Cisco ASA parsing issues for event.duration, group.name and event.reason

[adriansr]

For confirmed bugs, please report:

• Version: 7.10
• Operating System: -
• Discuss Forum URL: -
• Steps to Reproduce:

There are a few issues with Cisco ASA (and possibly FTD) parsing:

• Pipeline expects session duration formatted as nn:nn:nn (hh:mm:ss). However, some messages (at least 113019) are observed to include time units: 3h:55m:49s. This leads to a bad event.duration (and event.start) calculation.

• Some messages include group information which is currently discarded (113019, 722051, 713049, 716002, 722037). Possibly others. This should be mapped into one of the allowed ECS group objects.

• Messages (113019, ...) include a reason which is extracted as field message, which is wrong and later dropped by the pipeline. The correct field to use in this case is event.reason.

• This same message also includes a "session type" field. It needs investigation to see if this field can be mapped to ECS or alternatively to a custom field under cisco.asa.

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)