[jira] [Commented] (METRON-2105) Enhance BasicAsaParser to add patterns dynamically
[ https://issues.apache.org/jira/browse/METRON-2105?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16832476#comment-16832476 ] Otto Fowler commented on METRON-2105: - Can you clarify what ciscotag is? Have you tried just doing this with a grok parser? > Enhance BasicAsaParser to add patterns dynamically > -- > > Key: METRON-2105 > URL: https://issues.apache.org/jira/browse/METRON-2105 > Project: Metron > Issue Type: Improvement >Affects Versions: 0.7.0, 0.7.1 >Reporter: Pieter Baele >Priority: Critical > > The current implementation of the ASA parser uses a static patternMap. As a > result, the parser needs recompilation when patterns are added. > An enhancement would be dyamic reload capabilities based on a mapping file > using ciscotag and grok patterns loaded using hdfs. > This can be especially important regarding the number of patterns that can be > introduced by 3-th party commiters as the list of possible messages is quite > long [https://www.cisco.com/c/en/us/td/docs/security/asa/syslog/b_syslog.html] -- This message was sent by Atlassian JIRA (v7.6.3#76005)
[jira] [Commented] (METRON-2105) Enhance BasicAsaParser to add patterns dynamically
[
https://issues.apache.org/jira/browse/METRON-2105?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16832481#comment-16832481
]
Pieter Baele commented on METRON-2105:
--
{{ private static final Map patternMap = ImmutableMap. builder()
.put("ASA-2-106001", "CISCOFW106001")}}
and a bit further
{{ metronJson.put("ciscotag", syslogJson.get("CISCOTAG"));
}}
We will use Grok parser as a temporary workaround, but I expect to perform less
> Enhance BasicAsaParser to add patterns dynamically
> --
>
> Key: METRON-2105
> URL: https://issues.apache.org/jira/browse/METRON-2105
> Project: Metron
> Issue Type: Improvement
>Affects Versions: 0.7.0, 0.7.1
>Reporter: Pieter Baele
>Priority: Critical
>
> The current implementation of the ASA parser uses a static patternMap. As a
> result, the parser needs recompilation when patterns are added.
> An enhancement would be dyamic reload capabilities based on a mapping file
> using ciscotag and grok patterns loaded using hdfs.
> This can be especially important regarding the number of patterns that can be
> introduced by 3-th party commiters as the list of possible messages is quite
> long [https://www.cisco.com/c/en/us/td/docs/security/asa/syslog/b_syslog.html]
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
[jira] [Commented] (METRON-2105) Enhance BasicAsaParser to add patterns dynamically
[ https://issues.apache.org/jira/browse/METRON-2105?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16832508#comment-16832508 ] Simon Elliston Ball commented on METRON-2105: - I really like this idea. The grok parser is probably ok as a short term solution, maybe filtering out the messages the ASA parser doesn't cover right now. [~ottobackwards] The ciscotag field is used to determine which ASA grok pattern is necessary for the message, so is sort of a router to the right pattern. Given the variety of different message types on an ASA source, you can't just parse all of it with a single grok (or at least not with a sane pattern!), hence the tag. > Enhance BasicAsaParser to add patterns dynamically > -- > > Key: METRON-2105 > URL: https://issues.apache.org/jira/browse/METRON-2105 > Project: Metron > Issue Type: Improvement >Affects Versions: 0.7.0, 0.7.1 >Reporter: Pieter Baele >Priority: Critical > > The current implementation of the ASA parser uses a static patternMap. As a > result, the parser needs recompilation when patterns are added. > An enhancement would be dyamic reload capabilities based on a mapping file > using ciscotag and grok patterns loaded using hdfs. > This can be especially important regarding the number of patterns that can be > introduced by 3-th party commiters as the list of possible messages is quite > long [https://www.cisco.com/c/en/us/td/docs/security/asa/syslog/b_syslog.html] -- This message was sent by Atlassian JIRA (v7.6.3#76005)
