# Values field event.action for Cisco ASA integration **URL:** \ **Category:** Elastic Agent\ **Tags:** integrations\ **Created:** [July 6, 2023, 12:11pm UTC](https://discuss.elastic.co/t/values-field-event-action-for-cisco-asa-integration/337794 "2023-07-06T12:11:59Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![frederikvandeputte](https://avatars.discourse-cdn.com/v4/letter/f/6de8d8/32.png) [@frederikvandeputte](https://discuss.elastic.co/u/frederikvandeputte)\ **Post date:** [July 6, 2023, 12:11pm UTC](https://discuss.elastic.co/t/values-field-event-action-for-cisco-asa-integration/337794/1 "2023-07-06T12:11:59Z")
Hi Currently parsed events coming from Cisco ASA firewall ingest pipeline show 4 types of values in field event.action: firewall-rule; flow-expiration; flow-creation and error. Value "firewall-rule" is very much a useless value, when you want to validate if a connection was allowed or denied. Many Syslog messages from ASA do have actual action values present, so it would seem logical to also include those in event.action. This is a quite important request when you are trying to make exceptions for threat indicator matches in the Security module. Thanks Frederik ---
**Author:** ![Wave](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wave/32/117242_2.png) [@Wave](https://discuss.elastic.co/u/Wave)\ **Post date:** [July 10, 2023, 2:50pm UTC](https://discuss.elastic.co/t/values-field-event-action-for-cisco-asa-integration/337794/2 "2023-07-10T14:50:14Z")
Hi @frederikvandeputte, Have you tried loading in the [ingest pipelines](https://www.elastic.co/guide/en/beats/filebeat/current/load-ingest-pipelines.html) for the cisco asa? ---
**Author:** ![frederikvandeputte](https://avatars.discourse-cdn.com/v4/letter/f/6de8d8/32.png) [@frederikvandeputte](https://discuss.elastic.co/u/frederikvandeputte)\ **Post date:** [July 10, 2023, 3:17pm UTC](https://discuss.elastic.co/t/values-field-event-action-for-cisco-asa-integration/337794/3 "2023-07-10T15:17:34Z")
Hi, This is about an integration, provided by Elastic and it is a request to improve ingest pipeline logic. Obviously, I could write one myself, but since this is OOB, I do believe that Elastic is responsible for correct parsing. ---
**Author:** ![Wave](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wave/32/117242_2.png) [@Wave](https://discuss.elastic.co/u/Wave)\ **Post date:** [July 10, 2023, 7:27pm UTC](https://discuss.elastic.co/t/values-field-event-action-for-cisco-asa-integration/337794/4 "2023-07-10T19:27:36Z")
Ok, yes just wanted to make sure we are talking about the same thing. You should be able to modify the ingest pipeline as needed. I've had to do that for some of our cisco asa rules. If you think you've found a bug in that pipeline I'd recommend opening up an issue through git hub. ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [July 10, 2023, 7:48pm UTC](https://discuss.elastic.co/t/values-field-event-action-for-cisco-asa-integration/337794/5 "2023-07-10T19:48:26Z")
> [@frederikvandeputte](#): > > This is about an integration, provided by Elastic and it is a request to improve ingest pipeline logic. You need to open an issue in the Integrations repository, [this one](https://github.com/elastic/integrations) to see if this is an error in the parsing or a feature request. The [ingest pipeline](https://github.com/elastic/integrations/blob/main/packages/cisco_asa/data_stream/log/elasticsearch/ingest_pipeline/default.yml) for the Cisco ASA integration will populate the field `event.action` with values direct from the message or using conditionals based on the message id, but there are more than those 4 values you mentioned. Basically the value _firewall-rule_ is only added if the field with the message id is empty: ```auto - set: if: 'ctx._temp_?.cisco?.message_id != ""' field: "event.action" value: "firewall-rule" ``` Can you share an example of the original message of one of those events that have `event.action` as `firewall-rule`? ---
**Author:** ![frederikvandeputte](https://avatars.discourse-cdn.com/v4/letter/f/6de8d8/32.png) [@frederikvandeputte](https://discuss.elastic.co/u/frederikvandeputte)\ **Post date:** [July 12, 2023, 12:00pm UTC](https://discuss.elastic.co/t/values-field-event-action-for-cisco-asa-integration/337794/6 "2023-07-12T12:00:48Z")
The majority of ASA logs that we receive from customer are for below event codes: 710005 305011 305012 302013 302014 302015 302016 302020 106023 The complaint mostly stems from the fact that ingest pipelines for most other firewall brands process the "action" for a traffic log in field event.action, which is good for our case, because we process logs for many firewall brands and prefer that all fields contain similar values universally. Sadly, the ingest pipeline for Cisco ASA is just not doing that. After having taken a look how ASA logs are processed, i see that some of the status values are filled into field event.type with some comparable value, which sometimes is straightforward, like a denied or allowed, but when it sais info, that does not compute, because "info" is not an action. looking at the message itself for most cases it looks that when info is mentioned this is comparable to an allow, so we can work with that. Also, while we are busy, for event code 302016 the values of source and destination IP and ports are switched around, but when you look at how the events message text is written, this confusion is understandable. (From other discussion posts, I have found this is already being suggested before) Anyway thank you for your imput. ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [July 12, 2023, 2:04pm UTC](https://discuss.elastic.co/t/values-field-event-action-for-cisco-asa-integration/337794/7 "2023-07-12T14:04:30Z")
> [@frederikvandeputte](#): > > Sadly, the ingest pipeline for Cisco ASA is just not doing that. I would say that this is because the majority of the parsing on the integrations are community contributions from people that were using Filebeat Modules and now Elatic Agent, so the effectiveness of the parsing pipeline will depends on the contributor use case, which may be different from other use cases. In some cases the fields will be populated with generic information until someone else contributes improving it or open a feature request providing some sample data so Elastic can look on it. In this case the best way would be to open an Issue on Github with the Cisco Event codes that do not have `event.action` or just have generic ones like `flow-creation` and `flow-expiration` and provide some sample messages for Elastic to analyze. > [@frederikvandeputte](#): > > i see that some of the status values are filled into field event.type with some comparable value, which sometimes is straightforward, like a denied or allowed, but when it sais info, that does not compute, because "info" is not an action. The `event.type` field is one of the [categorization fields](https://www.elastic.co/guide/en/ecs/current/ecs-category-field-values-reference.html) that elastic uses in the SIEM and Alerts modules, it will not match the value of `event.action` and Elastic recommend to limit the values for this field to the [allowed values](https://www.elastic.co/guide/en/ecs/current/ecs-allowed-values-event-type.html). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 9, 2023, 2:04pm UTC](https://discuss.elastic.co/t/values-field-event-action-for-cisco-asa-integration/337794/8 "2023-08-09T14:04:53Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.