Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Gigamon SSL Session Syslog #2409

Closed
cchansk opened this issue Apr 18, 2024 · 2 comments
Closed

Gigamon SSL Session Syslog #2409

cchansk opened this issue Apr 18, 2024 · 2 comments
Assignees

Comments

@cchansk
Copy link

cchansk commented Apr 18, 2024

Was the issue replicated by support?
n/a
What is the sc4s version ?
2.49.8
Is there a pcap available?
Can be made available
Is the issue related to the environment of the customer or Software related issue?
No
Is it related to Data loss, please explain ?
Protocol? Hardware specs?
No
Last chance index/Fallback index?
No
Is the issue related to local customization?
No
Do we have all the default indexes created?
Yes
Describe the bug
This issue was reported in #1833, but it was recently closed. However, the issue still exists and never worked on.

Recently, after restarting the service and updating to a new version (2.35.0), I started seeing having certain issues with my Gigamon SSL session logs where 8 different devices with different source IPs are showing up with host=sep. They host field used to show up with the source IP. I tried modifying the host.csv file and adding the SC4S_USE_REVERSE_DNS variable to see if I can manually change it to a name, but had no luck. Wanted to see if anyone knows why that'd be happening.

Below is what some events look like:

Wed CEF:0|Gigamon|HC1|5.15.01|1002|SESSION_DECRYPT|6|src=10.40.24.148 dst=138.113.112.18 spt=53699 dpt=443 vlan=100 dhost=newseu.cgtn.com cs1Label=Certificate Subject cs1=*.cgtn.com cs2Label=Certificate Issuer cs2=Zscaler Intermediate Root CA (zscloud.net) (t) cs3Label=Cipher Suite cs3=TLS_AES_256_GCM_SHA384 proto=TLS/SSL outbound GigamonIsslTLSVersion=TLSv1.3 GigamonIsslCertStatus=Valid

Wed CEF:0|Gigamon|HC1|5.15.01|1001|SESSION_NO_DECRYPT|6|src=10.40.200.62 dst=20.106.86.13 spt=63240 dpt=443 vlan=100 dhost=settings-win.data.microsoft.com proto=TLS/SSL reason=Policy
giga.txt

To Reproduce
Send Gigamon SSL traffic logs to SC4S

@rjha-splunk
Copy link
Collaborator

Please do following as workaround to fix this :

Check the sourceip of the device from the splunk UI that will be sourceIP sc4s_fromhostip and check as sc4s_vendor , we will be using both fields.

Create host.csv entry with the value of SOURCEIP, for example say the IP there is 1.1.1.1 and the host value we want is gigamon.x.com

1.1.1.1,HOST,gigamon.x.com

Create an app_parser in the path /opt/sc4s/local/config/app_parsers/new_cef.conf

block parser app-dest-new-cef() {
   channel {
       parser {
          add-contextual-data(
          selector("${SOURCEIP}"),
          database("conf.d/local/context/host.csv")
          );
         };
     };
};

application app-dest-new-cef[sc4s-finalfilter] {
       filter {
           tags(".source.s_DEFAULT") and
           "${fields.sc4s_vendor}" eq "Gigamon";
             };
       parser {
            app-dest-new-cef();
             };
          };

Restart SC4S and it will work , it will update the host field from host.csv file

@rjha-splunk
Copy link
Collaborator

Please reopen the issue if you need any further assistance on the same.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants