Skip to content

Commit 38227ae

Browse files
oatiasoatias
authored
Ivanti Secure Connect VPN - CRTX-149281 (#40174)
* update ivanti pack
1 parent 7a1fa59 commit 38227ae

File tree

4 files changed

+64
-27
lines changed

4 files changed

+64
-27
lines changed

‎Packs/IvantiConnectSecure/ModelingRules/IvantiConnectSecure/IvantiConnectSecure.xif

Lines changed: 49 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,26 @@ alter
2626
msg_realm = arrayindex(regextract(syslog_msg, "\(([^\)]+)"), 0),
2727
msg_roles_str = arrayindex(regextract(syslog_msg, "\)\[([^\]]+)"), 0),
2828
msg_event_id = arrayindex(regextract(syslog_msg, "\].+?\]\s+([\w\-]+)\s+.+$"), 0),
29-
msg_payload = arrayindex(regextract(syslog_msg, "\].+?\]\s+[\w\-]+\s+(.+$)"), 0)
29+
msg_payload = arrayindex(regextract(syslog_msg, "\].+?\]\s+[\w\-]+\s+(.+$)"), 0),
30+
log_event_code = arrayindex(regextract(_raw_log , "msg\=\"([A-Z0-9]+?)\:"),0),
31+
host_ip_target = arrayindex(regextract(_raw_log , "T\d{2}\:\d{2}\:\d{2}\+\d+\:\d+\s(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"),0),
32+
application_name = arrayindex(regextract(_raw_log ,"\+\d{2}\:\d{2}\s\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\s(\S+)\:\s"),0),
33+
alert_id = arrayindex(regextract(_raw_log , "id\=([A-Za-z0-9\s]+)?\stime"),0),
34+
pri = arrayindex(regextract(_raw_log , "pri\=(\d+)"),0),
35+
fw = arrayindex(regextract(_raw_log , "fw\=(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"),0),
36+
vpn = arrayindex(regextract(_raw_log , "vpn\=([^\s]+)"),0),
37+
user = arrayindex(regextract(_raw_log , "user\=([^\s]+)"),0),
38+
realm = arrayindex(regextract(_raw_log , "realm\=\"([^\"]+)"),0),
39+
roles = arrayindex(regextract(_raw_log , "roles\=\"([^\"]+)"),0),
40+
session_id = arrayindex(regextract(_raw_log , "sessionID\=\"([^\"]+)"),0),
41+
proto = arrayindex(regextract(_raw_log ,"proto\=([A-Za-z]+)\s"),0),
42+
src = arrayindex(regextract(_raw_log , "src\=(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"),0),
43+
type = arrayindex(regextract(_raw_log ,"type\=([^\s]+)"),0),
44+
bytes_sent = arrayindex(regextract(_raw_log ,"sent\=(\d+)"),0),
45+
bytes_rcvd = arrayindex(regextract(_raw_log , "rcvd\=(\d+)"),0),
46+
user_agent = arrayindex(regextract(_raw_log , "agent\=\"([^\"]+)"),0),
47+
duration = arrayindex(regextract(_raw_log ,"duration\=(\d+)"),0),
48+
msg = arrayindex(regextract(_raw_log , "msg\=\"([^\"]+)"),0)
3049
| alter
3150
syslog_severity = subtract(syslog_priority, multiply(syslog_facility, 8)),
3251
full_user_name = coalesce(msg_user1, msg_user2),
@@ -44,22 +63,27 @@ alter
4463
src_ipv6 = if(msg_ip ~= "\:[a-fA-F\d]{1,3}", msg_ip, null),
4564
client_version = arrayindex(regextract(msg_payload, "from \S+ with [\w\-]+\/([\d\.]+\d)"), 0),
4665
client_os = arrayindex(regextract(msg_payload, "from \S+ with [\w\-]+\/[\d\.]+\d\s+\(([^\)]+)\)"), 0),
47-
session_id = arrayindex(regextract(msg_payload, "session:(\w+)"), 0),
66+
session_id2 = arrayindex(regextract(msg_payload, "session:(\w+)"), 0),
4867
reason = arrayindex(regextract(msg_payload, "Reason:\s*([\w\s\-]+)"), 0),
4968
reason2 = arrayindex(regextract(msg_payload, "due to\s+(\S+)"), 0),
5069
target_share_server = arrayindex(regextract(msg_payload, "\s*\\\\([a-fA-F\d\.\:]+)\\\S+\$"), 0),
5170
target_share_domain= arrayindex(regextract(msg_payload, "in wrkgrp\/domain\s*(\S+)"), 0),
52-
error_code = arrayindex(regextract(msg_payload, "with error (\w+)"), 0)
71+
error_code = arrayindex(regextract(msg_payload, "with error (\w+)"), 0),
72+
log_event_type = if(log_event_code contains "AUT", "Authenticate", log_event_code = "SYS31048", "System Error" ,log_event_code contains "SYS", "System Status", log_event_code = "NWC30993", "Network Connect", log_event_code contains "EAM", "Agent Manager", log_event_code = "NWC32001", "Dsagentd User", log_event_code = "NWC32185", "Dsagentd User", log_event_code = "NWC23464", "Network Connect", log_event_code = "AGU30457", "Dsagentd User", log_event_code = "NWC32179", "Dsagentd User", log_event_code = "NWC32164", "Dsagentd User", log_event_code = "AGU30458", "Dsagentd User", log_event_code = "NWC30477", "Network Connect", log_event_code = "NWC23465", "Network Connect", log_event_code),
73+
pri = if(pri in ("1","2","3","4"),"Info", pri in("5","6","7"),"Minor", pri in("8","9"),"Major",pri ="10","Critical",pri)
5374
| alter
5475
severity = to_string(syslog_severity),
5576
event_name = coalesce(event_name_custom1, event_name1, event_name2, event_name3, event_name4, event_name5, event_name6),
5677
user_name = arrayindex(regextract(full_user_name, "[^\\]\\\s*(\S.+)"), 0),
5778
user_domain = arrayindex(regextract(full_user_name, "([^\\]+)\\\s*\S.+"), 0),
5879
dst_ipv4 = if(target_share_server ~= "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}", target_share_server, null),
5980
dst_ipv6 = if(target_share_server ~= "\:[a-fA-F\d]{1,3}", target_share_server, null),
60-
os = lowercase(client_os)
81+
os = lowercase(client_os),
82+
log_event_name = if(log_event_code = "AUT23391", "Connect Failed", log_event_code = "SYS31408", "Pending Syslog Start", log_event_code = "AUT24804", "Host Checker Failed Ex", log_event_code = "SYS31048", "Log Broken Connection", log_event_code = "AUT24803" , "Host Checker Passed Ex", log_event_code = "AUT24326", "Log Auth Success", log_event_code = "AUT20914", "Session Timeout", log_event_code = "NWC30993", "Conn Closed", log_event_code = "EAM24460", "User Event", log_event_code = "AUT31829", "User Session Deleted", log_event_code = "AUT32033", "Session Creation", log_event_code = "AUT31984", "Host Checker Result", log_event_code = "AUT22673", "Logout", log_event_code = "NWC32185", "Closure Of Web Initiated Connection",log_event_code = "NWC23464", "Session Start", log_event_code = "EAM30446", "ExtendSession", log_event_code = "AGU30457", "Starting Session", log_event_code = "AUT24414", "Login", log_event_code = "AUT31985", "Signin Reject Log User", log_event_code = "NWC32179", "Duplicate Session", log_event_code = "NWC32164", "IFT Disconnect", log_event_code = "AUT20915", "User Idle Timeout By Request", log_event_code = "SYS31415", "Syslog Reconnected", log_event_code = "AUT22886", "User Idle Timeout", log_event_code = "AUT32051", "Log Connection Type", log_event_code = "SYS31641", "Log Message Trap", log_event_code = "AGU30458", "Ending Session", log_event_code = "NWC30477", "Transport Mode", log_event_code = "NWC23465", "Session End", log_event_code = "AUT24327", "Log Auth Failure", log_event_code = "SYS31409", "Pending Syslog Done", log_event_code = "AUT23523", "Policy Reeval Delete Session", log_event_code = "NWC32001", "Client Connection Done" ,log_event_code)
6183
| alter
62-
dst_hostname = if(dst_ipv4 = null and dst_ipv6 = null, target_share_server, null)
84+
dst_hostname = if(dst_ipv4 = null and dst_ipv6 = null, target_share_server, null),
85+
log_event_type_and_name = concat(log_event_type , " - " , log_event_name),
86+
roles = arraycreate(roles)
6387
| alter
6488
xdm.observer.name = syslog_hostname,
6589
xdm.observer.version = client_version,
@@ -68,31 +92,40 @@ alter
6892
xdm.intermediate.host.hostname = syslog_hostname,
6993
xdm.intermediate.application.name = syslog_app_name,
7094
xdm.intermediate.process.identifier = if(syslog_process_id != "-", syslog_process_id, null),
71-
xdm.source.ipv4 = src_ipv4,
95+
xdm.source.ipv4 = coalesce(src_ipv4,src),
7296
xdm.source.host.ipv4_addresses = arraycreate(src_ipv4),
7397
xdm.source.ipv6 = src_ipv6,
7498
xdm.source.host.ipv6_addresses = arraycreate(src_ipv6),
75-
xdm.source.user.username = full_user_name,
99+
xdm.source.user.username = coalesce(full_user_name, user),
76100
xdm.source.user.upn = coalesce(user_name, full_user_name),
77-
xdm.source.user.domain = user_domain,
78-
xdm.source.user.groups = msg_roles,
101+
xdm.source.user.domain = coalesce(user_domain, realm),
102+
xdm.source.user.groups = coalesce(msg_roles,roles),
79103
xdm.source.agent.version = client_version,
80104
xdm.source.host.os = client_os,
81105
xdm.source.host.os_family = if(os contains "windows", XDM_CONST.OS_FAMILY_WINDOWS, os contains "mac", XDM_CONST.OS_FAMILY_MACOS, os contains "linux", XDM_CONST.OS_FAMILY_LINUX, os contains "android", XDM_CONST.OS_FAMILY_ANDROID, os contains "ios", XDM_CONST.OS_FAMILY_IOS, os contains "ubuntu", XDM_CONST.OS_FAMILY_UBUNTU, os contains "debian", XDM_CONST.OS_FAMILY_DEBIAN, os contains "fedora", XDM_CONST.OS_FAMILY_FEDORA, os contains "centos", XDM_CONST.OS_FAMILY_CENTOS, os contains "chrome", XDM_CONST.OS_FAMILY_CHROMEOS, os contains "solaris", XDM_CONST.OS_FAMILY_SOLARIS, os contains "scada", XDM_CONST.OS_FAMILY_SCADA, to_string(client_os)),
82-
xdm.target.ipv4 = dst_ipv4,
106+
xdm.target.ipv4 = coalesce(dst_ipv4,host_ip_target),
83107
xdm.target.host.ipv4_addresses = if(dst_ipv4 != null, arraycreate(dst_ipv4), null),
84108
xdm.target.ipv6 = dst_ipv6,
85109
xdm.target.host.ipv6_addresses = if(dst_ipv4 != null, arraycreate(dst_ipv6), null),
86-
xdm.target.host.hostname = dst_hostname,
110+
xdm.target.host.hostname = coalesce(dst_hostname, vpn),
87111
xdm.target.domain = coalesce(target_share_domain, msg_realm),
88-
xdm.event.description = msg_payload,
89-
xdm.event.type = null, // System, User Access, Admin Access, Sensors & Client Logs;
112+
xdm.event.description = coalesce(msg_payload,msg),
113+
xdm.event.type = log_event_type_and_name, // System, User Access, Admin Access, Sensors & Client Logs;
90114
xdm.event.id = event_id,
115+
xdm.event.original_event_type = type,
91116
xdm.event.tags = arrayconcat(if(msg_payload ~= "[Ll]ogin|[Aa]uthentication", arraycreate(XDM_CONST.EVENT_TAG_AUTHENTICATION), null), syslog_structured_data_segments),
92117
xdm.event.outcome = if(msg_payload ~= "succeeded|successful", XDM_CONST.OUTCOME_SUCCESS, msg_payload ~= "[Ff]ailed|[Rr]ejected", XDM_CONST.OUTCOME_FAILED, null),
93118
xdm.event.outcome_reason = coalesce(reason, reason2, error_code),
94119
xdm.event.log_level = if(severity = "0", XDM_CONST.LOG_LEVEL_EMERGENCY , severity = "1", XDM_CONST.LOG_LEVEL_ALERT , severity = "2", XDM_CONST.LOG_LEVEL_CRITICAL, severity = "3", XDM_CONST.LOG_LEVEL_ERROR, severity = "4", XDM_CONST.LOG_LEVEL_WARNING, severity = "5", XDM_CONST.LOG_LEVEL_NOTICE, severity = "6", XDM_CONST.LOG_LEVEL_INFORMATIONAL, severity = "7", XDM_CONST.LOG_LEVEL_DEBUG, severity),
95-
xdm.alert.severity = severity,
96-
xdm.network.session_id = session_id,
97-
xdm.session_context_id = session_id;
120+
xdm.alert.severity = coalesce(severity, pri),
121+
xdm.network.session_id = coalesce(session_id,session_id2),
122+
xdm.source.application.name = application_name,
123+
xdm.alert.subcategory = alert_id,
124+
xdm.intermediate.ipv4 = fw,
125+
xdm.source.sent_bytes = to_integer(bytes_sent),
126+
xdm.target.sent_bytes = to_integer(bytes_rcvd),
127+
xdm.network.application_protocol_category = proto,
128+
xdm.session_context_id = session_id,
129+
xdm.source.user_agent = user_agent,
130+
xdm.event.duration = to_integer(duration);
98131
/* END of Ivanti (Pulse) Connect Secure (Remote Access VPN) */

‎Packs/IvantiConnectSecure/README.md

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,3 @@
1-
21
# Ivanti Connect Secure
32

43
<~XSIAM>
@@ -21,7 +20,9 @@ This section describes the mandatory steps you should perform on Ivanti Connect
2120
| :--- | :---
2221
| `Server name/IP` | Enter the [Cortex XSIAM Broker VM](#broker-vm) server's IP address or FQDN.
2322
| `Type` | Select **UDP**.
24-
| `Filter` | Select **Standard** (the default).
23+
| `Filter` | Select **WELF**.
24+
25+
**Note:** While the pack supports both "WELF" and "Default RAW" log formats, it is recommended to use WELF format.
2526

2627
5. Click **Save Changes** for saving the configuration.
2728

@@ -61,4 +62,4 @@ You can configure the specific vendor and product for this instance.
6162
| `Vendor` | Enter **_Ivanti_**.
6263
| `Product` | Enter **_Connect Secure_**.
6364

64-
</~XSIAM>
65+
</~XSIAM>

‎Packs/IvantiConnectSecure/ReleaseNotes/1_0_3.md

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
2+
#### Modeling Rules
3+
4+
##### Ivanti Connect Secure Modeling Rules
5+
6+
- Modeling rules updated to support WELF format

‎Packs/IvantiConnectSecure/pack_metadata.json

Lines changed: 5 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -2,22 +2,19 @@
22
"name": "Ivanti Connect Secure",
33
"description": "XSIAM Modeling & Parsing Rules for ICS (Ivanti Connect Secure).",
44
"support": "xsoar",
5-
"currentVersion": "1.0.2",
5+
"currentVersion": "1.0.3",
66
"author": "Cortex XSOAR",
77
"url": "https://www.paloaltonetworks.com/cortex",
88
"email": "",
99
"categories": [
1010
"Network Security"
1111
],
12-
"tags": [],
12+
"tags": [
13+
"Network"
14+
],
1315
"useCases": [],
1416
"keywords": [
15-
"Ivanti",
16-
"Pulse",
17-
"Pulse Connect Secure",
18-
"Ivanti Connect Secure",
19-
"Connect Secure",
20-
"VPN"
17+
"Pulse"
2118
],
2219
"marketplaces": [
2320
"marketplacev2",

0 commit comments

Comments
 (0)