Cisco ASA NSEL: firewall_event field and fw_ext_event fields support

ElastiFlow Community
1

Hi everyone,
I am currently testing ElastiFlow v7.26.2 in my environment and have encountered an issue with Cisco ASA NSEL (NetFlow Security Event Logging) event parsing.

Specifically, during my testing, I noticed that the standard firewall_event field is completely missing, while the fw_ext_event field is populated correctly. According to the Cisco NSEL specifications, both standard and extended event IDs should map to their respective human-readable meanings, but currently, only the extended ones are appearing.


 "sec.action.id": 2034,

 "sec.action.name": "TCP_FINS",

image
image1096×437 15.3 KB

2

Can you let me know what you’re wanting us to see in the screenshots you’ve provided? Based on https://www.cisco.com/c/en/us/td/docs/security/asa/special/netflow/asa_netflow.html, the event ID 2034 shown in the screenshots is being correctly mapped as NP_FLOW_TCP_FINS.

What event ID are you expecting to be mapped for the firewall_event field? Is there documentation that you’re able to provide that shows this mapping?

3

Yes, extended field (NSEL Extended Event ID ) mapped correctly, but NSEL Event ID completly missing. https://www.cisco.com/c/en/us/td/docs/security/asa/special/netflow/asa_netflow.html

Based on this documentation NSEL Event ID needs to be mapped something like: Created/Updated/Deleted

Something like:

sec.action.name: “Deleted”

sec.reason.name: “TCP_FINS”