Forum Discussion

JLospinoso's avatar
JLospinoso
Copper Contributor
Jan 03, 2024

Cisco ASA Events - TCP Build Messages (302013) Not Parsing Correctly

It seems that for the ASA Sentinel is not correctly parsing source and destination IP/Port in TCP or UDP build messages where communication direction is outbound. It doesn't help things that Cisco do...
analytics
data collection
Log Data
siem
JLospinoso's avatar
JLospinoso
Copper Contributor
Jan 04, 2024

 

Good questions, we're currently using the V1 Cisco ASA Data Connector, 2+ years old now. It may well be that a newer V3 connector fixes this. It's difficult to understand how even a V1 makes it out the door with source and destination IPs reversed, but makes sense to give it a try.

 

Doesn't seem to be an upgrade button and appears that the Data Connector content has been re-worked, we don't even see all of our connectors under "Data Connectors", it's telling us we have to Centralize our content. We'll have support walk us through that. Thanks, J-

 

 

  • Clive_Watson's avatar
    Clive_Watson
    Bronze Contributor
    Jan 04, 2024

    You need to look in [Content Hub] not [Data Connectors], it all moved there a while a go 

Resources