Hi,
My use case is.
I am having a log file of Firewall. In this I have a log like this:
Aug 22 2019 13:17:05: %ASA-6-106100: access-list CheckPoint_access_in denied tcp CheckPoint/20.36.219.28(443) -> Intranet-DMZ/10.18.13.85(55460) hit-cnt 1 first hit [0x14fc4bcc, 0x00000000]
This is my parser:
%{SYSLOGTIMESTAMP:timeStamp}: %{DATA:data}: %{DATA:msg}/%{IP:srcIp}(%{NUMBER:srcPort}) -> Intranet-DMZ/%{IP:dstIp}(%{NUMBER:dstPort})%{GREEDYDATA:remain}
From this I have to extract these field source-ip, Destination Ip and destination port.
according to my use case I have to trigger an alert when the source ip and destination ip is same but they have different port trigger alert.
Kindly help.