Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Added additional Cisco-fw rules to log admin commands #288

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Added additional Cisco-fw rules to log admin commands #288

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions patterns/firewalls
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,12 @@ CISCOFW106100 access-list %{NOTSPACE:policy_id} %{CISCO_ACTION:action} %{WORD:pr
CISCOFW304001 %{IP:src_ip}(\(%{DATA:src_fwuser}\))? Accessed URL %{IP:dst_ip}:%{GREEDYDATA:dst_url}
# ASA-6-110002
CISCOFW110002 %{CISCO_REASON:reason} for %{WORD:protocol} from %{DATA:src_interface}:%{IP:src_ip}/%{INT:src_port} to %{IP:dst_ip}/%{INT:dst_port}
# ASA-5-111008
CISCOFW111008 User '%{DATA:user}' executed the '%{GREEDYDATA:cmd}' command\.
# ASA-7-111009
CISCOFW111009 User '%{DATA:user}' executed cmd: %{GREEDYDATA:cmd}
# ASA-5-111010
CISCOFW111010 User '%{DATA:user}', running '%{WORD:application_name}' from IP %{IPORHOST:src_ip}, executed '%{GREEDYDATA:cmd}'
# ASA-6-302010
CISCOFW302010 %{INT:connection_count} in use, %{INT:connection_count_max} most used
# ASA-6-302013, ASA-6-302014, ASA-6-302015, ASA-6-302016
Expand Down