[cisco_asa] Fix 113015 grok to handle missing user IP.

[ie-ops]

Executive summary

The grok processor for Cisco ASA message 113015 only had a pattern that required a trailing user IP = <IP> field. When a device emits a 113015 message without a user IP (e.g., local-database auth failures), the processor failed to match and logged a MISSING_CASE error. The fix adds a second, fallback grok pattern for 113015 that captures the username via %{NOTSPACE} and terminates without requiring the IP field, allowing these events to parse successfully. The unused USERNAME and CISCO_USER custom pattern definitions that were scoped to this grok block were also removed.

Proposed commit message

[cisco_asa] Fix 113015 grok to handle missing user IP.

Root cause

The parse_113015 grok processor has only one pattern that requires a trailing : user IP = <ip> segment, but Cisco ASA omits that field when authentication originates from a local/console context with no client IP, causing the processor to fail for that valid message variant.

Approach

Add a second grok pattern to the parse_113015 processor that matches the no-IP variant of the 113015 message (i.e., the message ends after user = <name> with no : user IP = ... suffix). The existing with-IP pattern stays first; the new no-IP pattern is appended second so grok tries the more-specific variant first. A new test event using the sanitized log line is added to test-additional-messages.log with its expected output entry.

Implementation

1. Step 1: In packages/cisco_asa/data_stream/log/elasticsearch/ingest_pipeline/default.yml, locate the parse_113015 grok processor at line 464. Append a second pattern under patterns: after the existing with-IP pattern: "AAA user authentication Rejected(%{SPACE})?: reason = %{REASON:_temp_.cisco.rejection_reason}(%{SPACE})?: local database(%{SPACE})?: [Uu]ser = %{CISCO_USER:source.user.name}". Keep REASON and CISCO_USER pattern_definitions identical to the existing block.
2. Step 2: Append the sanitized test event to packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-additional-messages.log: <166>Jun 27 2026 10:00:24: %ASA-6-113015: AAA user authentication Rejected : reason = User was not found : local database : user = alice.johnson
3. Step 3: Add a corresponding expected-output JSON object to packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-additional-messages.log-expected.json mirroring the structure of existing 113015 entries but without source.address/source.ip fields, with cisco.asa.rejection_reason: "User was not found", source.user.name: "alice.johnson", and no entry in related.ip.
4. Step 4: Add a changelog entry to packages/cisco_asa/changelog.yml as a new version 2.45.3 with type bugfix and description Fix grok pattern for message 113015 to handle the no-IP variant where user IP is absent.
5. Step 5: Run elastic-package test pipeline for the cisco_asa package to confirm the new event parses correctly and the existing 113015 with-IP events continue to pass.

Pipeline changes

• Add second pattern to the parse_113015 grok processor (line 470): "AAA user authentication Rejected(%{SPACE})?: reason = %{REASON:_temp_.cisco.rejection_reason}(%{SPACE})?: local database(%{SPACE})?: [Uu]ser = %{CISCO_USER:source.user.name}" — placed after the existing with-IP pattern so grok tries specific first.

Field / mapping changes

—

Sanitized error message

Processor 'grok' with tag 'parse_113015' in pipeline 'logs-cisco_asa.log-default' failed with message '[on_failure_message]'

Sanitized log (event_sanitized excerpt)

<166>Jun 27 2026 10:00:24: %ASA-6-113015: AAA user authentication Rejected : reason = User was not found : local database : user = alice.johnson

Reviewer concerns

• The fallback pattern uses %{NOTSPACE:source.user.name} rather than the more permissive %{DATA:...} used by the original pattern; if any username legitimately contains spaces this would silently mismatch and fall through, though that is extremely unlikely for AAA usernames.
• USERNAME and CISCO_USER were removed from the pattern_definitions block. The diff confirms neither was referenced in the original 113015 patterns (the first pattern used bare %{DATA} and %{IP}), so this is safe, but a reviewer should confirm they are not referenced anywhere else in this specific grok processor block.
• The changelog link field points to PR Initial structure #1 which is a placeholder; should be updated to the real PR number before merge.

Self-review findings

—

Risk and classification

• Plan risk level: low
• Tags: pipeline, processors, test-fixture, ingest
• Impact: medium

Links

• Issue: (no issue number)
• Issue title: cisco_asa.log [MISSING_CASE]: Processor 'grok' with tag 'parse_113015' in pipeline 'logs-cisco_asa.log…
• Pipeline case: 83c5760ccc22127f

[github-actions]

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[taylor-swanson]

/test

[taylor-swanson]

/test

[taylor-swanson]

/test

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

Package cisco_asa 👍(0) 💚(0) 💔(1)

Expand to view

Data stream	Previous EPS	New EPS	Diff (%)	Result
log	1050.42	812.35	-238.07 (-22.66%)	💔

To see the full report comment with /test benchmark fullreport

[infra-vault-gh-plugin-prod]

Pinging @elastic/integration-experience (Team:Integration-Experience)

[vera-review-bot]

🟢 No issues across the latest commits 236af7c.

Review summary

Issues found across earlier commits d5cc7b5 — 1 medium

• 🟡 The new USERPART definition is [^:]*?, which matches the empty string, so a 113015 line ending in user = sets source.user.name to "" instead of failing to parse. Make it one-or-more ([^:]+?) so an absent username falls through to the grok on_failure path. (link) (Resolved)

Issues found across earlier commits 0cf1c34 — 1 high

• 🟠 The new no-IP fallback pattern captures source.user.name with an unbounded %{DATA}, so any 113015 line the first pattern rejects is silently mis-parsed with the whole ' : user IP = ...' tail stored as the username. Constrain the capture so it cannot cross a ':' and allow trailing whitespace on the IP pattern. (link) (Resolved)

Issues found across earlier commits 21db256 — 1 medium

• 🟡 The new no-IP 113015 pattern captures the username with %{NOTSPACE}, so a username containing a space is silently truncated instead of failing (link) (Resolved)

A new commit triggers another review — at most once every 15 minutes. I skip the PR while it's approved or has merge conflicts.

🤖 AI-Generated Review | Vera Review Bot - v0.2.6 | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.

[ilyannn]

LGTM, good call on names with spaces (we even have ;;alice-johnson(test user) username in the tests)

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request

[elastic-vault-github-plugin-prod]

✅ All changelog entries have the correct PR link.

[infra-vault-gh-plugin-prod]

💚 Build Succeeded

• Buildkite Build
• Commit: 95be839

History

• 💚 Build #47826 succeeded 236af7c
• 💚 Build #47823 succeeded d5cc7b5
• 💚 Build #47808 succeeded 0cf1c34
• 💚 Build #47757 succeeded 21db256
• 💔 Build #47755 failed 21db256
• 💔 Build #47746 failed 21db256

cc @taylor-swanson

[elastic-vault-github-plugin-prod]

Package cisco_asa - 2.45.13 containing this change is available at https://epr.elastic.co/package/cisco_asa/2.45.13/