From c1c84fe7d9a2b86a01009e1518ac6ed70795ac23 Mon Sep 17 00:00:00 2001 From: mbonsack Date: Tue, 27 Aug 2019 05:19:49 -0700 Subject: [PATCH] Fix/change sourcetype for NX-OS to cisco:ios (#64) Completes support with docs --- docs/sources.md | 91 +++++++++++++++---- .../conf.d/conflib/vendor_cisco/nx-os.conf | 4 +- .../log_paths/p_rfc3164-cisco-nx-os.conf | 4 +- package/etc/context-local/splunk_index.csv | 4 +- .../vendor_product_by_source.conf | 4 +- .../vendor_product_by_source.csv | 2 +- tests/test_cisco_nx_os.py | 4 +- 7 files changed, 85 insertions(+), 28 deletions(-) diff --git a/docs/sources.md b/docs/sources.md index d4167ef..24e9d72 100644 --- a/docs/sources.md +++ b/docs/sources.md @@ -8,7 +8,7 @@ | Product Manual | https://www.cisco.com/c/en/us/td/docs/security/asa/asa82/configuration/guide/config/monitor_syslog.html | -## Sourcetypes +### Sourcetypes | sourcetype | notes | |----------------|---------------------------------------------------------------------------------------------------------| @@ -16,11 +16,11 @@ | cisco:pix | Not supported | | cisco:fwsm | Not supported | -## Filter type +### Filter type MSG Parse: This filter parses message content -## Setup and Configuration +### Setup and Configuration * Install the Splunk Add-on on the search head(s) for the user communities interested in this data source. If SC4S is exclusively used the addon is not required on the indexer. * Review and update the splunk_index.csv file and set the index as required. @@ -31,7 +31,7 @@ MSG Parse: This filter parses message content * device-id is hostname and included * timestamp is included -## Verification +### Verification Use the following search to validate events are present @@ -39,6 +39,63 @@ Use the following search to validate events are present index= sourcetype=cisco:asa ``` +Verify timestamp, and host values match as expected + +## Product - IOS and NX-OS based equipment + +| Ref | Link | +|----------------|---------------------------------------------------------------------------------------------------------| +| Splunk Add-on | https://splunkbase.splunk.com/app/1467/ | +| IOS Manual | https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960/software/release/12-2_55_se/configuration/guide/scg_2960/swlog.html | +| NX-OS Manual | https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus9000/sw/6-x/system_management/configuration/guide/b_Cisco_Nexus_9000_Series_NX-OS_System_Management_Configuration_Guide/sm_5syslog.html| +| Cisco ACI | https://community.cisco.com/legacyfs/online/attachments/document/technote-aci-syslog_external-v1.pdf | +| Cisco WLC & AP | https://www.cisco.com/c/en/us/support/docs/wireless/4100-series-wireless-lan-controllers/107252-WLC-Syslog-Server.html#anc8 | +### Sourcetypes + +| sourcetype | notes | +|----------------|---------------------------------------------------------------------------------------------------------| +| cisco:ios | This source type is also used for NX-OS, ACI and WLC product lines | + +### Filter type + +* Cisco IOS products can be identified by message parsing alone +* Cisco NX OS, WLC, and ACI products must be identified by host or ip assignment update the filter `f_cisco_nx_os` as required + +### Setup and Configuration + +* Install the Splunk Add-on on the search head(s) for the user communities interested in this data source. If SC4S is exclusively used the addon is not required on the indexer. +* Review and update the splunk_index.csv file and set the index as required. +* IOS Follow vendor configuration steps per Product Manual above ensure: + * Ensure a reliable NTP server is set and synced + * Log Level is 6 "Informational" + * Protocol is TCP/IP + * permit-hostdown is on + * device-id is hostname and included + * timestamp is included +* NX-OS Follow vendor configuration steps per Product Manual above ensure: + * Ensure a reliable NTP server is set and synced + * Log Level is 6 "Informational" user may select alternate levels by module based on use cases + * Protocol is TCP/IP + * device-id is hostname and included + * timestamp is included and milisecond accuracy selected +* ACI Logging configuration of the ACI product often varies by use case. + * Ensure NTP sync is configured and active + * Ensure proper host names are configured +* WLC + * Ensure NTP sync is configured and active + * Ensure proper host names are configured + * For security use cases per AP logging is required + + +### Verification + +Use the following search to validate events are present, for NX-OS, WLC and ACI products ensure each host filter condition is verified + +``` +index= sourcetype=cisco:ios | stats count by host +``` + + Verify timestamp, and host values match as expected # Vendor - Fortinet @@ -51,7 +108,7 @@ Verify timestamp, and host values match as expected | Product Manual | https://docs.fortinet.com/product/fortigate/6.2 | -## Sourcetypes +### Sourcetypes | sourcetype | notes | |----------------|---------------------------------------------------------------------------------------------------------| @@ -60,11 +117,11 @@ Verify timestamp, and host values match as expected | fgt_utm | None | | fgt_event | None -## Filter type +### Filter type MSG Parse: This filter parses message content -## Setup and Configuration +### Setup and Configuration * Install the Splunk Add-on on the search head(s) for the user communities interested in this data source. If SC4S is exclusively used the addon is not required on the indexer. * Review and update the splunk_index.csv file and set the index as required. @@ -103,7 +160,7 @@ end ``` -## Verification +### Verification An active firewall will generate frequent events, in addition fortigate has the ability to test logging functionality using a build in command @@ -117,7 +174,7 @@ Verify timestamp, and host values match as expected index= (sourcetype=fgt_log OR sourcetype=fgt_traffic OR sourcetype=fgt_utm) ``` -###UTM Message type +### UTM Message type ![FortiGate UTM message](FortiGate_utm.png) @@ -140,7 +197,7 @@ Verify timestamp, and host values match as expected | Product Manual | https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/monitoring/use-syslog-for-monitoring/configure-syslog-monitoring.html | -## Sourcetypes +### Sourcetypes | sourcetype | notes | |----------------|---------------------------------------------------------------------------------------------------------| @@ -148,11 +205,11 @@ Verify timestamp, and host values match as expected | pan:traffic | None | | pan:threat | None | -## Filter type +### Filter type MSG Parse: This filter parses message content -## Setup and Configuration +### Setup and Configuration * Install the Splunk Add-on on the search head(s) for the user communities interested in this data source. If SC4S is exclusively used the addon is not required on the indexer. * Review and update the splunk_index.csv file and set the index as required. @@ -161,7 +218,7 @@ MSG Parse: This filter parses message content * Select IETF Format * Ensure the format of the event is not customized -## Verification +### Verification An active firewall will generate frequent events use the following search to validate events are present per source device @@ -179,17 +236,17 @@ index= sourcetype=pan:*| stats count by host | Product Manual | https://support.symantec.com/us/en/article.tech242216.html | -## Sourcetypes +### Sourcetypes | sourcetype | notes | |----------------|---------------------------------------------------------------------------------------------------------| | bluecoat:proxysg:access:kv | Requires version 3.6 | -## Filter type +### Filter type MSG Parse: This filter parses message content -## Setup and Configuration +### Setup and Configuration * Install the Splunk Add-on on the search head(s) for the user communities interested in this data source. If SC4S is exclusively used the addon is not required on the indexer. * Review and update the splunk_index.csv file and set the index as required. @@ -197,7 +254,7 @@ MSG Parse: This filter parses message content * Select TCP or SSL transport option * Ensure the format of the event is customized per Splunk documentation -## Verification +### Verification An active proxy will generate frequent events use the following search to validate events are present per source device diff --git a/package/etc/conf.d/conflib/vendor_cisco/nx-os.conf b/package/etc/conf.d/conflib/vendor_cisco/nx-os.conf index 3c8192b..2f9cacc 100644 --- a/package/etc/conf.d/conflib/vendor_cisco/nx-os.conf +++ b/package/etc/conf.d/conflib/vendor_cisco/nx-os.conf @@ -1,3 +1,3 @@ -filter f_cisco_nx-os { - match("cisco_nx-os", value("fields.sc4s_vendor_product") type(glob) ); +filter f_cisco_nx_os { + match("cisco_nx_os", value("fields.sc4s_vendor_product") type(glob) ); }; \ No newline at end of file diff --git a/package/etc/conf.d/log_paths/p_rfc3164-cisco-nx-os.conf b/package/etc/conf.d/log_paths/p_rfc3164-cisco-nx-os.conf index 025ba55..e9f018c 100644 --- a/package/etc/conf.d/log_paths/p_rfc3164-cisco-nx-os.conf +++ b/package/etc/conf.d/log_paths/p_rfc3164-cisco-nx-os.conf @@ -1,13 +1,13 @@ log { source(s_default-ports); - filter(f_cisco_nx-os); + filter(f_cisco_nx_os); parser { p_add_context_splunk(key("cisco:nx-os")); }; rewrite { - r_set_splunk(template("t_standard")) + r_set_splunk(template("t_hdr_msg")) }; destination(d_hec); #--HEC-- flags(flow-control); diff --git a/package/etc/context-local/splunk_index.csv b/package/etc/context-local/splunk_index.csv index 4f98d23..e3d7f9d 100644 --- a/package/etc/context-local/splunk_index.csv +++ b/package/etc/context-local/splunk_index.csv @@ -4,8 +4,8 @@ cisco:asa,index,netfw cisco:asa,sourcetype,cisco:asa cisco:ios,index,netops cisco:ios,sourcetype,cisco:ios -cisco:nx-os,index,main -cisco:nx-os,sourcetype,cisco:nx-os +cisco:nx-os,index,netops +cisco:nx-os,sourcetype,cisco:ios fgt_event,sourcetype,fgt_event fgt_event,index,netops fgt_log,sourcetype,fgt_log diff --git a/package/etc/context-local/vendor_product_by_source.conf b/package/etc/context-local/vendor_product_by_source.conf index 215d5f6..4da1866 100644 --- a/package/etc/context-local/vendor_product_by_source.conf +++ b/package/etc/context-local/vendor_product_by_source.conf @@ -23,7 +23,7 @@ filter f_juniper_netscreen { host("jnpns-*" type(glob) ) or match("juniper_netscreen" value("fields.sc4s_presume")) }; -filter f_cisco_nx-os { +filter f_cisco_nx_os { host("csconx-*" type(glob) ) - or match("cisco_nx-os" value("fields.sc4s_presume")) + or match("cisco_nx_os" value("fields.sc4s_presume")) }; \ No newline at end of file diff --git a/package/etc/context-local/vendor_product_by_source.csv b/package/etc/context-local/vendor_product_by_source.csv index e04b149..5193616 100644 --- a/package/etc/context-local/vendor_product_by_source.csv +++ b/package/etc/context-local/vendor_product_by_source.csv @@ -3,4 +3,4 @@ f_juniper_nsm,sc4s_vendor_product,"juniper_nsm" f_juniper_nsm_idp,sc4s_vendor_product,"juniper_nsm_idp" f_juniper_idp,sc4s_vendor_product,"juniper_idp" f_juniper_netscreen,sc4s_vendor_product,"juniper_netscreen" -f_cisco_nx-os,sc4s_vendor_product,"cisco_nx-os" \ No newline at end of file +f_cisco_nx_os,sc4s_vendor_product,"cisco_nx_os" \ No newline at end of file diff --git a/tests/test_cisco_nx_os.py b/tests/test_cisco_nx_os.py index d44e009..27b1155 100644 --- a/tests/test_cisco_nx_os.py +++ b/tests/test_cisco_nx_os.py @@ -21,7 +21,7 @@ def test_cisco_nx_os(record_property, setup_wordlist, get_host_key, setup_splunk sendsingle(message) - st = env.from_string("search index=main host=\"csconx-{{ host }}\" sourcetype=\"cisco:nx-os\" | head 2") + st = env.from_string("search index=netops host=\"csconx-{{ host }}\" sourcetype=\"cisco:ios\" | head 2") search = st.render(host=host) resultCount, eventCount = splunk_single(setup_splunk, search) @@ -43,7 +43,7 @@ def test_cisco_nx_os(record_property, setup_wordlist, get_host_key, setup_splunk # # sendsingle(message, host="sc4s-nx-os") # -# st = env.from_string("search index=main host=\"{{ host }}\" sourcetype=\"cisco:nx-o\" | head 2") +# st = env.from_string("search index=main host=\"{{ host }}\" sourcetype=\"cisco:ios\" | head 2") # search = st.render(host=host) # # resultCount, eventCount = splunk_single(setup_splunk, search)