Cisco Asa ASim Authentication parsing fix

[cgiamp]

Hello,

The event id 716038 of Cisco ASA has the following format:

%ASA-6-716038: Group User [email protected] IP <xxx.xxx.xxx.xxx> Authentication: successful, Session Type: WebVPN.

So I suggest to change the parsing of this line:

Azure-Sentinel/Parsers/ASimAuthentication/Parsers/ASimAuthenticationCiscoASA.yaml

Line 176 in 34b6334

| parse Message with * 'User ' TargetUsername ' IP ' SrcIpAddr ' Authentication'*

to:

| parse Message with * 'User <' TargetUsername '> IP <' SrcIpAddr '> Authentication'*

in order to trim the angle brackets from the relevant fields.

Regards,
Christos

[vakohl]

@cgiamp
The example you shared:

%ASA-6-716038: Group User [email protected] IP <xxx.xxx.xxx.xxx> Authentication: successful, Session Type: WebVPN.

and suggested following change:

| parse Message with * 'User <' TargetUsername '> IP <' SrcIpAddr '> Authentication'*

I see angle bracket only around IP Address and not around user. I think we just need to add angle bracket for IP Address. Can you confirm?

[cgiamp]

Hi @vakohl,

Based on the events that I am seeing on our ASA firewall both information (User and IP) are included into angle brackets.

Sorry but I cannot share the events here.

Regards,
Christos Giampoulakis | Threat Detection Engineer

[v-sudkharat]

ASIM - @vakohl