|
Source Ip Address |
Displays a flow chart of source IP addresses by severity, class
name, source host, and source address.
Hide Query Show Query cisco_facility="ASA"
| host=?asaHost
| cisco_severity=?severity
| cisco_className=?classname
| sankey(source="host", target="src_addr")
| Sankey |
|
Top 10 Attempted Access To Ports |
Displays a list of the top 10 port access attempts.
Hide Query Show Query host=?asaHost
| cisco_facility="ASA"
| cisco_mnemonic=710003
| dst_port=?DestPort
| top(dst_port)
| Pie Chart |
|
Cisco Secure Firewall ASA Series Syslog Messages |
Displays a flow chart of Cisco Secure Firewall ASA syslog messages
by host.
Hide Query Show Query cisco_facility="ASA"
| sankey(source="host", target="cisco_mnemonic")
| Sankey |
|
Connections Per Hour From Outside |
Displays the number of connections per hour from outside sources
in a 1 hour timespan.
Hide Query Show Query src_location="outside"
| match(file="cisco/asa/asa_message_class.csv", field="cisco_classDefinition")
| timechart(span=1h)
| Single Value |
|
Top 10 Destination Address |
Displays a pie chart of the top 10 IP address destinations.
Hide Query Show Query top(destination_ip, limit=10)
| Pie Chart |
|
Number of ASA firewalls |
Displays the number of ASA firewalls.
Hide Query Show Query cisco_facility="ASA"
| count(field=host, distinct=true)
| Single Value |
|
Event List |
Displays a list of Cisco ASA events with timestamp, firewall,
severity, class name, mnemonic, and message information.
Hide Query Show Query cisco_facility="ASA"
| host=?asaHost
| cisco_severity=?severity
| cisco_className=?classname
| rename(host,as=Firewall)
| rename(cisco_severity,as=Severity)
| rename(cisco_className,as="Class name")
| rename(cisco_mnemonic,as=Mnemonic)
| rename(cisco_message,as=Message)
| select(["@timestamp",Firewall,Severity,"Class name",Mnemonic,Message])
| Table |
|
Total Connection From Inside |
Displays the number of total connections occurring from inside in
a 1 hour timespan.
Hide Query Show Query src_location="inside"
| match(file="cisco/asa/asa_message_class.csv", field="cisco_classDefinition")
| timechart(span=1h)
| Single Value |
|
Failed By Cisco Class Name |
Displays a table of failed Cisco events by class name.
Hide Query Show Query groupBy(["cisco_severity","cisco_className"], function=(count(as="Count")))
| rename(field="cisco_severity", as="Severity")
| rename(field="cisco_className", as="ClassName")
| select([Severity, ClassName, Count])
| Table |
|
Top Source Ports |
Displays a list of top source ports based on Cisco severity and
escalation guidelines.
Hide Query Show Query cisco_severity=?severity
| timechart("source_port")
| Time Chart |
|
Total Accepted Connection |
Displays a list of total accepted connections in a 1 hour
timespan.
Hide Query Show Query cisco_action = "Built"
| timechart(span=1h)
| Single Value |
|
Top 10 Source Address |
Displays a chart of the top 10 source IP addresses.
Hide Query Show Query top("source_ip", limit=10)
| Bar Chart |
|
ICMP Connction Denied |
Displays a table of denied ICMP connections.
Hide Query Show Query cisco_message="*ICMP*"
| groupBy(type, function=[])
| rename(field="type", as="Type")
| Table |
|
Events Per Firewall |
Displays a table of events per firewall by severity, class, and
number of events.
Hide Query Show Query cisco_facility="ASA"
| cisco_severity=?severity
| cisco_className=?classname
| groupby(host)
| rename(host,as=Firewall)
| rename("_count",as="Number of events")
| Table |
|
Severity Messages |
Displays a chart of severity messages using Cisco data.
Hide Query Show Query | Bar Chart |
|
Total Failed Connections |
Displays a list of total failed connections in a one hour time
span.
Hide Query Show Query cisco_message="*failed*"
| timechart(span=1h)
| Single Value |
|
Top 10 Messages |
Displays a chart of top 10 ASA message classes and limits results
to the first 10 entries.
Hide Query Show Query cisco_facility="ASA"
| host=?asaHost
| cisco_severity=?severity
| cisco_className=?classname
| rename("cisco_classDefinition",as="ASA message classes")
| timechart("ASA message classes", limit=10)
| Time Chart |
|
Cisco Action by Ports |
Displays a list of Cisco actions by source port.
Hide Query Show Query groupBy([source_port, cisco_action, outside, inside], function = [])
| rename(field="source_port", as="Source Port")
| rename(field="cisco_action", as="Cisco Action")
| select(["Source Port", "Cisco Action"])
| Table |
