Cisco PIX log regex

hattori.hanzo · 05-08-2013, 11:38 PM

I am trying to run a script called ciscofw2csv.pl from a GIAC paper (https://s54-www.giac.org/paper/gcia/...ecurity/109883). This script supposes to parse PIX logs to .csv for further processing.

Code:

#!/usr/bin/perl
########################################################################
# Title: CISCOFW2CSV
# File: ciscofw2csv.pl
# Version: 1.0
#
# Description: Takes specific cisco firewall (asa, fwsm, pix) messages (see below) and
# parses the events into comma separated values. Specific fields wanted in the output are
# provided at execution.
#
# %PIX|ASA-3-710003: {TCP|UDP} access denied by ACL from source_address/source_port to interface_name:dest_address/service
# %PIX|ASA-4-106023: Deny protocol src [interface_name:source_address/source_port] dst interface_name:dest_address/dest_port [type
#{string}, code {code}] by access_group #acl_ID
#
# Usage: cat /var/log/enterprise.log | ./ciscofw2csv.pl ["field list"]
#
# Possible fields:
# timestamp sip dip sport dport type level src_int dst_int access_group
# rest proto report_ip
########################################################################
#
#
use strict vars;
my $output=$ARGV[0];
our ($timestamp,$report_ip,$level,$type,$src_int,$sip,$sport,$dst_int,$dip,$dport,$access_group,$rest,$proto);

while (<STDIN>) {
        chomp;
        my $input = $_;
        if ($input =~ /106023/){
        ($timestamp, $report_ip, $type, $level, $proto, $src_int, $sip, $sport, $dst_int, $dip, $dport, $access_group,$rest) =
        $input =~ /^(.* \d{2}:\d{2}:\d{2}).*? (\d+\.\d+\.\d+\.\d+) \%(ASA|FWSM|PIX)\-(4)\-106023\: Deny (tcp|udp) src (\D+)\:(\d+\.\d+\.\d+\.\d+)\/(\d+) dst (\D+)\:(\d+\.\d+\.\d+\.\d+)\/(\d+) by access-group \"(\D+)\" (.*)/;
        }

        if ($input =~ /710003/){
        ($timestamp, $report_ip, $type, $level, $proto, $sip, $sport, $dst_int, $dip, $dport) =
        $input =~ /^(.* \d{2}:\d{2}:\d{2}).*? (\d+\.\d+\.\d+\.\d+) \%(ASA|FWSM|PIX)\-(3)\-710003\:(TCP|UDP) access denied by ACL from (\d+\.\d+\.\d+\.\d+)\/(\d+) to (\D+)\:(\d+\.\d+\.\d+\.\d+)\/(\d+)/;
        }

        $dport = $dport."-".$proto;
        my @tokens = split / /,$output;
        print ${shift(@tokens)};
        for my $token (@tokens) {
                print ','.$$token;
        }
        print "\n";
}

When I test the script I cannot get any meaningful output.

Code:

May  7 09:23:39 143.45.9.7 %PIX-4-106023: Deny icmp src outside:65.255.219.102 dst dmz1:34.160.128.101 (type 8, code 0) by access-group "inbound"
May  7 09:23:39 143.45.9.7 %PIX-4-106023: Deny tcp src inside:221.166.70.61/35848 dst outside:291.166.101.213/143 by access-group "inbound"
May  7 09:23:39 143.45.9.7 %PIX-4-106023: Deny tcp src inside:221.166.70.61/40669 dst outside:291.166.100.61/110 by access-group "outbound"

I got a feeling the regex maybe the problem (high lighted above in bold).

Could anyone confirm this?

Thanks.

chrism01 · 05-09-2013, 01:12 AM

There seemed to be 1 or 2 problems with the regexes, plus a few other Perlisms that needed tidying up.
Its not quite how I would do it, but this seems to work

Code:

#!/usr/bin/perl -w
########################################################################
# Title: CISCOFW2CSV
# File: ciscofw2csv.pl
# Version: 1.0
#
# Description: Takes specific cisco firewall (asa, fwsm, pix) messages (see below) and
# parses the events into comma separated values. Specific fields wanted in the output are
# provided at execution.
#
# %PIX|ASA-3-710003: {TCP|UDP} access denied by ACL from source_address/source_port to interface_name:dest_address/service
# %PIX|ASA-4-106023: Deny protocol src [interface_name:source_address/source_port] dst interface_name:dest_address/dest_port [type
#{string}, code {code}] by access_group #acl_ID
#
# Usage: cat /var/log/enterprise.log | ./ciscofw2csv.pl ["field list"]
#
# Possible fields:
# timestamp sip dip sport dport type level src_int dst_int access_group
# rest proto report_ip
########################################################################
#
#
use strict "vars";

my @tokens = @ARGV;
our ($timestamp,$report_ip,$level,$type,$src_int,$sip,$sport,$dst_int,$dip,$dport,$access_group,$rest,$proto);

        # Print hdr csv
        my $cflag = 0;
        for my $token (@tokens)
        {
            if( $cflag == 0 )
            {
                print $token;
                $cflag = 1;
            }
            else
            {
                print ','.$token;
            }
        }
        print "\n";

while (<STDIN>) 
{
        chomp;
        my $input = $_;
		next if( $input =~ /icmp/ );
        if ($input =~ /106023/ )
		{
			($timestamp, $report_ip, $type, $level, $proto, $src_int, $sip, $sport, $dst_int, $dip, $dport, $access_group,$rest) =

     $input =~ /^([A-Za-z]+\s+[0-9]{1,2} \d{2}:\d{2}:\d{2}) (\d+\.\d+\.\d+\.\d+) \%(ASA|FWSM|PIX)\-(4)\-106023\: Deny (tcp|udp) src (\D+)\:(\d+\.\d+\.\d+\.\d+)\/(\d+) dst (\D+)\:(\d+\.\d+\.\d+\.\d+)\/(\d+) by access-group \"(\D+)\"/ ;

        }

        if ($input =~ /710003/)
		{
			($timestamp, $report_ip, $type, $level, $proto, $sip, $sport, $dst_int, $dip, $dport) =
        $input =~ /^([A-Za-z]+\s+[0-9]{1,2} \d{2}:\d{2}:\d{2}).*? (\d+\.\d+\.\d+\.\d+) \%(ASA|FWSM|PIX)\-(3)\-710003\:(TCP|UDP) access denied by ACL from (\d+\.\d+\.\d+\.\d+)\/(\d+) to (\D+)\:(\d+\.\d+\.\d+\.\d+)\/(\d+)/;
        }

        $dport = $dport."-".$proto;

		# Print data csv	
        $cflag = 0;
        for my $token (@tokens) 
		{
            if( $cflag == 0 )
			{
				print $$token;
                $cflag = 1;
            }
            else
            {
               print ','.$$token;
			}
        }
        print "\n";
}

Obviously I don't have a 710003 type rec to test.
Note that the original code didn't output icmp pkts, so I've told it to skip those; I'm sure you can handle that if reqd

hattori.hanzo · 05-17-2013, 12:30 AM

G'Day,

Thank you very much for the response.

I will look into this further.

Cheers.