Cisco ASA integration

%3CLINGO-SUB%20id%3D%22lingo-sub-1295542%22%20slang%3D%22en-US%22%3ECisco%20ASA%20integration%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1295542%22%20slang%3D%22en-US%22%3E%3CP%3EHello%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHave%20managed%20to%20get%20logs%20into%20Sentinel%2C%20and%20can%20see%20them%20in%20Analytics%20and%20in%20the%20events%20list%20and%20graph%2C%20but%20none%20of%20the%20other%20metric%20return%20anything%20other%20than%20'the%20query%20returned%20no%20results'%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAny%20ideas%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1295542%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3Easa%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3Elogs%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1296733%22%20slang%3D%22en-US%22%3ERe%3A%20Cisco%20ASA%20integration%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1296733%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F615805%22%20target%3D%22_blank%22%3E%40saint_stevo%3C%2FA%3E%26nbsp%3BOne%20thing%20we%20noted%20on%20our%20setup%20was%20event%20IDs%20were%20missing.%26nbsp%3B%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1297047%22%20slang%3D%22en-US%22%3ERe%3A%20Cisco%20ASA%20integration%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1297047%22%20slang%3D%22en-US%22%3EDid%20you%20have%20a%20solution%3F%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1302843%22%20slang%3D%22en-US%22%3ERe%3A%20Cisco%20ASA%20integration%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1302843%22%20slang%3D%22en-US%22%3ENope%2C%20we%20just%20did%20a%20quick%20ingestion%20of%20the%20ASA%20logs%20to%20see%20what%20they%20looked%20like.%20We%20filtered%20the%20logs%20based%20on%20VPN%20connnection%20messages%20so%20it%20worked%20for%20our%20purpose.%20To%20move%20forward%20in%20a%20production%20setup%20we%20would%20have%20needed%20to%20solve%20that%20event%20ID%20issue.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1338215%22%20slang%3D%22en-US%22%3ERe%3A%20Cisco%20ASA%20integration%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1338215%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F615805%22%20target%3D%22_blank%22%3E%40saint_stevo%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThe%20Cisco%20ASA%20dashboard%20is%20indeed%20unusable%20but%20the%20main%20problem%20lies%20in%20the%20parsing%20of%20the%20Cisco%20ASA%20logs.%20Cisco%20managed%20to%20make%20these%20logs%20very%20complicated%20and%20difficult%20to%20process.%20For%20example%2C%20to%20get%20the%20full%20data%20on%20a%20simple%20TCP%20connection%20one%20needs%20to%20correlate%20two%20different%20types%20of%20log%20entries%20based%20on%20the%20session%20id%20and%20reshuffle%20the%20source%20IP%2Fport%20and%20destination%20IP%2Fport%20depending%20on%20the%20direction%20of%20the%20traffic.%20So%2C%20to%20actually%20get%20useful%20data%20from%20the%20raw%20Cisco%20ASA%20logs%20in%20the%20CommonSecurityLog%20first%20you%20need%20to%20build%20a%20parser%20to%20put%20the%20data%20in%20order%20and%20the%20build%20a%20workbook%2Fdashboard%20for%20it.%20To%20make%20things%20more%20complicated%2C%20only%20some%20log%20entries%20are%20sent%20to%20the%20CommonSecurityLog%20(those%20related%20to%20allowed%20traffic).%20The%20rest%20are%20sent%20to%20the%20Syslog%20table%20where%20again%2C%20one%20needs%20to%20build%20a%20parser%20from%20scratch.%20Microsoft%20if%20doing%20actually%20a%20little%20bit%20of%20work%20in%20the%20background%20to%20convert%20some%20of%20the%20ASA%20log%20entries%20to%20CEF%20(as%20you%20probably%20know%2C%20the%20ASA%20don't%20know%20CEF).%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EFor%20example%2C%20a%20correct%20parser%20would%20provide%20this%20type%20of%20data%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22cisco_parser.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F186680iA31D518EECCC782F%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20title%3D%22cisco_parser.png%22%20alt%3D%22cisco_parser.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EOnce%20you%20have%20the%20good%20data%2C%20it%20is%20much%20easier%20to%20build%20a%20workbook%20for%20it%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22cisco_workbook.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F186682i7DCA39F40073B799%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20title%3D%22cisco_workbook.png%22%20alt%3D%22cisco_workbook.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20have%20just%20little%20bit%20of%20data%20as%20we%20only%20have%20a%20test%20Cisco%20ASA%205505%20that%20is%20not%20actively%20used%20but%20if%20you%20have%20the%20data%20you%20can%20build%20any%20kind%20of%20visualization.%26nbsp%3BWhat%20type%20of%20data%20you%20would%20want%20to%20see%20on%20an%20ASA%20dashboard%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAdrian%20Grigorof%3C%2FP%3E%3CP%3E%3CA%20href%3D%22http%3A%2F%2Fwww.managedsentinel.com%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ewww.managedsentinel.com%3C%2FA%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1340175%22%20slang%3D%22en-US%22%3ERe%3A%20Cisco%20ASA%20integration%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1340175%22%20slang%3D%22en-US%22%3E%3CP%3EThanks%20for%20the%20reply!%20Not%20sure%20i%20would%20know%20where%20to%20start%20with%20regard%20the%20parser.....but%20your%20example%20screenshot%20is%20a%20lot%20more%20useful%20than%20'The%20query%20returned%20no%20results'%20so%20maybe%20use%20Lockdown%20to%20learn!%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20guess%20a%20number%20of%20'red%20flag'%20type%20bits%20on%20a%20dashboard%2C%20Rule%20changes%2C%20failed%20SSH%20etc.%20And%20some%20trends%20of%20top%20denied%2Fallowed%20based%20on%20IP%2FProtocol%2FPort%20would%20be%20a%20start%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
New Contributor

Hello

 

Have managed to get logs into Sentinel, and can see them in Analytics and in the events list and graph, but none of the other metric return anything other than 'the query returned no results'

 

Any ideas?

 

Thanks

5 Replies

@saint_stevo One thing we noted on our setup was event IDs were missing.  

Highlighted
Did you have a solution?
Highlighted
Nope, we just did a quick ingestion of the ASA logs to see what they looked like. We filtered the logs based on VPN connnection messages so it worked for our purpose. To move forward in a production setup we would have needed to solve that event ID issue.
Highlighted

@saint_stevo 

The Cisco ASA dashboard is indeed unusable but the main problem lies in the parsing of the Cisco ASA logs. Cisco managed to make these logs very complicated and difficult to process. For example, to get the full data on a simple TCP connection one needs to correlate two different types of log entries based on the session id and reshuffle the source IP/port and destination IP/port depending on the direction of the traffic. So, to actually get useful data from the raw Cisco ASA logs in the CommonSecurityLog first you need to build a parser to put the data in order and the build a workbook/dashboard for it. To make things more complicated, only some log entries are sent to the CommonSecurityLog (those related to allowed traffic). The rest are sent to the Syslog table where again, one needs to build a parser from scratch. Microsoft if doing actually a little bit of work in the background to convert some of the ASA log entries to CEF (as you probably know, the ASA don't know CEF).

 

For example, a correct parser would provide this type of data:

 

cisco_parser.png

 

Once you have the good data, it is much easier to build a workbook for it:

 

cisco_workbook.png

 

I have just little bit of data as we only have a test Cisco ASA 5505 that is not actively used but if you have the data you can build any kind of visualization. What type of data you would want to see on an ASA dashboard?

 

Adrian Grigorof

www.managedsentinel.com

Highlighted

Thanks for the reply! Not sure i would know where to start with regard the parser.....but your example screenshot is a lot more useful than 'The query returned no results' so maybe use Lockdown to learn!

 

I guess a number of 'red flag' type bits on a dashboard, Rule changes, failed SSH etc. And some trends of top denied/allowed based on IP/Protocol/Port would be a start