default.yml

---
description: Pipeline for Cisco ISE logs.
processors:
  - set:
      field: ecs.version
      value: '8.17.0'
  - rename:
      field: message
      target_field: event.original
      ignore_missing: true
      if: ctx.event?.original == null
  - grok:
      field: event.original
      tag: grok_time_details
      patterns:
        - '^(?:<%{NUMBER:log.syslog.priority:long}>)?%{SYSLOGTIMESTAMP:_tmp.timestamp} %{ISO8601_TIMEZONE:_tmp.timezone} %{DATA:host.hostname} %{DATA:cisco_ise.log.category.name} %{GREEDYDATA:_tmp.message}$'
        - '^(?:<%{NUMBER:log.syslog.priority:long}>)?%{SYSLOGTIMESTAMP:_tmp.timestamp} %{DATA:host.hostname} %{DATA:cisco_ise.log.category.name} %{GREEDYDATA:_tmp.message}$'
        - '^%{TIMEONLYSTAMP_ISO8601:_tmp.timestamp}%{ISO8601_TIMEZONE:_tmp.timezone} %{DATA:host.hostname} %{DATA:cisco_ise.log.category.name} %{GREEDYDATA:_tmp.message}$'
        - '^%{DATA:cisco_ise.log.category.name} %{DATA:cisco_ise.log.message.id} %{NONNEGINT:cisco_ise.log.segment.total:long} %{NONNEGINT:cisco_ise.log.segment.number:long} %{GREEDYDATA:_tmp.message}$'
      pattern_definitions:
        TIMEONLYSTAMP_ISO8601: '%{YEAR}-%{MONTHNUM}-%{MONTHDAY}[T]%{HOUR}:?%{MINUTE}(?::?%{SECOND})?'
      on_failure:
        - append:
            field: error.message
            value: '{{{ _ingest.on_failure_processor_tag }}}: {{{_ingest.on_failure_message}}}'
  - grok:
      field: _tmp.message
      tag: grok_message_details
      if: ctx._tmp?.message != null
      patterns:
        - '^%{NOTCOLON:cisco_ise.log.log_severity_level}%{SPACE}: %{NOTCOLON:event.action}%{SPACE}: %{GREEDYDATA:message}$'
        - ^%{NUMBER:cisco_ise.log.message.id} %{NUMBER:cisco_ise.log.segment.total:long} %{NUMBER:cisco_ise.log.segment.number:long} %{GREEDYDATA:message}$
        - ^%{GREEDYDATA:message}$
      pattern_definitions:
        NOTCOLON: '[^:]*?'
      on_failure:
        - append:
            field: error.message
            value: '{{{ _ingest.on_failure_processor_tag }}}: {{{_ingest.on_failure_message}}}'
  - trim:
      field: message
      ignore_failure: true
  - convert:
      if: ctx.host?.hostname != null && ctx.host.hostname != ''
      field: host.hostname
      target_field: host.ip
      type: ip
      ignore_failure: true
      ignore_missing: true
  - remove:
      field: host.hostname
      if: ctx.host?.ip != null
  - append:
      field: related.ip
      value: '{{{host.ip}}}'
      if: ctx.host?.ip != null
      allow_duplicates: false
      ignore_failure: true
  - append:
      field: related.hosts
      value: '{{{host.hostname}}}'
      if: ctx.host?.hostname != null
      allow_duplicates: false
      ignore_failure: true
  - rename:
      field: _conf.tz_offset
      target_field: event.timezone
      if: ctx._conf?.tz_offset != null
      tag: rename_tz_offset
      ignore_missing: true
  - rename:
      field: _tmp.timezone
      tag: rename_tmp_timezone
      target_field: event.timezone
      if: ctx.event?.timezone == null # If user has not provided the timezone offset.
      ignore_missing: true
  - date:
      field: _tmp.timestamp
      tag: default-tmp-timestamp parsing
      formats:
        - MMM [ ]d[d] HH:mm:ss[.SSSSSS][.SSS]
        - ISO8601
      on_failure:
        - remove:
            field: _tmp.timestamp
            ignore_missing: true
        - append:
            field: error.message
            value: '{{{ _ingest.on_failure_processor_tag }}}: {{{_ingest.on_failure_message}}}'
  - date:
      if: ctx.event?.timezone != null && ctx.event.timezone != ''
      field: _tmp.timestamp
      timezone: '{{{event.timezone}}}'
      tag: default-tmp-timestamp-with timezone parsing
      formats:
        - MMM [ ]d[d] HH:mm:ss[.SSSSSS][.SSS]
        - ISO8601
      on_failure:
        - remove:
            field: _tmp.timestamp
            ignore_missing: true
        - append:
            field: error.message
            value: '{{{ _ingest.on_failure_processor_tag }}}: {{{_ingest.on_failure_message}}}'
  - pipeline:
      name: '{{ IngestPipeline "pipeline_policy_diagnostics" }}'
      if: ctx.cisco_ise?.log?.category?.name == 'CISE_Policy_Diagnostics'
  - pipeline:
      name: '{{ IngestPipeline "pipeline_guest" }}'
      if: ctx.cisco_ise?.log?.category?.name == 'CISE_Guest'
  - pipeline:
      name: '{{ IngestPipeline "pipeline_mydevices" }}'
      if: ctx.cisco_ise?.log?.category?.name == 'CISE_MyDevices'
  - pipeline:
      name: '{{ IngestPipeline "pipeline_internal_operations_diagnostics" }}'
      if: ctx.cisco_ise?.log?.category?.name == 'CISE_Internal_Operations_Diagnostics'
  - pipeline:
      name: '{{ IngestPipeline "pipeline_threat_centric_nac" }}'
      if: ctx.cisco_ise?.log?.category?.name == 'CISE_Threat_Centric_NAC'
  - pipeline:
      name: '{{ IngestPipeline "pipeline_posture_and_client_provisioning_audit" }}'
      if: ctx.cisco_ise?.log?.category?.name == 'CISE_Posture_and_Client_Provisioning_Audit'
  - pipeline:
      name: '{{ IngestPipeline "pipeline_radius_accounting" }}'
      if: ctx.cisco_ise?.log?.category?.name == 'CISE_RADIUS_Accounting'
  - pipeline:
      name: '{{ IngestPipeline "pipeline_failed_attempts" }}'
      if: ctx.cisco_ise?.log?.category?.name == 'CISE_Failed_Attempts'
  - pipeline:
      name: '{{ IngestPipeline "pipeline_passed_authentications" }}'
      if: ctx.cisco_ise?.log?.category?.name == 'CISE_Passed_Authentications'
  - pipeline:
      name: '{{ IngestPipeline "pipeline_radius_diagnostics" }}'
      if: ctx.cisco_ise?.log?.category?.name == 'CISE_RADIUS_Diagnostics'
  - pipeline:
      name: '{{ IngestPipeline "pipeline_ad_connector" }}'
      if: ctx.cisco_ise?.log?.category?.name == 'CISE_AD_Connector'
  - pipeline:
      name: '{{ IngestPipeline "pipeline_authentication_flow_diagnostics" }}'
      if: ctx.cisco_ise?.log?.category?.name == 'CISE_Authentication_Flow_Diagnostics'
  - pipeline:
      name: '{{ IngestPipeline "pipeline_administrative_and_operational_audit" }}'
      if: ctx.cisco_ise?.log?.category?.name == 'CISE_Administrative_and_Operational_Audit'
  - pipeline:
      name: '{{ IngestPipeline "pipeline_system_statistics" }}'
      if: ctx.cisco_ise?.log?.category?.name == 'CISE_System_Statistics'
  - pipeline:
      name: '{{ IngestPipeline "pipeline_tacacs_accounting" }}'
      if: ctx.cisco_ise?.log?.category?.name == 'CISE_TACACS_Accounting'
  - pipeline:
      name: '{{ IngestPipeline "pipeline_identity_stores_diagnostics" }}'
      if: ctx.cisco_ise?.log?.category?.name == "CISE_Identity_Stores_Diagnostics"
  - pipeline:
      name: '{{ IngestPipeline "pipeline_alarm" }}'
      if: ctx.cisco_ise?.log?.category?.name == "CISE_Alarm"
  - pipeline:
      name: '{{ IngestPipeline "pipeline_monitoring_data_purge_audit" }}'
      if: ctx.cisco_ise?.log?.category?.name?.toUpperCase() == 'CISE_MONITORING_DATA_PURGE_AUDIT'
  - set:
      field: host.ip
      value: ['{{{host.ip}}}']
      if: ctx.host?.ip instanceof String
  - convert:
      field: cisco_ise.log.log_details.ConfigVersionId
      target_field: cisco_ise.log.config_version.id
      type: long
      ignore_missing: true
      on_failure:
        - append:
            field: error.message
            value: "{{{ _ingest.on_failure_message }}}"
  - remove:
      field: cisco_ise.log.log_details.ConfigVersionId
      ignore_missing: true
  - lowercase:
      field: log.syslog.severity.name
      ignore_failure: true
      ignore_missing: true
  - set:
      field: log.level
      copy_from: log.syslog.severity.name
      ignore_empty_value: true
  - remove:
      field:
        - _tmp
        - cisco_ise.log.log_details_raw
      ignore_missing: true
  - set:
      field: event.code
      copy_from: cisco_ise.log.message.code
      if: ctx.cisco_ise?.log?.message?.code != null
      ignore_failure: true
  - script:
      lang: painless
      source:
        boolean dropEmptyFields(Object object) {
          if (object == null || object == '') {
            return true;
          } else if (object instanceof Map) {
            ((Map) object).values().removeIf(value -> dropEmptyFields(value));
            return (((Map) object).size() == 0);
          } else if (object instanceof List) {
            ((List) object).removeIf(value -> dropEmptyFields(value));
            return (((List) object).length == 0);
          }
          return false;
        }
        dropEmptyFields(ctx);
on_failure:
  - set:
      field: event.kind
      value: pipeline_error
  - append:
      field: error.message
      value: '{{{_ingest.on_failure_message}}}'