fix(cisco-asa): repair condition syntax, geolocation keys and rule consumers

[kryonsx]

Summary

The Cisco ASA filter and its three rules have defects that the filter's own patterns, the event engine and go-sdk establish on their own. This draft fixes those and defers everything that depends on Cisco's message wording.

Predecessor: #2598 (closed, historical context only).

Evidence basis

• No Cisco ASA records were found on any reachable UTMStack v11 instance: 29 instances searched, 2 not reachable. The deployed filter and rules match this repository.
• Cisco's syslog guide on www.cisco.com refused automated access (HTTP 403).
• Every change below is therefore established by the filter itself, the EventProcessor source (commit 497bf53; the latest 8a3ade7 differs only in SDK versions and the CEL plugin's OpenSearch settings) and go-sdk v1.1.26/v1.1.33 behavior (unchanged for these points in v1.1.36), and validated with fabricated raw lines. Nothing here claims real-device validation.

Filter (filters/cisco/asa.yml, 3.0.3 → 3.1.1)

• Conditions: 519 conditions such as log.messageId==106001 become equals("log.messageId", 106001), with ranges using greaterOrEqual/lessOrEqual and log.severity=="4" using equals.
  • go-sdk declares CEL variables only for top-level keys that already exist. When neither header grok matches, each raw condition fails to compile ("undeclared reference to 'log'"). The step is then skipped and an error is added: 519 errors, about 145 KB per event.
  • The same failure pattern appears on live records of another Cisco filter that uses this style.
  • Truth tables are identical on parsed events (1,987 comparisons).
• Geolocation: the 16 geolocation steps now write to log.<field>Geolocation instead of log.<field>.geolocation. Writing under the address turned a string field into an object and lost the address. In a local OpenSearch test, one of the two documents was then rejected.
• 106102/106103: "permitted" hits were stored as denied because two add steps ran in the wrong order.
• Five parsing fixes:
  • 302013 direction is now set;
  • 302304 protocol grok matches Teardown;
  • 305011/305012 no longer cut action;
  • 302017 sets log.firewallUserTo and trims target.user;
  • the 113009/113011 second variant no longer overwrites the user with = name.
• Three steps that could never write on the engine (3.1.1). The EventProcessor grok plugin counts an empty match as no match, and then the whole step writes nothing.
  • 302003/302004: the optional to was its own pattern, (to\s)?, which matched empty text on every 302003 line. A 302003 line whose local side is a host name was parsed by no step. The to is now read with the address and trimmed off.
  • 302022/302024/302026: the two steps for a mapped address without a port used {{.data}}, which on its own always matches empty text, so they never wrote. They now read [^/()]+, which only fits when no port follows.

Rules

• ips_signature_matches.yml: the condition now requires origin.ip before its history lookup. Message 108003 is not parsed, so the lookup failed and the rule engine disabled the rule after five errors. A branch reading log.action, which nothing writes, is removed.
• multiple_failed_vpn_attempts.yml: reads log.msg, which the filter writes, instead of log.message.
• botnet_traffic_detection.yml is unchanged; see the deferred items below.

Validation

Re-checked on 2026-09-24 on the latest versions: official v11 d2479c1a (merged into this branch, no conflicts; plugins/alerts now pins go-sdk v1.1.36) and EventProcessor main 8a3ade7 (playground and every plugin on go-sdk v1.1.36; the geolocation plugin is built from v11, which pins v1.1.34).

• SDK change: go-sdk v1.1.35+ keeps underscores in field names the parser plugins write, and v1.1.36 makes regexMatch match strings only. Neither changes this draft: none of the 129 names the filter writes contains an underscore, and every regexMatch/contains call reads a text field. No file needed a change.
• Isolated EventProcessor playground (latest), 80 fabricated lines:
  • Unchanged filter: 6,228 errors (12 lines with 519 each).
  • Changed filter: 0 errors. All 84 assertions pass, with no unintended differences. Every line's stored fields equal the results recorded on the older build.
  • Rule run: 2 botnet alerts, 0 IPS alerts, 0 circuit-breaker alerts and 0 compile errors (24/24 checks). With the original filter and rules, the IPS rule still fails 6 history lookups and trips the circuit breaker.
  • Committed plugins/alerts/testdata/cisco-asa/replay.py: 46 events (41 plus the five below), 0 errors, every field as in expected.json, 2 botnet alerts, no circuit breaker, no history search.
• Empty-match correction (3.1.1), on engine 8a3ade7: five new fabricated lines show both defects with version 3.1.0 (the 302003 host-name line kept only its result; the 302024 line had no mapped address) and the fix with 3.1.1; the other three lines are identical. The 80 private fabricated lines give identical events with both versions. go-sdk v1.1.36 rule replay over the 46 committed events: 13/13 checks; the earlier predicate checks, repeated with the new events: 90/90 and 65/65.
• go-sdk v1.1.36 predicate replay: 90/90 and 65/65. History queries (threshold, window, placeholders) passed 36/36 against a local OpenSearch with go-sdk v1.1.33 earlier; those blocks are unchanged, and the SDK's history code (plugins/rules.go) is identical in v1.1.36.
• Go tests: the full plugins/alerts suite passes on go-sdk v1.1.36: 51 pass, 11 skip (other technologies' private-evidence tests, same as the base), 0 fail. The eight new Cisco ASA tests all fail against the original files. The newest one tries every grok pattern alone on texts that start with each printable character and fails when one matches empty text at the start; it and the model test (now with the five new lines) also fail on version 3.1.0.

Deferred

These need Cisco's documentation or real device records.

• Put the 113015/113017 user IP on origin.ip. This would make the failed-VPN rule work.
• Parse 108003, 338001, 338002, 113021, 109034 and 611102, and decide which address is malicious in the botnet messages.
• Header variants: no timestamp, no device-id, RFC 5424.
• Origin/target direction per message, byte counters and device time.
• Outcome values, owned by a separate outcome review.

The audit file lists each deferred item with the evidence that would unblock it.

Limits

• Fixtures are fabricated.
• The playground (EventProcessor 8a3ade7) and this module both use go-sdk v1.1.36; neither is claimed to match a customer deployment.
• The index-rejection result comes from a local OpenSearch 2.13.0 test.
• Production indexing, grouping, deduplication and notifications were not tested.

See filters/audits/cisco-asa.md.

🤖 Generated with Claude Code