Add Cisco FTD, FTD-session and IOS/NX-OS decoder integrations#104
Merged
Conversation
Denied Cisco FTD traffic was reaching the manager but not alerting, so it was visible only in the archives. Three gaps in the stock decoders caused this: - Some FTD builds emit a "%FTD-session-" message prefix that the stock parent prematch rejects, so those events were never decoded. - Interface names containing hyphens (LAN-INT, DMZ-INT) are not matched by a \w+ interface pattern, breaking extraction for TCP and UDP denies. - ICMP denies carry no port and report type/code instead, so they do not fit the port-bearing pattern at all. This adds a cisco-ftd-session parent for the alternate prefix, plus TCP/UDP and ICMP deny decoders for both prefixes, matching interfaces with [^:\s]+ and addresses with [^/\s]+ so ports are always captured separately. Also adds Cisco NX-OS and IOS-XE decoders for login results, PAM authentication failures for unknown users (which carry the source address and so support brute-force correlation), and account management: password change, role/group assignment, and account expiry change. The stock cisco-ios-login and cisco-ios-auth prematches match the NX-OS wordings but their regexes target the classic IOS formats, so these events previously fell through to cisco-ios-default with only facility, severity and mnemonic extracted. Because Wazuh commits the first child decoder whose prematch matches even when its regex then fails, placement is load-bearing here. The README documents the constraint and two deployment methods, one straightforward and one upgrade-safe. Rules occupy the 110000 block. All sample logs, addresses, hostnames and usernames are anonymized, using the RFC 5737 documentation ranges.
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a new Wazuh integration (integrations/cisco_ftd_nxos_decoders/) to improve decoding and alerting for (1) Cisco FTD ACL deny syslogs (106023), including the %FTD-session- prefix and ICMP type/code formats, and (2) Cisco NX-OS/IOS-XE SYSTEM_MSG authentication and user-administration events, preserving key fields like dstuser and srcip for correlation.
Changes:
- Added FTD 106023 deny decoders (TCP/UDP + ICMP) and associated alerting rules, including a frequency rule for repeated denies.
- Added NX-OS/IOS-XE
SYSTEM_MSGauth/account-management decoders and associated rules, including a frequency rule for repeated PAM illegal-user failures bysrcip. - Added integration documentation and sample logs to validate decoder placement and expected extracted fields.
Reviewed changes
Copilot reviewed 5 out of 6 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| integrations/cisco_ftd_nxos_decoders/ruleset/decoders/cisco_ftd_deny_decoders.xml | New decoders for FTD 106023 denies, including %FTD-session- prefix and ICMP type/code handling. |
| integrations/cisco_ftd_nxos_decoders/ruleset/decoders/cisco_nxos_auth_decoders.xml | New decoders for NX-OS/IOS-XE SYSTEM_MSG login/auth/account-management events (including PAM illegal-user srcip). |
| integrations/cisco_ftd_nxos_decoders/ruleset/rules/cisco_ftd_deny_rules.xml | New alerting rules for FTD denies plus repeated-deny frequency correlation. |
| integrations/cisco_ftd_nxos_decoders/ruleset/rules/cisco_nxos_auth_rules.xml | New alerting rules for NX-OS auth/account changes plus repeated-failure frequency correlation. |
| integrations/cisco_ftd_nxos_decoders/sample-logs.log | Sample log lines for wazuh-logtest validation of supported formats. |
| integrations/cisco_ftd_nxos_decoders/README.md | Installation guidance emphasizing decoder ordering constraints, field reference, testing, and troubleshooting. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Split cisco_ftd_nxos_decoders into self-contained cisco_ftd, cisco_ftd_session and cisco_ios integrations, each shipping full drop-in decoder replacements (stock set + extensions). Sanitize sample logs to RFC 5737 ranges, document dashboard + backend install with the exclude-decoder/rules-then-re-include workflow, and merge the IOS interactive-session rules.
leonfullxr
changed the title
leonfullxr
marked this pull request as ready for review
July 21, 2026 08:16
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Splits the Cisco decoder work into three self-contained integrations, each extending part of the stock Wazuh Cisco ruleset that does not fully handle its source:
cisco_ftd- access-list denies (message 106023), standard%FTD-prefix.cisco_ftd_session- the same denies with the%FTD-session-prefix that some FTD builds emit, which the stock parent decoder rejects.cisco_ios- Cisco NX-OS / IOS-XESYSTEM_MSGauthentication and user-administration events, plus IOS/IOS-XE interactive VTY login/logout and interface state.The gaps addressed: interface names with hyphens (
LAN-INT) that\w+cannot match, ICMP denies that carry(type, code)instead of a port, the access-group that dropped the traffic, the%FTD-session-prefix, and NX-OS login/PAM/account events whose bodies differ from the classic IOS formats (the PAM source IP that brute-force correlation needs was being lost).Contents
Each folder ships
README.md,sample-logs.log,ruleset/decoders/and (where applicable)ruleset/rules/:cisco_ftd- full drop-in replacement of the stock FTD decoder file withcisco-ftd-acl-deny/-icmpmerged in above the generic children. No rules; the stock FTD rules alert on the improved fields.cisco_ftd_session- newcisco-ftd-sessionparent + TCP/UDP and ICMP deny decoders. The decoders emitproduct.name=FTD, so changing the stock FTD base rule (91500) fromdecoded_asto aproduct.namefield match lets the whole stock FTD ruleset alert on both prefixes. No rules shipped.cisco_ios- full drop-in replacement of the stock IOS decoder file with sixcisco-nxos-*decoders merged abovecisco-ios-default, plus a rules file (NX-OS auth110020-110028, IOS interactive/interface110029-110031).