prelude-lml-rules 4.1.0-1 / etc / prelude-lml / ruleset / cisco-ace.rules

#FULLNAME: Cisco ACE
#VERSION: 1.0
#DESCRIPTION: The Cisco ACE (Application Control Engine) Module is a load-balancing and application-delivery solution. The rules included here were developed using a Cisco ACE 4700.

#####
#
# Copyright (C) 2012 Seguridadx <operador@seguridadx.com>
# twitter: <www.twitter.com/seguridad_x>
# All Rights Reserved
#
# This file is part of the Prelude-LML program.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2, or (at your option)
# any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License along
# with this program; if not, write to the Free Software Foundation, Inc.,
# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
#
#####

#DESCRIPTION:Health probe detection - State change to DOWN
#CATEGORY:Service Management
#LOG:Sep 25 11:53:19 x.x.x.x ACE_NAME %ACE-4-442002: Health probe CHECK_NAME detected SERVER_NAME (interface vlanXX) in serverfarm SF_NAME changed state to DOWN
regex=-442002: Health probe (\S+) detected (\S+) \(interface (\S+)\) in serverfarm (\S+) changed state to DOWN; \
 classification.text=Health probe $1; \
 classification.reference(0).origin=vendor-specific; \
 classification.reference(0).meaning=asa_id; \
 classification.reference(0).name=442002; \
 classification.reference(0).url=http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA1_7_/configuration/system/message/guide/messags.html#wp456001; \
 id=5101; \
 revision=0; \
 analyzer(0).name=ACE; \
 analyzer(0).manufacturer=Cisco; \
 analyzer(0).class=Aplication Control Engine; \
 assessment.impact.severity=high; \
 assessment.impact.type=admin; \
 assessment.impact.completion=succeeded; \
 assessment.impact.description=Health probe $1 detected $2 (interface $3) in serverfarm $4 changed state to DOWN; \
 target(0).interface=$3; \
 target(0).node.address(0).category=ipv4-addr; \
 target(0).node.address(0).address=$2; \
 last

#DESCRIPTION:Health probe detection - State change to UP
#CATEGORY:Service Management
#LOG:Sep 25 11:53:19 x.x.x.x ACE_NAME %ACE-4-442001: Health probe CHECK_NAME detected SERVER_NAME (interface vlanXX) in serverfarm SF_NAME changed state to UP
regex=-442001: Health probe (\S+) detected (\S+) \(interface (\S+)\) in serverfarm (\S+) changed state to UP; \
 classification.text=Health probe $1; \
 classification.reference(0).origin=vendor-specific; \
 classification.reference(0).meaning=asa_id; \
 classification.reference(0).name=442001; \
 classification.reference(0).url=http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA1_7_/configuration/system/message/guide/messags.html#wp456001; \
 id=5102; \
 revision=0; \
 analyzer(0).name=ACE; \
 analyzer(0).manufacturer=Cisco; \
 analyzer(0).class=Aplication Control Engine; \
 assessment.impact.severity=medium; \
 assessment.impact.type=admin; \
 assessment.impact.completion=succeeded; \
 assessment.impact.description=Health probe $1 detected $2 (interface $3) in serverfarm $4 changed state to UP; \
 target(0).interface=$3; \
 target(0).node.address(0).category=ipv4-addr; \
 target(0).node.address(0).address=$2; \
 last

#DESCRIPTION:VIP in class - State change from XXX to YYY
#CATEGORY:Service Management
#LOG:Sep 25 12:02:44 x.x.x.x ACE_NAME %ACE-4-442007: VIP in class: 'VIP_NAME' changed state from OUTOFSERVICE to INSERVICE
regex=-442007: VIP in class: '(\S+)' changed state from (\S+) to (\S+); \
 classification.text=VIP in class $1 changed state; \
 classification.reference(0).origin=vendor-specific; \
 classification.reference(0).meaning=asa_id; \
 classification.reference(0).name=442007; \
 classification.reference(0).url=http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA1_7_/configuration/system/message/guide/messags.html#wp456001; \
 id=5103; \
 revision=0; \
 analyzer(0).name=ACE; \
 analyzer(0).manufacturer=Cisco; \
 analyzer(0).class=Aplication Control Engine; \
 assessment.impact.severity=high; \
 assessment.impact.type=admin; \
 assessment.impact.completion=succeeded; \
 assessment.impact.description=VIP in class:$1 changed state to $3; \
 last

#DESCRIPTION:Serverfarm back in service
#CATEGORY:Monitoring
#LOG:Sep 25 12:02:44 x.x.x.x ACE_NAME %ACE-5-441002: Serverfarm (SF_NAME) is now back in service in policy_map (PM_NAME) --> class_map (#class_default_slb). Number of failovers = 0, number of times back in service = 0
regex=-441002: Serverfarm \((\S+)\) is now back in service; \
 classification.text=Serverfarm $1 is now back in service; \
 classification.reference(0).origin=vendor-specific; \
 classification.reference(0).meaning=asa_id; \
 classification.reference(0).name=441002; \
 classification.reference(0).url=http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA1_7_/configuration/system/message/guide/messags.html#wp456001; \
 id=5104; \
 revision=0; \
 analyzer(0).name=ACE; \
 analyzer(0).manufacturer=Cisco; \
 analyzer(0).class=Aplication Control Engine; \
 assessment.impact.severity=medium; \
 assessment.impact.type=admin; \
 assessment.impact.completion=succeeded; \
 assessment.impact.description=Serverfarm $1 is now back in service.; \
 last

#DESCRIPTION:Serverfarm failed over to backup
#CATEGORY:Monitoring
regex=-441001: Serverfarm \((\S+)\) failed over to backup; \
 classification.text=Serverfarm $1 failed; \
 classification.reference(0).origin=vendor-specific; \
 classification.reference(0).meaning=asa_id; \
 classification.reference(0).name=441001; \
 classification.reference(0).url=http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA1_7_/configuration/system/message/guide/messags.html#wp456001; \
 id=5105; \
 revision=0; \
 analyzer(0).name=ACE; \
 analyzer(0).manufacturer=Cisco; \
 analyzer(0).class=Aplication Control Engine; \
 assessment.impact.severity=high; \
 assessment.impact.type=admin; \
 assessment.impact.completion=succeeded; \
 assessment.impact.description=Serverfarm $1 failed over to backup.; \
 last

#DESCRIPTION:HA - FT Track Interface is UP
#CATEGORY:High Availability
#LOG:Sep 20 18:10:44 x.x.x.x ACE_NAME %ACE-2-727017: HA: FT Track Interface XX is UP.
regex=-727017: HA: FT Track Interface (\d+); \
 classification.text=FT Track Interfac is UP; \
 classification.reference(0).origin=vendor-specific; \
 classification.reference(0).meaning=asa_id; \
 classification.reference(0).name=727017; \
 classification.reference(0).url=http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA1_7_/configuration/system/message/guide/messags.html#wp456001; \
 id=5106; \
 revision=0; \
 analyzer(0).name=ACE; \
 analyzer(0).manufacturer=Cisco; \
 analyzer(0).class=Aplication Control Engine; \
 assessment.impact.severity=high; \
 assessment.impact.type=admin; \
 assessment.impact.completion=succeeded; \
 assessment.impact.description=HA: FT Track Interface $1 is UP.; \
 last

#DESCRIPTION:HA - FT Track Interface is DOWN
#CATEGORY:High Availability
#LOG:Sep 20 18:10:57 x.x.x.x ACE_NAME %ACE-2-727018: HA: FT Track Interface XX is DOWN.
regex=-727018: HA: FT Track Interface (\d+); \
 classification.text=FT Track Interface is DOWN; \
 classification.reference(0).origin=vendor-specific; \
 classification.reference(0).meaning=asa_id; \
 classification.reference(0).name=727018; \
 classification.reference(0).url=http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA1_7_/configuration/system/message/guide/messags.html#wp456001; \
 id=5107; \
 revision=0; \
 analyzer(0).name=ACE; \
 analyzer(0).manufacturer=Cisco; \
 analyzer(0).class=Aplication Control Engine; \
 assessment.impact.severity=high; \
 assessment.impact.type=admin; \
 assessment.impact.completion=succeeded; \
 assessment.impact.description=HA: FT Track Interface $1 is DOWN.; \
 last

#DESCRIPTION:HA - FT Group state changes
#CATEGORY:High Availability
#LOG:Sep 20 18:25:50 x.x.x.x ACE_NAME %ACE-2-727012: HA: FT Group 1 changed state to FSM_FT_STATE_STANDBY_HOT. Event: FSM_FT_EV_BULK_SYNC_STATUS
regex=-727012: HA: FT Group (\d+) changed state to (\S+); \
 classification.text=FT Group changed state $2; \
 classification.reference(0).origin=vendor-specific; \
 classification.reference(0).meaning=asa_id; \
 classification.reference(0).name=727012; \
 classification.reference(0).url=http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA1_7_/configuration/system/message/guide/messags.html#wp456001; \
 id=5108; \
 revision=0; \
 analyzer(0).name=ACE; \
 analyzer(0).manufacturer=Cisco; \
 analyzer(0).class=Aplication Control Engine; \
 assessment.impact.severity=high; \
 assessment.impact.type=admin; \
 assessment.impact.completion=succeeded; \
 assessment.impact.description= HA: FT Group $1 changed state to $2.; \
 last

#DESCRIPTION:Memory allocation Error
#CATEGORY:Monitoring
#LOG:Sep 20 18:25:50 x.x.x.x ACE_NAME %ACE-3-211001: Memory allocation Error
regex=-211001; \
 classification.text=Memory allocation Error; \
 classification.reference(0).origin=vendor-specific; \
 classification.reference(0).meaning=asa_id; \
 classification.reference(0).name=ACE-3-211001; \
 classification.reference(0).url=http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA1_7_/configuration/system/message/guide/messags.html#wp456001; \
 id=5109; \
 revision=0; \
 analyzer(0).name=ACE; \
 analyzer(0).manufacturer=Cisco; \
 analyzer(0).class=Aplication Control Engine; \
 assessment.impact.severity=high; \
 assessment.impact.type=admin; \
 assessment.impact.completion=succeeded; \
 assessment.impact.description=Explanation Failed to allocate RAM system memory.; \
 last

#DESCRIPTION:ACL resource usage beyond maximum limit
#CATEGORY:Monitoring
#LOG:Sep 20 18:25:50 x.x.x.x ACE_NAME %ACE-4-254001: ACL resource usage beyond maximum limit for context context_id. Free up some resources.
regex=-254001; \
 classification.text=ACL resource usage beyond maximum limit; \
 classification.reference(0).origin=vendor-specific; \
 classification.reference(0).meaning=asa_id; \
 classification.reference(0).name=ACE-4-254001; \
 classification.reference(0).url=http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA1_7_/configuration/system/message/guide/messags.html#wp456001; \
 id=5110; \
 revision=0; \
 analyzer(0).name=ACE; \
 analyzer(0).manufacturer=Cisco; \
 analyzer(0).class=Aplication Control Engine; \
 assessment.impact.severity=high; \
 assessment.impact.type=admin; \
 assessment.impact.completion=succeeded; \
 assessment.impact.description=Explanation This message indicates that ACL resources in use for the specified context (context_id) are above the maximum limit allowed by the resource class.; \
 last

#DESCRIPTION:Line protocol - changed state to up
#CATEGORY:Monitoring
#LOG:Sep 20 18:25:50 x.x.x.x ACE_NAME %ACE-4-411001: Line protocol on interface interface_name changed state to up
regex=-411001; \
 classification.text=Line protocol changed state to up; \
 classification.reference(0).origin=vendor-specific; \
 classification.reference(0).meaning=asa_id; \
 classification.reference(0).name=ACE-4-411001; \
 classification.reference(0).url=http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA1_7_/configuration/system/message/guide/messags.html#wp456001; \
 id=5111; \
 revision=0; \
 analyzer(0).name=ACE; \
 analyzer(0).manufacturer=Cisco; \
 analyzer(0).class=Aplication Control Engine; \
 assessment.impact.severity=low; \
 assessment.impact.type=admin; \
 assessment.impact.completion=succeeded; \
 assessment.impact.description=Explanation The status of the line protocol has changed from down to up.; \
 last

#DESCRIPTION:Line protocol - changed state to down
#CATEGORY:Monitoring
#LOG:Sep 20 18:25:50 x.x.x.x ACE_NAME %ACE-4-411002: Line protocol on interface interface_name changed state to down
regex=-411002; \
 classification.text=Line protocol changed state to down; \
 classification.reference(0).origin=vendor-specific; \
 classification.reference(0).meaning=asa_id; \
 classification.reference(0).name=ACE-4-411002; \
 classification.reference(0).url=http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA1_7_/configuration/system/message/guide/messags.html#wp456001; \
 id=5112; \
 revision=0; \
 analyzer(0).name=ACE; \
 analyzer(0).manufacturer=Cisco; \
 analyzer(0).class=Aplication Control Engine; \
 assessment.impact.severity=high; \
 assessment.impact.type=admin; \
 assessment.impact.completion=succeeded; \
 assessment.impact.description=Explanation The status of the line protocol has changed from up to down; \
 last

#DESCRIPTION:Configuration status - changed state to up
#CATEGORY:Monitoring
#LOG:Sep 20 18:25:50 x.x.x.x ACE_NAME %ACE-4-411003: Configuration status on interface interface_name changed state to up
regex=-411003; \
 classification.text=Configuration status changed state to up; \
 classification.reference(0).origin=vendor-specific; \
 classification.reference(0).meaning=asa_id; \
 classification.reference(0).name=ACE-4-411003; \
 classification.reference(0).url=http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA1_7_/configuration/system/message/guide/messags.html#wp456001; \
 id=5113; \
 revision=0; \
 analyzer(0).name=ACE; \
 analyzer(0).manufacturer=Cisco; \
 analyzer(0).class=Aplication Control Engine; \
 assessment.impact.severity=low; \
 assessment.impact.type=admin; \
 assessment.impact.completion=succeeded; \
 assessment.impact.description=Explanation The configuration status of the interface has changed from down to up; \
 last

#DESCRIPTION:Configuration status - changed state to down
#CATEGORY:Monitoring
#LOG:Sep 20 18:25:50 x.x.x.x ACE_NAME %ACE-4-411004: Configuration status on interface interface_name changed state to down
regex=-411004; \
 classification.text=Configuration status changed state to down; \
 classification.reference(0).origin=vendor-specific; \
 classification.reference(0).meaning=asa_id; \
 classification.reference(0).name=ACE-4-411004; \
 classification.reference(0).url=http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA1_7_/configuration/system/message/guide/messags.html#wp456001; \
 id=5114; \
 revision=0; \
 analyzer(0).name=ACE; \
 analyzer(0).manufacturer=Cisco; \
 analyzer(0).class=Aplication Control Engine; \
 assessment.impact.severity=high; \
 assessment.impact.type=admin; \
 assessment.impact.completion=succeeded; \
 assessment.impact.description=Explanation The configuration status of the interface has changed from down to up; \
 last

#DESCRIPTION:HA - Configuration replication will not happen
#CATEGORY:High Availability
#LOG:Sep 20 18:25:50 x.x.x.x ACE_NAME %ACE-2-727011: HA: Configuration replication for context ctx name will not happen.
regex=-727011; \
 classification.text=HA: Configuration replication will not happen; \
 classification.reference(0).origin=vendor-specific; \
 classification.reference(0).meaning=asa_id; \
 classification.reference(0).name=ACE-2-727011; \
 classification.reference(0).url=http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA1_7_/configuration/system/message/guide/messags.html#wp456001; \
 id=5115; \
 revision=0; \
 analyzer(0).name=ACE; \
 analyzer(0).manufacturer=Cisco; \
 analyzer(0).class=Aplication Control Engine; \
 assessment.impact.severity=high; \
 assessment.impact.type=admin; \
 assessment.impact.completion=succeeded; \
 assessment.impact.description=The configuration synchronization does not occur for a context. The error string indicates the reason for the failure.; \
 last

#DESCRIPTION:HA - Heartbeats from Peer become unidirectional
#CATEGORY:High Availability
#LOG:Sep 20 18:25:50 x.x.x.x ACE_NAME %ACE-2-727014: HA: Heartbeats from Peer PEER_ID have become unidirectional.
regex=-727014; \
 classification.text=HA: Heartbeats from Peer become unidirectional; \
 classification.reference(0).origin=vendor-specific; \
 classification.reference(0).meaning=asa_id; \
 classification.reference(0).name=ACE-2-727014; \
 classification.reference(0).url=http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA1_7_/configuration/system/message/guide/messags.html#wp456001; \
 id=5116; \
 revision=0; \
 analyzer(0).name=ACE; \
 analyzer(0).manufacturer=Cisco; \
 analyzer(0).class=Aplication Control Engine; \
 assessment.impact.severity=high; \
 assessment.impact.type=admin; \
 assessment.impact.completion=succeeded; \
 assessment.impact.description=Explanation Redundancy heartbeats from a peer have become unidirectional. That is, the peer cannot receive (only send) heartbeats. This problem occurs if one of the network processors has a problem.; \
 last

#DESCRIPTION:HA - FT Track track type track name is DOWN
#CATEGORY:High Availability
#LOG:Sep 20 18:25:50 x.x.x.x ACE_NAME %ACE-2-727018: HA: FT Track track type track name is DOWN.
regex=-727018; \
 classification.text=HA: FT Track track type track name is DOWN; \
 classification.reference(0).origin=vendor-specific; \
 classification.reference(0).meaning=asa_id; \
 classification.reference(0).name=ACE-2-727018; \
 classification.reference(0).url=http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA1_7_/configuration/system/message/guide/messags.html#wp456001; \
 id=5117; \
 revision=0; \
 analyzer(0).name=ACE; \
 analyzer(0).manufacturer=Cisco; \
 analyzer(0).class=Aplication Control Engine; \
 assessment.impact.severity=high; \
 assessment.impact.type=admin; \
 assessment.impact.completion=succeeded; \
 assessment.impact.description=Explanation The FT track is down. The track type variable can be one of the following: Interface, HSRP, Host.; \
 last

#DESCRIPTION:HA - Detected mismatch in heartbeat interval
#CATEGORY:High Availability
#LOG:Sep 20 18:25:50 x.x.x.x ACE_NAME %ACE-2-727015: HA: Detected mismatch in heartbeat interval from Peer peer id. Modified interval to interval.
regex=-727015; \
 classification.text=HA: Detected mismatch in heartbeat interval; \
 classification.reference(0).origin=vendor-specific; \
 classification.reference(0).meaning=asa_id; \
 classification.reference(0).name=ACE-2-727015; \
 classification.reference(0).url=http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA1_7_/configuration/system/message/guide/messags.html#wp456001; \
 id=5118; \
 revision=0; \
 analyzer(0).name=ACE; \
 analyzer(0).manufacturer=Cisco; \
 analyzer(0).class=Aplication Control Engine; \
 assessment.impact.severity=high; \
 assessment.impact.type=admin; \
 assessment.impact.completion=succeeded; \
 assessment.impact.description=Explanation The redundancy heartbeat received from one peer differs from the value of the second peer. This condition can occur when you choose to dynamically change the heartbeat interval. The modified heartbeat interval that is displayed shows the adjusted interval. This value is the greater of the two values.; \
 last

#DESCRIPTION:Deny MAC address MAC_address, possible spoof attempt
#CATEGORY:Network Security
#LOG:Sep 20 18:25:50 x.x.x.x ACE_NAME %ACE-3-322001: Deny MAC address MAC_address, possible spoof attempt on interface interface
regex=-322001; \
 classification.text=Deny MAC address MAC_address, possible spoof attempt; \
 classification.reference(0).origin=vendor-specific; \
 classification.reference(0).meaning=asa_id; \
 classification.reference(0).name=ACE-3-322001; \
 classification.reference(0).url=http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA1_7_/configuration/system/message/guide/messags.html#wp456001; \
 id=5119; \
 revision=0; \
 analyzer(0).name=ACE; \
 analyzer(0).manufacturer=Cisco; \
 analyzer(0).class=Aplication Control Engine; \
 assessment.impact.severity=high; \
 assessment.impact.type=admin; \
 assessment.impact.completion=succeeded; \
 assessment.impact.description=Explanation The ACE received a packet from the offending MAC address on the specified interface, but the source MAC address in the packet is statically bound to another interface in your configuration. This situation can be caused by either a MAC-spoofing attack or a misconfiguration.; \
 last

#DESCRIPTION:ARP inspection check failed
#CATEGORY:Monitoring
#LOG:Sep 20 18:25:50 x.x.x.x ACE_NAME %ACE-3-322002: ARP inspection check failed for arp {request|response} received from host MAC_address on interface interface. This host is advertising MAC Address MAC_address_1 for IP Address IP_address, which is {statically|dynamically} bound to MAC Address MAC_address_2.
regex=-322002; \
 classification.text=ARP inspection check failed; \
 classification.reference(0).origin=vendor-specific; \
 classification.reference(0).meaning=asa_id; \
 classification.reference(0).name=ACE-3-322002; \
 classification.reference(0).url=http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA1_7_/configuration/system/message/guide/messags.html#wp456001; \
 id=5120; \
 revision=0; \
 analyzer(0).name=ACE; \
 analyzer(0).manufacturer=Cisco; \
 analyzer(0).class=Aplication Control Engine; \
 assessment.impact.severity=high; \
 assessment.impact.type=admin; \
 assessment.impact.completion=succeeded; \
 assessment.impact.description=Explanation If ARP inspection is enabled, the ACE checks whether a new ARP entry advertised in the packet conforms to the statically configured or dynamically learned IP-MAC address binding before forwarding ARP packets. If this check fails, the ACE drops the ARP packet and generates this message. This situation can be caused by either ARP spoofing attacks in the network or an invalid configuration (IP-MAC binding).; \
 last

#DESCRIPTION:ARP inspection check failed
#CATEGORY:Monitoring
#LOG:Sep 20 18:25:50 x.x.x.x ACE_NAME %ACE-3-322003: ARP inspection check failed for arp {request|response} received from host MAC_address on interface interface. This host is advertising MAC Address MAC_address_1 for IP Address IP_address, which is not bound to any MAC Address.
regex=-322003; \
 classification.text=ARP inspection check failed; \
 classification.reference(0).origin=vendor-specific; \
 classification.reference(0).meaning=asa_id; \
 classification.reference(0).name=ACE-3-322003; \
 classification.reference(0).url=http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA1_7_/configuration/system/message/guide/messags.html#wp456001; \
 id=5121; \
 revision=0; \
 analyzer(0).name=ACE; \
 analyzer(0).manufacturer=Cisco; \
 analyzer(0).class=Aplication Control Engine; \
 assessment.impact.severity=high; \
 assessment.impact.type=admin; \
 assessment.impact.completion=succeeded; \
 assessment.impact.description=.; \
 last

#DESCRIPTION:Event on Cisco ACE
#CATEGORY:Network Security
#LOG:Sep 20 18:25:50 x.x.x.x ACE_NAME %ACE-4-400000: IDS:1000 IP Option Bad Option List from IP_address to IP_address on interface interface_name
regex=-4000(\d+): IDS:(\d+); \
 classification.text=IDS:$2 Event on Cisco ACE; \
 classification.reference(0).origin=vendor-specific; \
 classification.reference(0).meaning=asa_id; \
 classification.reference(0).name=ACE-4-4000$1; \
 classification.reference(0).url=http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA1_7_/configuration/system/message/guide/messags.html#wp456001; \
 id=5122; \
 revision=0; \
 analyzer(0).name=ACE; \
 analyzer(0).manufacturer=Cisco; \
 analyzer(0).class=Aplication Control Engine; \
 assessment.impact.severity=high; \
 assessment.impact.type=admin; \
 assessment.impact.completion=succeeded; \
 assessment.impact.description=Explanation Cisco Intrusion Detection System signature message: See original log.; \
 last

#DESCRIPTION:Received ARP collision
#CATEGORY:Network Security
#LOG:Sep 20 18:25:50 x.x.x.x ACE_NAME %ACE-4-405001: Received ARP {request | response} collision from IP_address/mac_address on interface interface_name
regex=-405001: Received ARP (\S+) collision from ([\d\.]+); \
 classification.text=Received ARP collision; \
 classification.reference(0).origin=vendor-specific; \
 classification.reference(0).meaning=asa_id; \
 classification.reference(0).name=ACE-4-405001; \
 classification.reference(0).url=http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA1_7_/configuration/system/message/guide/messags.html#wp456001; \
 id=5123; \
 revision=0; \
 analyzer(0).name=ACE; \
 analyzer(0).manufacturer=Cisco; \
 analyzer(0).class=Aplication Control Engine; \
 assessment.impact.severity=high; \
 assessment.impact.type=admin; \
 assessment.impact.completion=succeeded; \
 assessment.impact.description=Explanation The ACE received an ARP packet, and the MAC address in the packet differs from the ARP cache entry.; \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=$2; \
 source(0).user.category=os-device; \
 last

#DESCRIPTION:Dropped UDP DNS
#CATEGORY:Packet Filtering
#LOG:Sep 20 18:25:50 x.x.x.x ACE_NAME %ACE-4-410001: Dropped UDP DNS packet_type from source_interface:source_address/source_port to dest_interface:dest_address/dest_port; error_length_type length length bytes exceeds max_length_type limit of maximum_length bytes
regex=-410001; \
 classification.text=Dropped UDP DNS; \
 classification.reference(0).origin=vendor-specific; \
 classification.reference(0).meaning=asa_id; \
 classification.reference(0).name=ACE-4-410001; \
 classification.reference(0).url=http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA1_7_/configuration/system/message/guide/messags.html#wp456001; \
 id=5124; \
 revision=0; \
 analyzer(0).name=ACE; \
 analyzer(0).manufacturer=Cisco; \
 analyzer(0).class=Aplication Control Engine; \
 assessment.impact.severity=high; \
 assessment.impact.type=admin; \
 assessment.impact.completion=succeeded; \
 assessment.impact.description=Explanation The domain-name length exceeds 255 bytes in a UDP DNS packet. (See RFC 1035 section 3.1.); \
 last

#DESCRIPTION:MAC address moved from interface
#CATEGORY:Monitoring
#LOG:Sep 20 18:25:50 x.x.x.x ACE_NAME %ACE-4-412001: MAC MAC_address moved from interface_1 to interface_2
regex=-412001; \
 classification.text=MAC address moved from interface; \
 classification.reference(0).origin=vendor-specific; \
 classification.reference(0).meaning=asa_id; \
 classification.reference(0).name=ACE-4-412001; \
 classification.reference(0).url=http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA1_7_/configuration/system/message/guide/messags.html#wp456001; \
 id=5125; \
 revision=0; \
 analyzer(0).name=ACE; \
 analyzer(0).manufacturer=Cisco; \
 analyzer(0).class=Aplication Control Engine; \
 assessment.impact.severity=high; \
 assessment.impact.type=admin; \
 assessment.impact.completion=succeeded; \
 assessment.impact.description=Explanation The ACE detects that a host was moved from one module interface to another. In a transparent ACE, mapping between the host (MAC) and the ACE port is maintained in a Layer 2 forwarding table. The table dynamically binds packet source MAC addresses to an ACE port. When movement of a host from one interface to another interface is detected during this binding process, this error message is generated.; \
 last

#DESCRIPTION:User executed command
#CATEGORY:Command Execution
#LOG:Dec 13 17:58:27 x.x.x.x xxx %ACE-5-111008: User 'xx' executed the 'no set tcp timeout embryonic 30' command.
regex=-111008; \
 classification.text=User $1 executed command; \
 classification.reference(0).origin=vendor-specific; \
 classification.reference(0).meaning=asa_id; \
 classification.reference(0).name=ACE-5-111008; \
 classification.reference(0).url=http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA1_7_/configuration/system/message/guide/messags.html#wp456001; \
 id=5126; \
 revision=0; \
 analyzer(0).name=ACE; \
 analyzer(0).manufacturer=Cisco; \
 analyzer(0).class=Aplication Control Engine; \
 assessment.impact.severity=medium; \
 assessment.impact.type=admin; \
 assessment.impact.completion=succeeded; \
 assessment.impact.description=User exceuted a configuration command.; \
 last