[jira] [Commented] (METRON-2105) Enhance BasicAsaParser to add patterns dynamically
[ https://issues.apache.org/jira/browse/METRON-2105?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16832476#comment-16832476 ] Otto Fowler commented on METRON-2105: - Can you clarify what ciscotag is? Have you tried just doing this with a grok parser? > Enhance BasicAsaParser to add patterns dynamically > -- > > Key: METRON-2105 > URL: https://issues.apache.org/jira/browse/METRON-2105 > Project: Metron > Issue Type: Improvement >Affects Versions: 0.7.0, 0.7.1 >Reporter: Pieter Baele >Priority: Critical > > The current implementation of the ASA parser uses a static patternMap. As a > result, the parser needs recompilation when patterns are added. > An enhancement would be dyamic reload capabilities based on a mapping file > using ciscotag and grok patterns loaded using hdfs. > This can be especially important regarding the number of patterns that can be > introduced by 3-th party commiters as the list of possible messages is quite > long [https://www.cisco.com/c/en/us/td/docs/security/asa/syslog/b_syslog.html] -- This message was sent by Atlassian JIRA (v7.6.3#76005)
[jira] [Commented] (METRON-2105) Enhance BasicAsaParser to add patterns dynamically
[ https://issues.apache.org/jira/browse/METRON-2105?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16832481#comment-16832481 ] Pieter Baele commented on METRON-2105: -- {{ private static final Map patternMap = ImmutableMap. builder() .put("ASA-2-106001", "CISCOFW106001")}} and a bit further {{ metronJson.put("ciscotag", syslogJson.get("CISCOTAG")); }} We will use Grok parser as a temporary workaround, but I expect to perform less > Enhance BasicAsaParser to add patterns dynamically > -- > > Key: METRON-2105 > URL: https://issues.apache.org/jira/browse/METRON-2105 > Project: Metron > Issue Type: Improvement >Affects Versions: 0.7.0, 0.7.1 >Reporter: Pieter Baele >Priority: Critical > > The current implementation of the ASA parser uses a static patternMap. As a > result, the parser needs recompilation when patterns are added. > An enhancement would be dyamic reload capabilities based on a mapping file > using ciscotag and grok patterns loaded using hdfs. > This can be especially important regarding the number of patterns that can be > introduced by 3-th party commiters as the list of possible messages is quite > long [https://www.cisco.com/c/en/us/td/docs/security/asa/syslog/b_syslog.html] -- This message was sent by Atlassian JIRA (v7.6.3#76005)
[jira] [Commented] (METRON-2105) Enhance BasicAsaParser to add patterns dynamically
[ https://issues.apache.org/jira/browse/METRON-2105?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16832508#comment-16832508 ] Simon Elliston Ball commented on METRON-2105: - I really like this idea. The grok parser is probably ok as a short term solution, maybe filtering out the messages the ASA parser doesn't cover right now. [~ottobackwards] The ciscotag field is used to determine which ASA grok pattern is necessary for the message, so is sort of a router to the right pattern. Given the variety of different message types on an ASA source, you can't just parse all of it with a single grok (or at least not with a sane pattern!), hence the tag. > Enhance BasicAsaParser to add patterns dynamically > -- > > Key: METRON-2105 > URL: https://issues.apache.org/jira/browse/METRON-2105 > Project: Metron > Issue Type: Improvement >Affects Versions: 0.7.0, 0.7.1 >Reporter: Pieter Baele >Priority: Critical > > The current implementation of the ASA parser uses a static patternMap. As a > result, the parser needs recompilation when patterns are added. > An enhancement would be dyamic reload capabilities based on a mapping file > using ciscotag and grok patterns loaded using hdfs. > This can be especially important regarding the number of patterns that can be > introduced by 3-th party commiters as the list of possible messages is quite > long [https://www.cisco.com/c/en/us/td/docs/security/asa/syslog/b_syslog.html] -- This message was sent by Atlassian JIRA (v7.6.3#76005)