[cisco_ftd] Fixed grok errors on ftd message ID 305006. Added additio…

…nal matching patterns per specification. (#11780) * Fixed grok errors on ftd message ID 305006. Added additional matching pattern per specification. * Updated changelog with PR number
elastic · Nov 20, 2024 · 22070e4 · 22070e4
1 parent 792f10a
commit 22070e4
Show file tree

Hide file tree

Showing 22 changed files with 3,238 additions and 20 deletions.
diff --git a/packages/cisco_ftd/changelog.yml b/packages/cisco_ftd/changelog.yml
@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "3.4.4"
+  changes:
+    - description: Fixed grok errors on ftd message ID 305006. Added additional matching pattern per specification.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/11780
 - version: "3.4.3"
   changes:
     - description: Use triple-brace Mustache templating when referencing variables in ingest pipelines.

diff --git a/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-asa-fix.log-expected.json b/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-asa-fix.log-expected.json
@@ -439,4 +439,4 @@
             ]
         }
     ]
-}
+}
diff --git a/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-asa.log-expected.json b/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-asa.log-expected.json
@@ -22248,4 +22248,4 @@
             ]
         }
     ]
-}
+}
diff --git a/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-dns.log-expected.json b/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-dns.log-expected.json
@@ -3046,4 +3046,4 @@
             ]
         }
     ]
-}
+}
diff --git a/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-filtered.log-expected.json b/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-filtered.log-expected.json
@@ -86,4 +86,4 @@
             ]
         }
     ]
-}
+}
diff --git a/.../cisco_ftd/data_stream/log/_dev/test/pipeline/test-firepower-management.log-expected.json b/.../cisco_ftd/data_stream/log/_dev/test/pipeline/test-firepower-management.log-expected.json
@@ -1246,4 +1246,4 @@
             ]
         }
     ]
-}
+}
diff --git a/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-ftd-305006.log b/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-ftd-305006.log
@@ -0,0 +1,27 @@
+<163>%FTD-3-305006: regular translation creation failed for icmp src any:81.2.69.195/21 dst WAN-PROV:81.2.69.200 (type 3, code 0)
+<163>%FTD-3-305006: regular translation creation failed for icmp src any:81.2.69.195 dst WAN-PROV:81.2.69.200/9234 (type 3, code 0)
+<163>%FTD-3-305006: regular translation creation failed for icmp src any:81.2.69.195/21 dst WAN-PROV:81.2.69.200/9234 (type 3, code 0)
+<131>Nov 14 16:18:47 firepower : %FTD-3-305006: regular translation creation failed for icmp src any:81.2.69.195(LOCAL\esurbey) dst Internet:81.2.69.200 (type 3, code 3)
+<131>Nov 14 16:18:47 firepower : %FTD-3-305006: regular translation creation failed for icmp src any:81.2.69.195 (LOCAL\esurbey) dst Internet:81.2.69.200 (type 3, code 3)
+<131>Nov 14 16:18:47 firepower : %FTD-3-305006: regular translation creation failed for icmp src any:81.2.69.195 dst Internet:81.2.69.200(host1\foobar) (type 3, code 3)
+<131>Nov 14 16:18:47 firepower : %FTD-3-305006: regular translation creation failed for icmp src any:81.2.69.195 dst Internet:81.2.69.200 (host1\foobar) (type 3, code 3)
+<131>Nov 14 16:18:47 firepower : %FTD-3-305006: regular translation creation failed for icmp src any:81.2.69.195(host1\foobar) dst Internet:81.2.69.200(LOCAL\esurbey) (type 3, code 3)
+<131>Nov 14 16:18:47 firepower : %FTD-3-305006: regular translation creation failed for icmp src any:81.2.69.195 (host1\foobar) dst Internet:81.2.69.200 (LOCAL\esurbey) (type 3, code 3)
+<131>Nov 14 16:18:47 firepower : %FTD-3-305006: regular translation creation failed for icmp src any:81.2.69.195/21(LOCAL\esurbey) dst Internet:81.2.69.200 (type 3, code 3)
+<131>Nov 14 16:18:47 firepower : %FTD-3-305006: regular translation creation failed for icmp src any:81.2.69.195/21 (LOCAL\esurbey) dst Internet:81.2.69.200 (type 3, code 3)
+<131>Nov 14 16:18:47 firepower : %FTD-3-305006: regular translation creation failed for icmp src any:81.2.69.195/21 dst Internet:81.2.69.200(host1\foobar) (type 3, code 3)
+<131>Nov 14 16:18:47 firepower : %FTD-3-305006: regular translation creation failed for icmp src any:81.2.69.195/21 dst Internet:81.2.69.200 (host1\foobar) (type 3, code 3)
+<131>Nov 14 16:18:47 firepower : %FTD-3-305006: regular translation creation failed for icmp src any:81.2.69.195/21(host1\foobar) dst Internet:81.2.69.200(LOCAL\esurbey) (type 3, code 3)
+<131>Nov 14 16:18:47 firepower : %FTD-3-305006: regular translation creation failed for icmp src any:81.2.69.195/21 (host1\foobar) dst Internet:81.2.69.200 (LOCAL\esurbey) (type 3, code 3)
+<131>Nov 14 16:18:47 firepower : %FTD-3-305006: regular translation creation failed for icmp src any:81.2.69.195(LOCAL\esurbey) dst Internet:81.2.69.200/9234 (type 3, code 3)
+<131>Nov 14 16:18:47 firepower : %FTD-3-305006: regular translation creation failed for icmp src any:81.2.69.195 (LOCAL\esurbey) dst Internet:81.2.69.200/9234 (type 3, code 3)
+<131>Nov 14 16:18:47 firepower : %FTD-3-305006: regular translation creation failed for icmp src any:81.2.69.195 dst Internet:81.2.69.200/9234(host1\foobar) (type 3, code 3)
+<131>Nov 14 16:18:47 firepower : %FTD-3-305006: regular translation creation failed for icmp src any:81.2.69.195 dst Internet:81.2.69.200/9234 (host1\foobar) (type 3, code 3)
+<131>Nov 14 16:18:47 firepower : %FTD-3-305006: regular translation creation failed for icmp src any:81.2.69.195(host1\foobar) dst Internet:81.2.69.200/9234(LOCAL\esurbey) (type 3, code 3)
+<131>Nov 14 16:18:47 firepower : %FTD-3-305006: regular translation creation failed for icmp src any:81.2.69.195 (host1\foobar) dst Internet:81.2.69.200/9234 (LOCAL\esurbey) (type 3, code 3)
+<131>Nov 14 16:18:47 firepower : %FTD-3-305006: regular translation creation failed for icmp src any:81.2.69.195/21(LOCAL\esurbey) dst Internet:81.2.69.200/9234 (type 3, code 3)
+<131>Nov 14 16:18:47 firepower : %FTD-3-305006: regular translation creation failed for icmp src any:81.2.69.195/21 (LOCAL\esurbey) dst Internet:81.2.69.200/9234 (type 3, code 3)
+<131>Nov 14 16:18:47 firepower : %FTD-3-305006: regular translation creation failed for icmp src any:81.2.69.195/21 dst Internet:81.2.69.200/9234(host1\foobar) (type 3, code 3)
+<131>Nov 14 16:18:47 firepower : %FTD-3-305006: regular translation creation failed for icmp src any:81.2.69.195/21 dst Internet:81.2.69.200/9234 (host1\foobar) (type 3, code 3)
+<131>Nov 14 16:18:47 firepower : %FTD-3-305006: regular translation creation failed for icmp src any:81.2.69.195/21(host1\foobar) dst Internet:81.2.69.200/9234(LOCAL\esurbey) (type 3, code 3)
+<131>Nov 14 16:18:47 firepower : %FTD-3-305006: regular translation creation failed for icmp src any:81.2.69.195/21 (host1\foobar) dst Internet:81.2.69.200/9234 (LOCAL\esurbey) (type 3, code 3)
-Original file line number
+Diff line change
@@ Expand Up / @@ -439,4 +439,4 @@ @@
                 ]
             }
         ]
-    }
+    }