# Yet another Cisco ASA content pack

**URL:** <https://community.graylog.org/t/yet-another-cisco-asa-content-pack/16185>\
**Category:** Graylog Central (peer support)\
**Tags:** pipeline-rules\
**Created:** [July 2, 2020, 9:01pm UTC](https://community.graylog.org/t/yet-another-cisco-asa-content-pack/16185 "2020-07-02T21:01:51Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![acl](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/acl/32/6763_2.png) [@acl](https://community.graylog.org/u/acl)\
**Post date:** [July 2, 2020, 9:01pm UTC](https://community.graylog.org/t/yet-another-cisco-asa-content-pack/16185/1 "2020-07-02T21:01:51Z")

</div>

There are tons of Cisco ASA content packs out there but we have decided to roll our own. Mostly to learn and also to add a bit of flexibility.

Everything is working great but we are now looking into streamlining the pipeline. Right now we just have 1 massive grok lookup which we want to break apart. Our problem is we don’t want to make tons of pipeline rules either. Any recommendations to break this up into something efficient.

rule “ASA syslog/UDP raw log”  
when  
has\_field(“message”)  
then  
let raw\_log = to\_string($message.message);  
let header = grok(pattern:"%{CISCOTAG:ciscotag}: (%{CISCOFW104001}|%{CISCOFW104002}|%{CISCOFW104003}|%{CISCOFW104004}|%{CISCOFW105003}|%{CISCOFW105004}|%{CISCOFW105005}|%{CISCOFW105008}|%{CISCOFW106100}|%{CISCOFW106100\_2\_3}|%{CISCOFW106001}|%{CISCOFW106023}|%{CISCOFW113003}|%{CISCOFW113004}|%{CISCOFW113005}|%{CISCOFW113008}|%{CISCOFW113009\_113011}|%{CISCOFW113014}|%{CISCOFW113015}|%{CISCOFW113019}|%{CISCOFW113022\_3}|%{CISCOFW113039}|%{CISCOFW313005}|%{CISCOFW401004}|%{CISCOFW419001}|%{CISCOFW419002}|%{CISCOFW434002}|%{CISCOFW500004}|%{CISCOFW507003}|%{CISCOFW710001\_710002\_710003\_710005\_710006}|%{CISCOFW722037}|%{CISCOFW733100}|%{CISCOFW733100}|%{CISCOFW733102}|%{CISCOFW733103})|(%{CISCOTAG:ciscotag}: %{GREEDYDATA:cisco\_message})", value: raw\_log,only\_named\_captures: true);  
set\_fields(header);  
end

You can see the full content pack on the link below

> **[acl/Graylog\_ASA\_GrokPatterns](https://github.com/acl/Graylog_ASA_GrokPatterns)**
>
> Grok patterns for Cisco ASA. Contribute to acl/Graylog\_ASA\_GrokPatterns development by creating an account on GitHub.

Thanks fellas.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [July 16, 2020, 9:01pm UTC](https://community.graylog.org/t/yet-another-cisco-asa-content-pack/16185/2 "2020-07-16T21:01:59Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.