fix(cisco-asa): repair condition syntax, geolocation keys and rule consumers

plugins/alerts/testdata/cisco-asa/geolocation-data/asn-blocks-v4.csv

@@ -0,0 +1,3 @@
+network,autonomous_system_number,autonomous_system_organization
+198.51.100.0/24,64500,FABRICATED-AS-64500
+192.0.2.0/24,64501,FABRICATED-AS-64501

plugins/alerts/testdata/cisco-asa/geolocation-data/asn-blocks-v6.csv

@@ -0,0 +1,2 @@
+network,autonomous_system_number,autonomous_system_organization
+2001:db8::/32,64502,FABRICATED-AS-64502

plugins/alerts/testdata/cisco-asa/geolocation-data/blocks-v4.csv

@@ -0,0 +1,3 @@
+network,geoname_id,registered_country_geoname_id,represented_country_geoname_id,is_anonymous_proxy,is_satellite_provider,postal_code,latitude,longitude,accuracy_radius
+198.51.100.0/24,9900001,9900001,,0,0,,10.5,-20.25,100
+192.0.2.0/24,9900002,9900002,,0,0,,-30.125,40.75,50

plugins/alerts/testdata/cisco-asa/geolocation-data/blocks-v6.csv

@@ -0,0 +1,2 @@
+network,geoname_id,registered_country_geoname_id,represented_country_geoname_id,is_anonymous_proxy,is_satellite_provider,postal_code,latitude,longitude,accuracy_radius
+2001:db8::/32,9900003,9900003,,0,0,,1.5,2.5,1000

plugins/alerts/testdata/cisco-asa/geolocation-data/locations-en.csv

@@ -0,0 +1,4 @@
+geoname_id,locale_code,continent_code,continent_name,country_iso_code,country_name,subdivision_1_iso_code,subdivision_1_name,subdivision_2_iso_code,subdivision_2_name,city_name,metro_code,time_zone,is_in_european_union
+9900001,en,XX,Fabricated,XA,Fabricated Country A,,,,,Fabricated City A,,Etc/UTC,0
+9900002,en,XX,Fabricated,XB,Fabricated Country B,,,,,Fabricated City B,,Etc/UTC,0
+9900003,en,XX,Fabricated,XC,Fabricated Country C,,,,,Fabricated City C,,Etc/UTC,0

plugins/alerts/testdata/cisco-asa/patterns.yaml

@@ -0,0 +1,16 @@
+# The shared grok definitions this filter uses, copied from
+# backend/src/main/resources/config/liquibase/changelog/20250616001_insert_utm_regex_pattern.xml.
+patterns:
+  data: '(.*?)'
+  day: '(?:Mon(?:day)?|Tue(?:sday)?|Wed(?:nesday)?|Thu(?:rsday)?|Fri(?:day)?|Sat(?:urday)?|Sun(?:day)?)'
+  greedy: '.*'
+  hostname: '(\b(?:[0-9A-Za-z][0-9A-Za-z-]{0,62})(?:\.(?:[0-9A-Za-z][0-9A-Za-z-]{0,62}))*(\.?|\b))'
+  integer: '(?:[+-]?(?:[0-9]+))'
+  ipv4: '(((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(\.)){3}((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)))'
+  ipv6: '([0-9a-fA-F]{1,4}(:[0-9a-fA-F]{0,4}){1,7}|::[0-1]?)'
+  monthDay: '(?:(?:0[1-9])|(?:[12][0-9])|(?:3[01])|[1-9])'
+  monthName: '\b(?:[Jj]an(?:uary|uar)?|[Ff]eb(?:ruary|ruar)?|[Mm](?:a|ä)?r(?:ch|z)?|[Aa]pr(?:il)?|[Mm]a(?:y|i)?|[Jj]un(?:e|i)?|[Jj]ul(?:y|i)?|[Aa]ug(?:ust)?|[Ss]ep(?:tember)?|[Oo](?:c|k)?t(?:ober)?|[Nn]ov(?:ember)?|[Dd]e(?:c|z)(?:ember)?)\b'
+  space: '\s+'
+  time: '((([01][0-9])|2[0-4]):(?:[0-5][0-9])(?::(?:(?:[0-5]?[0-9]|60)(?:[:.,][0-9]+)?)))'
+  word: '\b\w+\b'
+  year: '(([1-9])[0-9]{1,3})'

plugins/alerts/testdata/cisco-asa/raw.json

@@ -0,0 +1,51 @@
+{
+  "provenance": "FABRICATED. Cisco's syslog documentation could not be read (the site refused automated access) and no Cisco ASA record was available, so every line follows the patterns in filters/cisco/asa.yml and none is claimed to be a documented Cisco format. Addresses are RFC 5737 and RFC 3849 documentation addresses; device and user names are examples.",
+  "cases": {
+    "header-bsd": "<166>Sep 23 2026 10:00:00 asa01.example.com : %ASA-6-302013: Built inbound TCP connection 1 for outside:198.51.100.7/51234 (198.51.100.7/51234) to inside:192.0.2.10/443 (203.0.113.5/443)",
+    "header-no-priority": "Sep 23 2026 10:00:00 asa01.example.com : %ASA-6-302013: Built inbound TCP connection 1 for outside:198.51.100.7/51234 (198.51.100.7/51234) to inside:192.0.2.10/443 (203.0.113.5/443)",
+    "header-device-ipv4": "<166>Sep 23 2026 10:00:00 192.0.2.1 : %ASA-6-302013: Built inbound TCP connection 1 for outside:198.51.100.7/51234 (198.51.100.7/51234) to inside:192.0.2.10/443 (203.0.113.5/443)",
+    "header-device-ipv6": "<166>Sep 23 2026 10:00:00 2001:db8::1 : %ASA-6-302013: Built inbound TCP connection 1 for outside:198.51.100.7/51234 (198.51.100.7/51234) to inside:192.0.2.10/443 (203.0.113.5/443)",
+    "unparsed-no-timestamp": "<166>%ASA-6-302013: Built inbound TCP connection 1 for outside:198.51.100.7/51234 (198.51.100.7/51234) to inside:192.0.2.10/443 (203.0.113.5/443)",
+    "unparsed-rfc5424": "<166>1 2026-09-23T10:00:00Z asa01.example.com - - - - %ASA-6-302013: Built inbound TCP connection 1 for outside:198.51.100.7/51234 (198.51.100.7/51234) to inside:192.0.2.10/443 (203.0.113.5/443)",
+    "unparsed-ftd-prefix": "<166>Sep 23 2026 10:00:00 ftd01.example.com : %FTD-6-302013: Built inbound TCP connection 1 for outside:198.51.100.7/51234 (198.51.100.7/51234) to inside:192.0.2.10/443 (203.0.113.5/443)",
+    "unparsed-no-device-id": "<166>Sep 23 2026 10:00:00: %ASA-6-302013: Built inbound TCP connection 1 for outside:198.51.100.7/51234 (198.51.100.7/51234) to inside:192.0.2.10/443 (203.0.113.5/443)",
+    "unparsed-linux-sshd": "<13>Sep 23 10:00:00 host01.example.com sshd[123]: Accepted password for alice from 198.51.100.7 port 22 ssh2",
+    "geo-302020-global": "<166>Sep 23 2026 10:00:00 asa01.example.com : %ASA-6-302020: Built inbound ICMP connection for faddr 198.51.100.7/0 gaddr 203.0.113.5/0 laddr 192.0.2.10/0 type 8 code 0",
+    "geo-113042-remote": "<166>Sep 23 2026 10:00:00 asa01.example.com : %ASA-4-113042: CoA: Non-HTTP connection from inside:192.0.2.10/51234 to outside:203.0.113.80/25 for user alice at 198.51.100.7 denied due to URL filtering",
+    "302013-outbound": "<166>Sep 23 2026 10:00:00 asa01.example.com : %ASA-6-302013: Built outbound TCP connection 7 for outside:198.51.100.7/443 (198.51.100.7/443) to inside:192.0.2.10/51234 (203.0.113.5/51234)",
+    "302013-probe": "<166>Sep 23 2026 10:00:00 asa01.example.com : %ASA-6-302013: Built inbound Probe TCP connection 8 for outside:198.51.100.7/51234 (198.51.100.7/51234) to inside:192.0.2.10/443 (203.0.113.5/443)",
+    "302015-outbound": "<166>Sep 23 2026 10:00:00 asa01.example.com : %ASA-6-302015: Built outbound UDP connection 11 for outside:198.51.100.53/53 (198.51.100.53/53) to inside:192.0.2.10/51000 (203.0.113.5/51000)",
+    "302304-teardown": "<166>Sep 23 2026 10:00:00 asa01.example.com : %ASA-6-302304: Teardown TCP state-bypass connection 5 from outside:198.51.100.7/443 to inside:192.0.2.10/51234 00:00:05, 1024, TCP FINs",
+    "302303-built": "<166>Sep 23 2026 10:00:00 asa01.example.com : %ASA-6-302303: Built TCP state-bypass connection 4 from outside:198.51.100.7/443 (198.51.100.7/443) to inside:192.0.2.10/51234 (192.0.2.10/51234)",
+    "305011-built": "<166>Sep 23 2026 10:00:00 asa01.example.com : %ASA-6-305011: Built dynamic TCP translation from inside:192.0.2.10/51234 to outside:203.0.113.5/40001",
+    "305012-teardown": "<166>Sep 23 2026 10:00:00 asa01.example.com : %ASA-6-305012: Teardown dynamic TCP translation from inside:192.0.2.10/51234 to outside:203.0.113.5/40001 duration 00:00:30",
+    "305012-one-digit-hour": "<166>Sep 23 2026 10:00:00 asa01.example.com : %ASA-6-305012: Teardown dynamic TCP translation from inside:192.0.2.10/51234 to outside:203.0.113.5/40001 duration 0:00:30",
+    "302017-gre": "<166>Sep 23 2026 10:00:00 asa01.example.com : %ASA-6-302017: Built inbound GRE connection 12 from outside:198.51.100.7 (198.51.100.7) (carol) to inside:192.0.2.10/0 (203.0.113.5/0) (dave) (erin)",
+    "302018-gre": "<166>Sep 23 2026 10:00:00 asa01.example.com : %ASA-6-302018: Teardown GRE connection 12 from outside:198.51.100.7 (198.51.100.7) (carol) to inside:192.0.2.10/0 (203.0.113.5/0) (dave) duration 00:01:02 bytes 2048 (erin)",
+    "106102-permitted": "<166>Sep 23 2026 10:00:00 asa01.example.com : %ASA-6-106102: access-list outside_in permitted tcp for user alice outside/198.51.100.7 51234 inside/192.0.2.10 443 hit-cnt 1 first hit [0x1a2b, 0x0]",
+    "106102-permitted-arrow": "<166>Sep 23 2026 10:00:00 asa01.example.com : %ASA-6-106102: access-list outside_in permitted tcp for user alice outside/198.51.100.7(51234) -> inside/192.0.2.10(443) hit-cnt 1 first hit [0x1a2b, 0x0]",
+    "106103-permitted": "<166>Sep 23 2026 10:00:00 asa01.example.com : %ASA-5-106103: access-list outside_in permitted udp for user alice outside/198.51.100.7 51234 inside/192.0.2.10 53 hit-cnt 1 first hit [0x1a2b, 0x0]",
+    "106102-denied": "<166>Sep 23 2026 10:00:00 asa01.example.com : %ASA-6-106102: access-list outside_in denied tcp for user alice outside/198.51.100.7 51234 inside/192.0.2.10 443 hit-cnt 1 first hit [0x1a2b, 0x0]",
+    "106102-denied-arrow": "<166>Sep 23 2026 10:00:00 asa01.example.com : %ASA-6-106102: access-list outside_in denied tcp for user alice outside/198.51.100.7(51234) -> inside/192.0.2.10(443) hit-cnt 1 first hit [0x1a2b, 0x0]",
+    "113009-with-equals": "<166>Sep 23 2026 10:00:00 asa01.example.com : %ASA-6-113009: AAA retrieved default group policy (DfltGrpPolicy) for user = alice",
+    "113011-with-equals": "<166>Sep 23 2026 10:00:00 asa01.example.com : %ASA-6-113011: AAA retrieved user specific group policy (GP1) for user = alice",
+    "113009-without-equals": "<166>Sep 23 2026 10:00:00 asa01.example.com : %ASA-6-113009: AAA retrieved default group policy (DfltGrpPolicy) for user alice",
+    "botnet-338001": "<166>Sep 23 2026 10:00:00 asa01.example.com : %ASA-4-338001: Dynamic filter monitored blacklisted TCP traffic from outside:198.51.100.7/51234 (198.51.100.7/51234) to inside:192.0.2.10/443 (192.0.2.10/443), source malicious address resolved from local or dynamic list: bad.example.invalid, threat-level: very-high, category: botnet",
+    "botnet-338002": "<166>Sep 23 2026 10:00:00 asa01.example.com : %ASA-4-338002: Dynamic filter monitored blacklisted TCP traffic from inside:192.0.2.10/51234 (192.0.2.10/51234) to outside:198.51.100.7/443 (198.51.100.7/443), destination malicious address resolved from local or dynamic list: bad.example.invalid, threat-level: very-high, category: botnet",
+    "ips-108003-1": "<166>Sep 23 2026 10:00:00 asa01.example.com : %ASA-2-108003: Terminating ESMTP/SMTP connection; malicious pattern detected in the mail address from outside:198.51.100.7/25 to inside:192.0.2.10/51231. Data:bad-pattern",
+    "ips-108003-2": "<166>Sep 23 2026 10:00:00 asa01.example.com : %ASA-2-108003: Terminating ESMTP/SMTP connection; malicious pattern detected in the mail address from outside:198.51.100.7/25 to inside:192.0.2.10/51232. Data:bad-pattern",
+    "ips-108003-3": "<166>Sep 23 2026 10:00:00 asa01.example.com : %ASA-2-108003: Terminating ESMTP/SMTP connection; malicious pattern detected in the mail address from outside:198.51.100.7/25 to inside:192.0.2.10/51233. Data:bad-pattern",
+    "ips-108003-4": "<166>Sep 23 2026 10:00:00 asa01.example.com : %ASA-2-108003: Terminating ESMTP/SMTP connection; malicious pattern detected in the mail address from outside:198.51.100.7/25 to inside:192.0.2.10/51234. Data:bad-pattern",
+    "ips-108003-5": "<166>Sep 23 2026 10:00:00 asa01.example.com : %ASA-2-108003: Terminating ESMTP/SMTP connection; malicious pattern detected in the mail address from outside:198.51.100.7/25 to inside:192.0.2.10/51235. Data:bad-pattern",
+    "ips-108003-6": "<166>Sep 23 2026 10:00:00 asa01.example.com : %ASA-2-108003: Terminating ESMTP/SMTP connection; malicious pattern detected in the mail address from outside:198.51.100.7/25 to inside:192.0.2.10/51236. Data:bad-pattern",
+    "vpn-113015-alice": "<166>Sep 23 2026 10:00:00 asa01.example.com : %ASA-6-113015: AAA user authentication Rejected : reason = Invalid password : local database : user = alice : user IP = 198.51.100.7",
+    "vpn-113015-bob": "<166>Sep 23 2026 10:00:00 asa01.example.com : %ASA-6-113015: AAA user authentication Rejected : reason = Invalid password : local database : user = bob : user IP = 198.51.100.8",
+    "vpn-109034-text": "<166>Sep 23 2026 10:00:00 asa01.example.com : %ASA-3-109034: Authentication failed for network user alice from 198.51.100.7/51234 to 192.0.2.10/443",
+    "vpn-611102-text": "<166>Sep 23 2026 10:00:00 asa01.example.com : %ASA-6-611102: User authentication failed: IP address: 198.51.100.7, Uname: alice",
+    "302003-ip": "<166>Sep 23 2026 10:00:00 asa01.example.com : %ASA-6-302003: Built H245 connection for 198.51.100.7 198.51.100.7/1720 192.0.2.10 192.0.2.10/5678",
+    "302003-hostname": "<166>Sep 23 2026 10:00:00 asa01.example.com : %ASA-6-302003: Built H245 connection for 198.51.100.7 198.51.100.7/1720 host-b.example.com host-b.example.com/5678",
+    "302004-to": "<166>Sep 23 2026 10:00:00 asa01.example.com : %ASA-6-302004: Pre-allocate H323 UDP backconnection for 198.51.100.7 198.51.100.7/1720 to 192.0.2.10 192.0.2.10/5678",
+    "302022-mapped-port": "<166>Sep 23 2026 10:00:00 asa01.example.com : %ASA-6-302022: Built backup stub TCP connection for outside:198.51.100.7/443 (198.51.100.7/443) to inside:192.0.2.10/51234 (203.0.113.5/51234)",
+    "302024-mapped-no-port": "<166>Sep 23 2026 10:00:00 asa01.example.com : %ASA-6-302024: Built backup stub UDP connection for outside:198.51.100.7/53 (198.51.100.7) to inside:192.0.2.10/40000 (203.0.113.5)"
+  }
+}