[
https://issues.apache.org/jira/browse/METRON-2105?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16832481#comment-16832481
]
Pieter Baele commented on METRON-2105:
--------------------------------------
{{ private static final Map<String, String> patternMap = ImmutableMap.<String,
String> builder()
.put("ASA-2-106001", "CISCOFW106001")}}
and a bit further
{{ metronJson.put("ciscotag", syslogJson.get("CISCOTAG"));
}}
We will use Grok parser as a temporary workaround, but I expect to perform less
> Enhance BasicAsaParser to add patterns dynamically
> --------------------------------------------------
>
> Key: METRON-2105
> URL: https://issues.apache.org/jira/browse/METRON-2105
> Project: Metron
> Issue Type: Improvement
> Affects Versions: 0.7.0, 0.7.1
> Reporter: Pieter Baele
> Priority: Critical
>
> The current implementation of the ASA parser uses a static patternMap. As a
> result, the parser needs recompilation when patterns are added.
> An enhancement would be dyamic reload capabilities based on a mapping file
> using ciscotag and grok patterns loaded using hdfs.
> This can be especially important regarding the number of patterns that can be
> introduced by 3-th party commiters as the list of possible messages is quite
> long [https://www.cisco.com/c/en/us/td/docs/security/asa/syslog/b_syslog.html]
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
