Typo in logstash-patterns-core/patterns/ecs-v1/firewalls about logstash-patterns-core

[leandrojmp]

This issue was mentioned in this discuss topic.

The error is in the pattern CISCOFW302013_302014_302015_302016 in the firewalls pattern file.

The part that should extract the source.user.name is wrong.

It is now:

(?:\(%{DATA:[source][user][name?]}\))

And it should be changed to:

(?:\(%{DATA:[source][user][name]}\))

I was able to replicate the issue in 8.2.3 and changing the pattern file solved it.

Sample message tested (sample for ASA-6-302016)

"Teardown UDP connection 89517928 for ingress_interface:10.0.0.15/61541(some.username) to egress_interface:192.168.0.20/53 duration 0:00:00 bytes 116 (some.username)"

Result after changing the pattern file:

{
          "cisco" => {
        "asa" => {
            "connection_id" => "89517928",
                  "network" => {
                "transport" => "UDP"
            },
                 "duration" => "0:00:00",
                  "outcome" => "Teardown"
        }
    },
        "message" => "Teardown UDP connection 89517928 for ingress_interface:10.0.0.15/61541(some.username) to egress_interface:192.168.0.20/53 duration 0:00:00 bytes 116 (some.username)",
       "@version" => "1",
     "@timestamp" => 2022-06-17T14:00:59.337891Z,
          "event" => {
        "original" => "Teardown UDP connection 89517928 for ingress_interface:10.0.0.15/61541(some.username) to egress_interface:192.168.0.20/53 duration 0:00:00 bytes 116 (some.username)"
    },
       "observer" => {
        "ingress" => {
            "interface" => {
                "name" => "ingress_interface"
            }
        },
         "egress" => {
            "interface" => {
                "name" => "egress_interface"
            }
        }
    },
         "source" => {
        "user" => {
            "name" => "some.username"
        },
          "ip" => "10.0.0.15",
        "port" => 61541
    },
    "destination" => {
          "ip" => "192.168.0.20",
        "port" => 53
    },
        "network" => {
        "bytes" => 116
    },
           "host" => {
        "hostname" => "elk-lab"
    }
}

I can make a PR with this change.