Cisco ASA module Source and Destination IP incorrect

Elastic Stack Beats
1

Dear Team,

We are currently ingesting Cisco ASA logs to our elasticsearch cluster using cisco asa module [ECS] which comes with filebeat. After verifying the logs in elasticsearch we could understand that Source.address and destination.address is reversed. Please see the snippet below.

Firewall Logs - Showing the correct flow

FW_logs
FW_logs1365×63 49.1 KB

Elasticsearch Discovery log console. - Showing the destination IP as source and Source which is our Internal IP as destination

elastic_logs
elastic_logs1299×273 86.4 KB

We have checked this on multiple firewalls we have and we see this on all the cisco asa firewalls integrated to elasticsearch cluster

Please let me know if we can do anything to correct this

Thanks,
Ajesh

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.