }}\" sourcetype=\"cisco:ios\" | head 2")
     search = st.render(host=host)
 
     resultCount, eventCount = splunk_single(setup_splunk, search)
@@ -43,7 +43,7 @@ def test_cisco_nx_os(record_property, setup_wordlist, get_host_key, setup_splunk
 #
 #    sendsingle(message, host="sc4s-nx-os")
 #
-#    st = env.from_string("search index=main host=\"{{ host }}\" sourcetype=\"cisco:nx-o\" | head 2")
+#    st = env.from_string("search index=main host=\"{{ host }}\" sourcetype=\"cisco:ios\" | head 2")
 #    search = st.render(host=host)
 #
 #    resultCount, eventCount = splunk_single(setup_splunk, search)