Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Issue with parser for CISCO ISE in Sentinel #9746

Closed
v-nguyentruong opened this issue Jan 9, 2024 · 63 comments
Closed

Issue with parser for CISCO ISE in Sentinel #9746

v-nguyentruong opened this issue Jan 9, 2024 · 63 comments
Assignees
@v-sudkharat @v-muuppugund
Labels
Parser Parser specialty review needed

Comments

@v-nguyentruong
Copy link

Describe the bug
Parsing issue with Cisco ISE data source
Using the parser from the Cisco Identity Service Engine data connector page in Sentinel provide and still got wrong information in the logs.
I found out that the parser will apply for these logs:
Syslog
| where ProcessName has_any ("CSCO", "CISE")
There are many logs with different structures of SyslogMessage which causes the parser to not be able to function properly.
When applied this line in parser for the above results, there will be an eventid with a date (Ex 1: 2024-01-05) and an eventid with a string (Ex 2: NetworkDeviceGroups...).
| parse SyslogMessage with * " " * " " * " " EventId " " EventSeverity " " EventCategory " " RestOfMessage

To Reproduce
Steps to reproduce the behavior:

  1. Go to Sentinel portal > Data Connectors > Cisco Identity Service Engine
  2. Click on "Follow these steps"
  3. Copy the function code then paste into Logs then Save as function.
  4. See wrong information in CiscoISEEvent table.

Expected behavior
Correct data from Syslog parse into the correct field in CiscoISEEvent table.

Screenshots
@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Jan 9, 2024

Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.

@v-sudkharat v-sudkharat added the Parser Parser specialty review needed label Jan 10, 2024
@v-sudkharat
Copy link
Contributor

Hi @v-nguyentruong, Thanks for flagging this issue, we will investigate this issue and get back to you with some updates by 15-01-2024. Thanks!

@v-sudkharat
Copy link
Contributor

v-sudkharat commented Jan 12, 2024 •
edited
Loading

Hi @v-nguyentruong, Could you please check with below shared parser file.
CiscoISEParser_Updated3.txt

Sharing the steps to configure it -

  1. Go to Log Analytics workspace and select your workspace.
  2. Click on Logs.
    In the Schema and Filter Pane, select Functions tab and enter Parser name (e.g. CiscoISEEvent) in the search box, function list would be filtered.
  3. Hover over the function name and click on Load the function code link in the flyout.
  4. This would load the definition of the parser in the new query window. Copy and paste the content of the function in a notepad and save it.

Please let us know if it works or you need any assistance on it.
Thanks!

@v-sudkharat
Copy link
Contributor

Hi @v-nguyentruong, we are waiting for your response on above comment. Thanks!

@v-nguyentruong
Copy link
Author

v-nguyentruong commented Jan 16, 2024 via email

@v-sudkharat
Copy link
Contributor

Hi @v-nguyentruong, Please let us know once you get update from customer on this. Thanks!

@v-sudkharat
Copy link
Contributor

Hi @v-nguyentruong, Any update from customer on this? Thanks!

@v-nguyentruong
Copy link
Author

Hi @v-sudkharat. Customer is still monitoring for few more days after trying the parser before letting me know the status.

@v-sudkharat
Copy link
Contributor

Hi @v-nguyentruong, thanks for sharing update with us, please let us know, once you get more update from customer on this.
Thanks!

@v-nguyentruong
Copy link
Author

v-nguyentruong commented Jan 25, 2024 via email •
edited
Loading

@v-sudkharat
Copy link
Contributor

Hi @v-nguyentruong, your shared screenshot is not visible for me, could you please reshare it. Thanks!

@v-nguyentruong
Copy link
Author

v-nguyentruong commented Jan 29, 2024 via email

@v-sudkharat
Copy link
Contributor

Hi @v-nguyentruong, still not visible, Could you please sent it on below mail id - v-sudkharat@microsoft.com
image

Thanks!

@v-nguyentruong
Copy link
Author

v-nguyentruong commented Jan 31, 2024 via email

@v-sudkharat
Copy link
Contributor

Hi @v-nguyentruoy - ng, yes, it's visible now. We will check on it and get back to you by 07-01-2024. Thanks!

@v-sudkharat
Copy link
Contributor

v-sudkharat commented Feb 1, 2024 •
edited
Loading

Hi @v-nguyentruong, could you please ask customer to expand the one of the raw and check for the TimeGenerated Column.
image

And still it is not visible, could you please below with below updated parser file -
CiscoISEParser_Updated1.txt

Please let us know if issue is still persists.
Thanks!

@v-nguyentruong
Copy link
Author

v-nguyentruong commented Feb 1, 2024 via email

@v-sudkharat
Copy link
Contributor

Hi @v-nguyentruong, have you checked with updated parser? - https://github.com/Azure/Azure-Sentinel/files/14122744/CiscoISEParser_Updated1.txt

@v-nguyentruong
Copy link
Author

Thanks for the update parser file. I just checked and seem like it will work. Let's me check this with customers. I will response if I have any update from them.

@v-sudkharat
Copy link
Contributor

@v-nguyentruong, Sure. Please share update with us once it done. Thanks!

@v-nguyentruong
Copy link
Author

Hi @v-sudkharat . Just got response from customer and the field TimeGenerated still not appear.

@v-sudkharat
Copy link
Contributor

@v-nguyentruong, thanks for update. We will check on this and get back to you by - 08-02-2024. Thanks!

@v-sudkharat
Copy link
Contributor

Hi @v-nguyentruong, We have updated the parser and tested in our workspace with available data. Could you please check it in customer environment and let us know still TimeGenerated column is not visible. Thanks!
Updated Paser File - CiscoParser.txt

image

@v-nguyentruong
Copy link
Author

Thanks for the update parser file. Let's me check this with customers. I will response if I have any update from them.

@v-sudkharat
Copy link
Contributor

@v-nguyentruong, please let us know once it gets completed. Thanks!

@v-sudkharat
Copy link
Contributor

Hi @v-nguyentruong, Any update from customer. Thanks!

@sandeep5234
Copy link

@v-sudkharat I have just tried and below is the result
image
seems same issue to me

@v-nguyentruong
Copy link
Author

Hi @v-sudkharat. I'm still waiting for cx response.

@v-sudkharat
Copy link
Contributor

@v-nguyentruong, Ok. Thanks!

@v-nguyentruong
Copy link
Author

Hi @v-sudkharat . Cx just response and said that the AcsSessionID still have ComputerName in it also there isn't any Computers column.

@v-sudkharat
Copy link
Contributor

Hi @v-nguyentruong, Could you please request cx to share the sample data with us, so we can modify the query accordingly. Thanks!

@v-nguyentruong
Copy link
Author

Hi @v-sudkharat . Sure, I'll let you know if I got the sample data from cx.

@sandeep5234
Copy link

Hi @v-sudkharat can I share the sample data with you? So you can provide the query . Please let me know.

@v-sudkharat
Copy link
Contributor

Hi @sandeep5234, we have received the data from customer. thank you for your response.

@v-sudkharat
Copy link
Contributor

Hi @v-nguyentruong, We have make those modification as per customer requirement in Parser and added the new column as Computers.
Sharing the screenshot for reference -
image

Could you please share the latest updated parser with the customer and let us know the feedback with us.
Updated Parser File - Cisco.txt

Thanks!

@v-nguyentruong
Copy link
Author

Hi @v-sudkharat . Thanks for the update parser, I'll let you know if I get update from cx.

@v-sudkharat
Copy link
Contributor

@v-nguyentruong, Ok

@v-nguyentruong
Copy link
Author

v-nguyentruong commented Feb 27, 2024 via email

@sandeep5234
Copy link

@v-sudkharat I have just tested the new updated parser and results are below
image

seems same issue for me.

@v-nguyentruong
Copy link
Author

v-nguyentruong commented Feb 27, 2024 via email

@v-sudkharat
Copy link
Contributor

@v-nguyentruong, checking on Parser.
Hey @sandeep5234, Could you please more explain your issue or if it is different, could you please raise a new issue so our team can check on that. Thanks!

@sandeep5234
Copy link

@v-sudkharat We have Cisco ISE network device from where we collect logs in Syslog format, the Cisco ISE parser available as part of the Cisco ISE package in Azure sentinel repository doesn't parse the data to correct columns. This is my issue in short.

@v-sudkharat
Copy link
Contributor

Hi @v-nguyentruong, We have updated the parser, and it successfully showing the expected result in cx shared CISCO ISE sample data. Please check with cx - Cisco.txt
If he still having the issue, then we required the cx syslog data to check on it.

Thanks!

@v-sudkharat
Copy link
Contributor

Hii @sandeep5234, Could you please raise a new GitHub issue and shared details over there with adding the sample data. So our team check on your case and update you. Thanks!

@sandeep5234 sandeep5234 mentioned this issue Mar 1, 2024
Closed
@sandeep5234
Copy link

sandeep5234 commented Mar 1, 2024 •
edited
Loading

@v-sudkharat I have created a new issue

This is the one.
#10070

@v-sudkharat
Copy link
Contributor

Hi @v-nguyentruong, Waiting for your response on above comment. Thanks!

@v-nguyentruong
Copy link
Author

Hi @v-sudkharat . Cx deployed the new parser, and it was working fine. However, they want to monitor the parser for few more days to check if new issue arises. I'll let you know if there is new update from them.

@v-sudkharat
Copy link
Contributor

@v-nguyentruong, Sure. Please confirm once it done. Thanks!

@v-sudkharat
Copy link
Contributor

Hi @v-nguyentruong, Any update from cx? Thanks!

@v-nguyentruong
Copy link
Author

Hi @v-sudkharat . The parser working fine now. Thanks for your help.

@v-nguyentruong
Copy link
Author

Hi @v-sudkharat . The parser working fine now. Thanks for your help.

@v-sudkharat
Copy link
Contributor

@v-nguyentruong, Always welcome.

@v-sudkharat v-sudkharat mentioned this issue Nov 19, 2024
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@v-sudkharat v-sudkharat

@v-muuppugund v-muuppugund

Labels
Parser Parser specialty review needed
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@sandeep5234 @v-sudkharat @v-muuppugund @v-nguyentruong