Cisco Decoders

[Facu Basgall]

Hi
I have in my environment some old Cisco devices which I cannot update the firmware so the logs coming from these devices do not arrive in the form "%SYS-5-CONFIG_I:" but the severity comes by letters (W, I, C, ...etc).
Are there any decoders already created for such a case? I am trying to do it manually
Thanks

[Santiago David Vendramini]

Hi! Sorry for the delay! I'm reviewing this, I will answer you ASAP!

[Santiago David Vendramini]

Hello, there are several decoders related to cisco. You can check them here:
https://github.com/wazuh/wazuh/blob/v4.5.2/ruleset/decoders/0060-cisco-estreamer_decoders.xml
https://github.com/wazuh/wazuh/blob/v4.5.2/ruleset/decoders/0062-cisco-ftd_decoders.xml
https://github.com/wazuh/wazuh/blob/v4.5.2/ruleset/decoders/0064-cisco-asa_decoders.xml
https://github.com/wazuh/wazuh/blob/v4.5.2/ruleset/decoders/0065-cisco-ios_decoders.xml
https://github.com/wazuh/wazuh/blob/v4.5.2/ruleset/decoders/0070-cisco-vpn_decoders.xml

You can also use a sample log to test it with the wazuh-logtest tool found in /var/ossec/bin/wazuh-logtest. Here you can see an example of how to use it:
https://documentation.wazuh.com/current/user-manual/ruleset/testing.html#using-the-wazuh-dashboard-and-the-command-line-tool

In case no decoder match with the log, you can create custom decoders, for which you can follow this documentation https://documentation.wazuh.com/current/user-manual/ruleset/custom.html.

let me know if this solves your need.

Best Regards.