[cisco_asa] Fix 106015 grok for NAT alias names with underscores.

[ie-ops]

Executive summary

The grok processor for Cisco ASA message 106015 (parse_106015) failed to parse log lines where the destination address was an ASA NAT alias name containing underscores (e.g., PROD_INSIDE_GLOBAL). The default Elasticsearch HOSTNAME grok pattern excludes underscores, so such alias names did not match. The fix adds local pattern_definitions to that single grok processor, overriding HOSTNAME to permit underscores in each label segment and redefining IPORHOST to chain through the updated HOSTNAME. A new pipeline test fixture entry covering an underscore-containing destination alias and ingress interface name is added to prevent regressions.

Proposed commit message

[cisco_asa] Fix 106015 grok for NAT alias names with underscores.

Root cause

The parse_106015 grok processor uses the built-in Elasticsearch IPORHOST pattern, whose HOSTNAME component only allows alphanumeric characters and hyphens between dots; Cisco ASA NAT pool alias names containing underscores (e.g. PROD_INSIDE_GLOBAL) are valid on the destination side of 106015 messages but are not matched, causing the entire grok to fail. Unlike parse_106023 (which already defines a custom HOSTNAME allowing underscores via pattern_definitions), parse_106015 has no such override.

Approach

Replace the default Elasticsearch IPORHOST pattern in the parse_106015 grok processor with a custom pattern_definitions block that extends HOSTNAME to allow underscores (matching the identical override already used in parse_106023). Both source.address and destination.address tokens need the extended pattern since ASA NAT global pool aliases such as PROD_INSIDE_GLOBAL can appear on either side of the connection. A new test fixture entry will cover the sanitized event with an underscore-containing destination alias.

Implementation

1. Step 1: In packages/cisco_asa/data_stream/log/elasticsearch/ingest_pipeline/default.yml, locate the parse_106015 grok processor at line 305–311.
2. Step 2: Add a pattern_definitions block to the parse_106015 grok processor defining HOSTNAME as \b(?:[0-9A-Za-z][0-9A-Za-z\-_]{0,62})(?:\.(?:[0-9A-Za-z][0-9A-Za-z\-_]{0,62}))*(\. ?|\b) and IPORHOST as (?:%{IP}|%{HOSTNAME}) — identical to the override already present on parse_106023 (line 357).
3. Step 3: Verify the existing pattern string at line 311 already uses %{IPORHOST:source.address} and %{IPORHOST:destination.address} — no change needed to the pattern string itself; only the pattern_definitions addition is required.
4. Step 4: Add the sanitized event Jun 27 01:09:46 host-1.example.local : %ASA-6-106015: Deny TCP (no connection) from 203.0.113.10/35531 to PROD_INSIDE_GLOBAL/80 flags PSH ACK on interface PUBLIC_FIREWALL to an appropriate existing test fixture log file (e.g. test-non-canonical.log).
5. Step 5: Generate the expected JSON output for the new test case and append it to the corresponding test-non-canonical.log-expected.json. Expected fields include source.address=203.0.113.10, source.ip=203.0.113.10, source.port=35531, destination.address=PROD_INSIDE_GLOBAL, destination.domain=PROD_INSIDE_GLOBAL (no destination.ip), network.transport=tcp, event.outcome=failure, event.code=106015, related.ip=[203.0.113.10], related.hosts=[host-1.example.local,PROD_INSIDE_GLOBAL].
6. Step 6: Bump the version in packages/cisco_asa/manifest.yml from 2.45.2 to 2.45.3 (patch bump for bugfix).
7. Step 7: Prepend a new changelog entry in packages/cisco_asa/changelog.yml for version 2.45.3 with type bugfix: Fix 106015 grok pattern to match ASA NAT alias names containing underscores.

Pipeline changes

• Add pattern_definitions block to the existing parse_106015 grok processor (line 305–311 in default.yml) with custom HOSTNAME (allowing underscores) and IPORHOST definitions, matching the identical override on parse_106023. No change to the pattern string itself.

Field / mapping changes

—

Sanitized error message

Processor 'grok' with tag 'parse_106015' in pipeline 'logs-cisco_asa.log-default' failed with message '[on_failure_message]'

Sanitized log (event_sanitized excerpt)

Jun 27 01:09:46 host-1.example.local : %ASA-6-106015: Deny TCP (no connection) from 203.0.113.10/35531 to PROD_INSIDE_GLOBAL/80 flags PSH ACK  on interface PUBLIC_FIREWALL

Reviewer concerns

• The local HOSTNAME override diverges from the RFC-compliant Elasticsearch built-in, which is intentional but should be noted: strictly speaking, underscores are not valid in DNS hostnames; however, ASA NAT alias names regularly use them.
• The test fixture file (test-non-canonical.log) ends without a trailing newline (\ No newline at end of file); this is cosmetic but inconsistent with the rest of the test corpus.
• The fix is scoped only to parse_106015; if other message-ID processors share the same IPORHOST ambiguity with underscore alias names, they would need analogous overrides separately.

Self-review findings

Self-review invoked: yes (1 cycle)

Severity	Finding	Addressed
nit	Changelog link uses placeholder PR URL — update once PR is opened Intentional per instructions: placeholder will be updated after PR creation	⚠️

Final validation passed: yes

Risk and classification

• Plan risk level: medium
• Tags: pipeline, processors, test-fixture, ingest
• Impact: medium

Links

• Issue: (no issue number)
• Issue title: cisco_asa.log [PIPELINE_FIX]: Processor 'grok' with tag 'parse_106015' in pipeline 'logs-cisco_asa.log…
• Pipeline case: f3ac0dcef9e14d1a

[github-actions]

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[elastic-vault-github-plugin-prod]

✅ All changelog entries have the correct PR link.

[infra-vault-gh-plugin-prod]

💚 Build Succeeded

• Buildkite Build
• Commit: 3ad051f

cc @robester0403

[infra-vault-gh-plugin-prod]

Pinging @elastic/integration-experience (Team:Integration-Experience)

[taylor-swanson]

This is a bit odd, especially the domain. Technically, this value is an alias not an address, but I don't have any better suggestions on where to put it. More annoyingly, I don't know how you'd tell the difference between an alias or a hostname anyway, so this is probably fine.

[vera-review-bot]

@ie-ops - 💤 This PR was approved before I picked it up, so I will leave it — automatic reviews are skipped on approved PRs. If you would still like a review, request one with a @vera-review-bot review comment (members and owners only).

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request