Filebeat cisco asa module source and destination IP showing reversed

Elastic Stack Beats
1

Hi Team,

We are using the filebeat cisco asa module in filebeat to parse the data from cisco asa firewalls. One issues we noticed is the source IP and destination IP are actually showing as reversed when its parsed.

Filebeat Version 7.9.0 with cisco module enabled. Elasticsearch Version 7.9.0

Tried with Elasticsearch Version 7.10.1 also , its the same issue.

Eg

I tried a telnet to public IP 52.87.178.42 on port 22 from our internal server 10.192.xxxxx

Now if i lookup in discovery for destination.ip : 52.87.178.42 or destination.address : 52.87.178.42 . it returns nothing.

But it i check the same IP as source.ip : 52.87.178.42 or source.address : 52.87.178.42 it gives me the output.

Please check the attached screenshot

Cisco ASA Issue
Cisco ASA Issue1296×453 86.6 KB

Please advise.

Thanks,
Ajesh

2

Ajesh, could you please post your original logs? It looks like an issue with Beats.

3

Hello Marcin,

sorry for the delay , are you looking for cisco ASA Firewall logs? i will post it asap

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.