Skip to content

Commit

Permalink
XSUP-42234 Cisco ASA Username Extraction Fix (#36575)
Browse files Browse the repository at this point in the history
* include digits in username extraction regex pattern

* update release notes

* fix release notes typo

* Update Packs/CiscoASA/ReleaseNotes/1_1_10.md

Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com>

---------

Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com>
  • Loading branch information
cweltPA and ShirleyDenkberg authored Oct 1, 2024
1 parent 6505778 commit c27d374
Show file tree
Hide file tree
Showing 3 changed files with 8 additions and 2 deletions.
2 changes: 1 addition & 1 deletion Packs/CiscoASA/ModelingRules/CiscoASA_1_4/CiscoASA_1_4.xif
Original file line number Diff line number Diff line change
Expand Up @@ -1058,7 +1058,7 @@ config case_sensitive = true
state2 = arrayindex(regextract(_raw_log ,"from\s[A-Za-z]+\sto\s[A-Za-z]+\,\sLoading\s([A-Za-z]+)"),0),
alert_msg = arrayindex(regextract(_raw_log ,"\([^\)]+\)\sis\s[A-Za-z]+\:\s(.*)"),0),
process_id = arrayindex(regextract(_raw_log ,"\d+\:\sProcess\s(\d+)\,"),0),
src_username = arrayindex(regextract(_raw_log ,"User\s([A-Za-z\.]+)"),0),
src_username = arrayindex(regextract(_raw_log ,"User\s([\w\.]+)"),0),
network_rule = arrayindex(regextract(_raw_log ,"for\sthis\sconnection\:\s([A-Za-z]+)"),0),
protocol1 = arrayindex(regextract(_raw_log ,"PASSWORD\:\s([A-Z]+)\/"),0),
protocol2 = arrayindex(regextract(_raw_log ,"Configuration\srequest\sfor\s([A-Z]+)\s"),0),
Expand Down
6 changes: 6 additions & 0 deletions Packs/CiscoASA/ReleaseNotes/1_1_10.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@

#### Modeling Rules

##### Cisco ASA Modeling Rule

Fixed an issue where usernames that contain digits weren't extracted fully on certain event logs.
2 changes: 1 addition & 1 deletion Packs/CiscoASA/pack_metadata.json
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
"name": "Cisco ASA",
"description": "Cisco Adaptive Security Appliance Software is the core operating system for the Cisco ASA Family. It delivers enterprise-class firewall capabilities for ASA devices.",
"support": "xsoar",
"currentVersion": "1.1.9",
"currentVersion": "1.1.10",
"author": "Cortex XSOAR",
"url": "https://www.paloaltonetworks.com/cortex",
"email": "",
Expand Down

0 comments on commit c27d374

Please sign in to comment.