You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@metron.apache.org by ce...@apache.org on 2017/03/27 13:38:48 UTC
[1/3] incubator-metron git commit: METRON-765: Add GUID to messages
(iraghumitra via cestella) closes apache/incubator-metron#483
Repository: incubator-metron
Updated Branches:
refs/heads/master 340e92383 -> 27b0d6e31
http://git-wip-us.apache.org/repos/asf/incubator-metron/blob/27b0d6e3/metron-platform/metron-integration-test/src/main/sample/data/bro/parsed/BroExampleParsed
----------------------------------------------------------------------
diff --git a/metron-platform/metron-integration-test/src/main/sample/data/bro/parsed/BroExampleParsed b/metron-platform/metron-integration-test/src/main/sample/data/bro/parsed/BroExampleParsed
index 952c315..d277520 100644
--- a/metron-platform/metron-integration-test/src/main/sample/data/bro/parsed/BroExampleParsed
+++ b/metron-platform/metron-integration-test/src/main/sample/data/bro/parsed/BroExampleParsed
@@ -1,10 +1,10 @@
-{"bro_timestamp":"1402307733.473","status_code":200,"method":"GET","ip_dst_port":80,"request_body_len":0,"uri":"\/","tags":[],"source.type":"bro","uid":"CTo78A11g7CYbbOHvj","resp_mime_types":["text\/html"],"trans_depth":1,"protocol":"http","original_string":"HTTP | id.orig_p:58808 status_code:200 method:GET request_body_len:0 id.resp_p:80 uri:\/ tags:[] uid:CTo78A11g7CYbbOHvj resp_mime_types:[\"text\\\/html\"] trans_depth:1 host:www.cisco.com status_msg:OK id.orig_h:192.249.113.37 response_body_len:25523 user_agent:curl\/7.22.0 (x86_64-pc-linux-gnu) libcurl\/7.22.0 OpenSSL\/1.0.1 zlib\/1.2.3.4 libidn\/1.23 librtmp\/2.3 ts:1402307733.473 id.resp_h:72.163.4.161 resp_fuids:[\"FJDyMC15lxUn5ngPfd\"]","ip_dst_addr":"72.163.4.161","ip_src_port":58808,"host":"www.cisco.com","status_msg":"OK","response_body_len":25523,"ip_src_addr":"192.249.113.37","user_agent":"curl\/7.22.0 (x86_64-pc-linux-gnu) libcurl\/7.22.0 OpenSSL\/1.0.1 zlib\/1.2.3.4 libidn\/1.23 librtmp\/2.3","resp_fuids":["FJDyMC15l
xUn5ngPfd"],"timestamp":1402307733473}
-{"TTLs":[3600.0,289.0,14.0],"qclass_name":"C_INTERNET","bro_timestamp":"1402308259.609","qtype_name":"AAAA","ip_dst_port":53,"qtype":28,"rejected":false,"answers":["www.cisco.com.akadns.net","origin-www.cisco.com","2001:420:1201:2::a"],"trans_id":62418,"uid":"CuJT272SKaJSuqO0Ia","protocol":"dns","original_string":"DNS | AA:true TTLs:[3600.0,289.0,14.0] qclass_name:C_INTERNET id.orig_p:33976 qtype_name:AAAA qtype:28 rejected:false id.resp_p:53 query:www.cisco.com answers:[\"www.cisco.com.akadns.net\",\"origin-www.cisco.com\",\"2001:420:1201:2::a\"] trans_id:62418 rcode:0 rcode_name:NOERROR TC:false RA:true uid:CuJT272SKaJSuqO0Ia RD:true proto:udp id.orig_h:10.122.196.204 Z:0 qclass:1 ts:1402308259.609 id.resp_h:144.254.71.184","ip_dst_addr":"144.254.71.184","Z":0,"ip_src_addr":"10.122.196.204","qclass":1,"timestamp":1402308259609,"AA":true,"query":"www.cisco.com","rcode":0,"rcode_name":"NOERROR","TC":false,"RA":true,"source.type":"bro","RD":true,"ip_src_port":33976,"proto":"udp"}
-{"bro_timestamp":"1402307733.473","status_code":200,"method":"GET","ip_dst_port":80,"request_body_len":0,"uri":"\/","tags":[],"source.type":"bro","uid":"KIRAN","resp_mime_types":["text\/html"],"trans_depth":1,"protocol":"http","original_string":"HTTP | id.orig_p:58808 status_code:200 method:GET request_body_len:0 id.resp_p:80 uri:\/ tags:[] uid:KIRAN resp_mime_types:[\"text\\\/html\"] trans_depth:1 host:www.cisco.com status_msg:OK id.orig_h:10.122.196.204 response_body_len:25523 user_agent:curl\/7.22.0 (x86_64-pc-linux-gnu) libcurl\/7.22.0 OpenSSL\/1.0.1 zlib\/1.2.3.4 libidn\/1.23 librtmp\/2.3 ts:1402307733.473 id.resp_h:72.163.4.161 resp_fuids:[\"FJDyMC15lxUn5ngPfd\"]","ip_dst_addr":"72.163.4.161","ip_src_port":58808,"host":"www.cisco.com","status_msg":"OK","response_body_len":25523,"ip_src_addr":"10.122.196.204","user_agent":"curl\/7.22.0 (x86_64-pc-linux-gnu) libcurl\/7.22.0 OpenSSL\/1.0.1 zlib\/1.2.3.4 libidn\/1.23 librtmp\/2.3","resp_fuids":["FJDyMC15lxUn5ngPfd"],"timestamp":14
02307733473}
-{"bro_timestamp":"1402307733.473","status_code":200,"method":"GET","ip_dst_port":80,"request_body_len":0,"uri":"\/","tags":[],"source.type":"bro","uid":"KIRAN12312312","resp_mime_types":["text\/html"],"trans_depth":1,"protocol":"http","original_string":"HTTP | id.orig_p:58808 status_code:200 method:GET request_body_len:0 id.resp_p:80 uri:\/ tags:[] uid:KIRAN12312312 resp_mime_types:[\"text\\\/html\"] trans_depth:1 host:www.cisco.com status_msg:OK id.orig_h:192.249.113.37 response_body_len:25523 user_agent:curl\/7.22.0 (x86_64-pc-linux-gnu) libcurl\/7.22.0 OpenSSL\/1.0.1 zlib\/1.2.3.4 libidn\/1.23 librtmp\/2.3 ts:1402307733.473 id.resp_h:72.163.4.161 resp_fuids:[\"FJDyMC15lxUn5ngPfd\"]","ip_dst_addr":"72.163.4.161","ip_src_port":58808,"host":"www.cisco.com","status_msg":"OK","response_body_len":25523,"ip_src_addr":"192.249.113.37","user_agent":"curl\/7.22.0 (x86_64-pc-linux-gnu) libcurl\/7.22.0 OpenSSL\/1.0.1 zlib\/1.2.3.4 libidn\/1.23 librtmp\/2.3","resp_fuids":["FJDyMC15lxUn5ngPfd"
],"timestamp":1402307733473}
-{"bro_timestamp":"1402307733.473","status_code":200,"method":"GET","ip_dst_port":80,"request_body_len":0,"uri":"\/","tags":[],"source.type":"bro","uid":"KIRAN12312312","resp_mime_types":["text\/html"],"trans_depth":1,"protocol":"http","original_string":"HTTP | id.orig_p:58808 status_code:200 method:GET request_body_len:0 id.resp_p:80 uri:\/ tags:[] uid:KIRAN12312312 resp_mime_types:[\"text\\\/html\"] trans_depth:1 host:www.cisco.com status_msg:OK id.orig_h:192.249.113.37 response_body_len:25523 user_agent:curl\/7.22.0 (x86_64-pc-linux-gnu) libcurl\/7.22.0 OpenSSL\/1.0.1 zlib\/1.2.3.4 libidn\/1.23 librtmp\/2.3 ts:1402307733.473 id.resp_h:72.163.4.161 resp_fuids:[\"FJDyMC15lxUn5ngPfd\"]","ip_dst_addr":"72.163.4.161","ip_src_port":58808,"host":"www.cisco.com","status_msg":"OK","response_body_len":25523,"ip_src_addr":"192.249.113.37","user_agent":"curl\/7.22.0 (x86_64-pc-linux-gnu) libcurl\/7.22.0 OpenSSL\/1.0.1 zlib\/1.2.3.4 libidn\/1.23 librtmp\/2.3","resp_fuids":["FJDyMC15lxUn5ngPfd"
],"timestamp":1402307733473}
-{"bro_timestamp":"1402307733.473","status_code":200,"method":"GET","ip_dst_port":80,"request_body_len":0,"uri":"\/","tags":[],"source.type":"bro","uid":"CTo78A11g7CYbbOHvj","resp_mime_types":["text\/html"],"trans_depth":1,"protocol":"http","original_string":"HTTP | id.orig_p:58808 status_code:200 method:GET request_body_len:0 id.resp_p:80 uri:\/ tags:[] uid:CTo78A11g7CYbbOHvj resp_mime_types:[\"text\\\/html\"] trans_depth:1 host:gabacentre.pw status_msg:OK id.orig_h:10.122.196.204 response_body_len:25523 email:abullis@mail.csuchico.edu user_agent:curl\/7.22.0 (x86_64-pc-linux-gnu) libcurl\/7.22.0 OpenSSL\/1.0.1 zlib\/1.2.3.4 libidn\/1.23 librtmp\/2.3 ts:1402307733.473 id.resp_h:72.163.4.161 resp_fuids:[\"FJDyMC15lxUn5ngPfd\"]","ip_dst_addr":"72.163.4.161","ip_src_port":58808,"host":"gabacentre.pw","status_msg":"OK","response_body_len":25523,"ip_src_addr":"10.122.196.204","email":"abullis@mail.csuchico.edu","user_agent":"curl\/7.22.0 (x86_64-pc-linux-gnu) libcurl\/7.22.0 OpenSSL\/1.0
.1 zlib\/1.2.3.4 libidn\/1.23 librtmp\/2.3","resp_fuids":["FJDyMC15lxUn5ngPfd"],"timestamp":1402307733473}
-{"TTLs":[3600.0,289.0,14.0],"qclass_name":"C_INTERNET","bro_timestamp":"1402308259.609","qtype_name":"AAAA","ip_dst_port":53,"qtype":28,"rejected":false,"answers":["gabacentre.pw","www.cisco.com.akadns.net","origin-www.cisco.com","2001:420:1201:2::a"],"trans_id":62418,"uid":"CYbbOHvj","protocol":"dns","original_string":"DNS | AA:true TTLs:[3600.0,289.0,14.0] qclass_name:C_INTERNET id.orig_p:33976 qtype_name:AAAA qtype:28 rejected:false id.resp_p:53 query:www.cisco.com answers:[\"gabacentre.pw\",\"www.cisco.com.akadns.net\",\"origin-www.cisco.com\",\"2001:420:1201:2::a\"] trans_id:62418 rcode:0 rcode_name:NOERROR TC:false RA:true uid:CYbbOHvj RD:true proto:udp id.orig_h:93.188.160.43 Z:0 qclass:1 ts:1402308259.609 id.resp_h:144.254.71.184","ip_dst_addr":"144.254.71.184","Z":0,"ip_src_addr":"93.188.160.43","qclass":1,"timestamp":1402308259609,"AA":true,"query":"www.cisco.com","rcode":0,"rcode_name":"NOERROR","TC":false,"RA":true,"source.type":"bro","RD":true,"ip_src_port":33976,"proto
":"udp"}
-{"bro_timestamp":"1402307733.473","status_code":200,"method":"GET","ip_dst_port":80,"request_body_len":0,"uri":"\/","tags":[],"source.type":"bro","uid":"CTo78A11g7CYbbOHvj","resp_mime_types":["text\/html"],"trans_depth":1,"protocol":"http","original_string":"HTTP | id.orig_p:58808 status_code:200 method:GET request_body_len:0 id.resp_p:80 uri:\/ tags:[] uid:CTo78A11g7CYbbOHvj resp_mime_types:[\"text\\\/html\"] trans_depth:1 host:www.cisco.com status_msg:OK id.orig_h:192.249.113.37 response_body_len:25523 user_agent:curl\/7.22.0 (x86_64-pc-linux-gnu) libcurl\/7.22.0 OpenSSL\/1.0.1 zlib\/1.2.3.4 libidn\/1.23 librtmp\/2.3 ts:1402307733.473 id.resp_h:72.163.4.161 resp_fuids:[\"FJDyMC15lxUn5ngPfd\"]","ip_dst_addr":"72.163.4.161","ip_src_port":58808,"host":"www.cisco.com","status_msg":"OK","response_body_len":25523,"ip_src_addr":"192.249.113.37","user_agent":"curl\/7.22.0 (x86_64-pc-linux-gnu) libcurl\/7.22.0 OpenSSL\/1.0.1 zlib\/1.2.3.4 libidn\/1.23 librtmp\/2.3","resp_fuids":["FJDyMC15l
xUn5ngPfd"],"timestamp":1402307733473}
-{"TTLs":[3600.0,289.0,14.0],"qclass_name":"C_INTERNET","bro_timestamp":"1402308259.609","qtype_name":"AAAA","ip_dst_port":53,"qtype":28,"rejected":false,"answers":["www.cisco.com.akadns.net","origin-www.cisco.com","2001:420:1201:2::a"],"trans_id":62418,"uid":"CuJT272SKaJSuqO0Ia","protocol":"dns","original_string":"DNS | AA:true TTLs:[3600.0,289.0,14.0] qclass_name:C_INTERNET id.orig_p:33976 qtype_name:AAAA qtype:28 rejected:false id.resp_p:53 query:www.cisco.com answers:[\"www.cisco.com.akadns.net\",\"origin-www.cisco.com\",\"2001:420:1201:2::a\"] trans_id:62418 rcode:0 rcode_name:NOERROR TC:false RA:true uid:CuJT272SKaJSuqO0Ia RD:true proto:udp id.orig_h:10.122.196.204 Z:0 qclass:1 ts:1402308259.609 id.resp_h:144.254.71.184","ip_dst_addr":"144.254.71.184","Z":0,"ip_src_addr":"10.122.196.204","qclass":1,"timestamp":1402308259609,"AA":true,"query":"www.cisco.com","rcode":0,"rcode_name":"NOERROR","TC":false,"RA":true,"source.type":"bro","RD":true,"ip_src_port":33976,"proto":"udp"}
-{"bro_timestamp":"1402307733.473","status_code":200,"method":"GET","ip_dst_port":80,"request_body_len":0,"uri":"\/","tags":[],"source.type":"bro","uid":"KIRAN","resp_mime_types":["text\/html"],"trans_depth":1,"protocol":"http","original_string":"HTTP | id.orig_p:58808 status_code:200 method:GET request_body_len:0 id.resp_p:80 uri:\/ tags:[] uid:KIRAN resp_mime_types:[\"text\\\/html\"] trans_depth:1 host:www.cisco.com status_msg:OK id.orig_h:10.122.196.204 response_body_len:25523 user_agent:curl\/7.22.0 (x86_64-pc-linux-gnu) libcurl\/7.22.0 OpenSSL\/1.0.1 zlib\/1.2.3.4 libidn\/1.23 librtmp\/2.3 ts:1402307733.473 id.resp_h:72.163.4.161 resp_fuids:[\"FJDyMC15lxUn5ngPfd\"]","ip_dst_addr":"72.163.4.161","ip_src_port":58808,"host":"www.cisco.com","status_msg":"OK","response_body_len":25523,"ip_src_addr":"10.122.196.204","user_agent":"curl\/7.22.0 (x86_64-pc-linux-gnu) libcurl\/7.22.0 OpenSSL\/1.0.1 zlib\/1.2.3.4 libidn\/1.23 librtmp\/2.3","resp_fuids":["FJDyMC15lxUn5ngPfd"],"timestamp":14
02307733473}
+{"bro_timestamp":"1402307733.473","status_code":200,"method":"GET","ip_dst_port":80,"request_body_len":0,"uri":"\/","tags":[],"source.type":"bro","uid":"CTo78A11g7CYbbOHvj","resp_mime_types":["text\/html"],"trans_depth":1,"protocol":"http","original_string":"HTTP | id.orig_p:58808 status_code:200 method:GET request_body_len:0 id.resp_p:80 uri:\/ tags:[] uid:CTo78A11g7CYbbOHvj resp_mime_types:[\"text\\\/html\"] trans_depth:1 host:www.cisco.com status_msg:OK id.orig_h:192.249.113.37 response_body_len:25523 user_agent:curl\/7.22.0 (x86_64-pc-linux-gnu) libcurl\/7.22.0 OpenSSL\/1.0.1 zlib\/1.2.3.4 libidn\/1.23 librtmp\/2.3 ts:1402307733.473 id.resp_h:72.163.4.161 resp_fuids:[\"FJDyMC15lxUn5ngPfd\"]","ip_dst_addr":"72.163.4.161","ip_src_port":58808,"host":"www.cisco.com","status_msg":"OK","response_body_len":25523,"ip_src_addr":"192.249.113.37","user_agent":"curl\/7.22.0 (x86_64-pc-linux-gnu) libcurl\/7.22.0 OpenSSL\/1.0.1 zlib\/1.2.3.4 libidn\/1.23 librtmp\/2.3","resp_fuids":["FJDyMC15l
xUn5ngPfd"],"timestamp":1402307733473,"guid":"this-is-random-uuid-will-be-36-chars"}
+{"TTLs":[3600.0,289.0,14.0],"qclass_name":"C_INTERNET","bro_timestamp":"1402308259.609","qtype_name":"AAAA","ip_dst_port":53,"qtype":28,"rejected":false,"answers":["www.cisco.com.akadns.net","origin-www.cisco.com","2001:420:1201:2::a"],"trans_id":62418,"uid":"CuJT272SKaJSuqO0Ia","protocol":"dns","original_string":"DNS | AA:true TTLs:[3600.0,289.0,14.0] qclass_name:C_INTERNET id.orig_p:33976 qtype_name:AAAA qtype:28 rejected:false id.resp_p:53 query:www.cisco.com answers:[\"www.cisco.com.akadns.net\",\"origin-www.cisco.com\",\"2001:420:1201:2::a\"] trans_id:62418 rcode:0 rcode_name:NOERROR TC:false RA:true uid:CuJT272SKaJSuqO0Ia RD:true proto:udp id.orig_h:10.122.196.204 Z:0 qclass:1 ts:1402308259.609 id.resp_h:144.254.71.184","ip_dst_addr":"144.254.71.184","Z":0,"ip_src_addr":"10.122.196.204","qclass":1,"timestamp":1402308259609,"AA":true,"query":"www.cisco.com","rcode":0,"rcode_name":"NOERROR","TC":false,"RA":true,"source.type":"bro","RD":true,"ip_src_port":33976,"proto":"udp","gui
d":"this-is-random-uuid-will-be-36-chars"}
+{"bro_timestamp":"1402307733.473","status_code":200,"method":"GET","ip_dst_port":80,"request_body_len":0,"uri":"\/","tags":[],"source.type":"bro","uid":"KIRAN","resp_mime_types":["text\/html"],"trans_depth":1,"protocol":"http","original_string":"HTTP | id.orig_p:58808 status_code:200 method:GET request_body_len:0 id.resp_p:80 uri:\/ tags:[] uid:KIRAN resp_mime_types:[\"text\\\/html\"] trans_depth:1 host:www.cisco.com status_msg:OK id.orig_h:10.122.196.204 response_body_len:25523 user_agent:curl\/7.22.0 (x86_64-pc-linux-gnu) libcurl\/7.22.0 OpenSSL\/1.0.1 zlib\/1.2.3.4 libidn\/1.23 librtmp\/2.3 ts:1402307733.473 id.resp_h:72.163.4.161 resp_fuids:[\"FJDyMC15lxUn5ngPfd\"]","ip_dst_addr":"72.163.4.161","ip_src_port":58808,"host":"www.cisco.com","status_msg":"OK","response_body_len":25523,"ip_src_addr":"10.122.196.204","user_agent":"curl\/7.22.0 (x86_64-pc-linux-gnu) libcurl\/7.22.0 OpenSSL\/1.0.1 zlib\/1.2.3.4 libidn\/1.23 librtmp\/2.3","resp_fuids":["FJDyMC15lxUn5ngPfd"],"timestamp":14
02307733473,"guid":"this-is-random-uuid-will-be-36-chars"}
+{"bro_timestamp":"1402307733.473","status_code":200,"method":"GET","ip_dst_port":80,"request_body_len":0,"uri":"\/","tags":[],"source.type":"bro","uid":"KIRAN12312312","resp_mime_types":["text\/html"],"trans_depth":1,"protocol":"http","original_string":"HTTP | id.orig_p:58808 status_code:200 method:GET request_body_len:0 id.resp_p:80 uri:\/ tags:[] uid:KIRAN12312312 resp_mime_types:[\"text\\\/html\"] trans_depth:1 host:www.cisco.com status_msg:OK id.orig_h:192.249.113.37 response_body_len:25523 user_agent:curl\/7.22.0 (x86_64-pc-linux-gnu) libcurl\/7.22.0 OpenSSL\/1.0.1 zlib\/1.2.3.4 libidn\/1.23 librtmp\/2.3 ts:1402307733.473 id.resp_h:72.163.4.161 resp_fuids:[\"FJDyMC15lxUn5ngPfd\"]","ip_dst_addr":"72.163.4.161","ip_src_port":58808,"host":"www.cisco.com","status_msg":"OK","response_body_len":25523,"ip_src_addr":"192.249.113.37","user_agent":"curl\/7.22.0 (x86_64-pc-linux-gnu) libcurl\/7.22.0 OpenSSL\/1.0.1 zlib\/1.2.3.4 libidn\/1.23 librtmp\/2.3","resp_fuids":["FJDyMC15lxUn5ngPfd"
],"timestamp":1402307733473,"guid":"this-is-random-uuid-will-be-36-chars"}
+{"bro_timestamp":"1402307733.473","status_code":200,"method":"GET","ip_dst_port":80,"request_body_len":0,"uri":"\/","tags":[],"source.type":"bro","uid":"KIRAN12312312","resp_mime_types":["text\/html"],"trans_depth":1,"protocol":"http","original_string":"HTTP | id.orig_p:58808 status_code:200 method:GET request_body_len:0 id.resp_p:80 uri:\/ tags:[] uid:KIRAN12312312 resp_mime_types:[\"text\\\/html\"] trans_depth:1 host:www.cisco.com status_msg:OK id.orig_h:192.249.113.37 response_body_len:25523 user_agent:curl\/7.22.0 (x86_64-pc-linux-gnu) libcurl\/7.22.0 OpenSSL\/1.0.1 zlib\/1.2.3.4 libidn\/1.23 librtmp\/2.3 ts:1402307733.473 id.resp_h:72.163.4.161 resp_fuids:[\"FJDyMC15lxUn5ngPfd\"]","ip_dst_addr":"72.163.4.161","ip_src_port":58808,"host":"www.cisco.com","status_msg":"OK","response_body_len":25523,"ip_src_addr":"192.249.113.37","user_agent":"curl\/7.22.0 (x86_64-pc-linux-gnu) libcurl\/7.22.0 OpenSSL\/1.0.1 zlib\/1.2.3.4 libidn\/1.23 librtmp\/2.3","resp_fuids":["FJDyMC15lxUn5ngPfd"
],"timestamp":1402307733473,"guid":"this-is-random-uuid-will-be-36-chars"}
+{"bro_timestamp":"1402307733.473","status_code":200,"method":"GET","ip_dst_port":80,"request_body_len":0,"uri":"\/","tags":[],"source.type":"bro","uid":"CTo78A11g7CYbbOHvj","resp_mime_types":["text\/html"],"trans_depth":1,"protocol":"http","original_string":"HTTP | id.orig_p:58808 status_code:200 method:GET request_body_len:0 id.resp_p:80 uri:\/ tags:[] uid:CTo78A11g7CYbbOHvj resp_mime_types:[\"text\\\/html\"] trans_depth:1 host:gabacentre.pw status_msg:OK id.orig_h:10.122.196.204 response_body_len:25523 email:abullis@mail.csuchico.edu user_agent:curl\/7.22.0 (x86_64-pc-linux-gnu) libcurl\/7.22.0 OpenSSL\/1.0.1 zlib\/1.2.3.4 libidn\/1.23 librtmp\/2.3 ts:1402307733.473 id.resp_h:72.163.4.161 resp_fuids:[\"FJDyMC15lxUn5ngPfd\"]","ip_dst_addr":"72.163.4.161","ip_src_port":58808,"host":"gabacentre.pw","status_msg":"OK","response_body_len":25523,"ip_src_addr":"10.122.196.204","email":"abullis@mail.csuchico.edu","user_agent":"curl\/7.22.0 (x86_64-pc-linux-gnu) libcurl\/7.22.0 OpenSSL\/1.0
.1 zlib\/1.2.3.4 libidn\/1.23 librtmp\/2.3","resp_fuids":["FJDyMC15lxUn5ngPfd"],"timestamp":1402307733473,"guid":"this-is-random-uuid-will-be-36-chars"}
+{"TTLs":[3600.0,289.0,14.0],"qclass_name":"C_INTERNET","bro_timestamp":"1402308259.609","qtype_name":"AAAA","ip_dst_port":53,"qtype":28,"rejected":false,"answers":["gabacentre.pw","www.cisco.com.akadns.net","origin-www.cisco.com","2001:420:1201:2::a"],"trans_id":62418,"uid":"CYbbOHvj","protocol":"dns","original_string":"DNS | AA:true TTLs:[3600.0,289.0,14.0] qclass_name:C_INTERNET id.orig_p:33976 qtype_name:AAAA qtype:28 rejected:false id.resp_p:53 query:www.cisco.com answers:[\"gabacentre.pw\",\"www.cisco.com.akadns.net\",\"origin-www.cisco.com\",\"2001:420:1201:2::a\"] trans_id:62418 rcode:0 rcode_name:NOERROR TC:false RA:true uid:CYbbOHvj RD:true proto:udp id.orig_h:93.188.160.43 Z:0 qclass:1 ts:1402308259.609 id.resp_h:144.254.71.184","ip_dst_addr":"144.254.71.184","Z":0,"ip_src_addr":"93.188.160.43","qclass":1,"timestamp":1402308259609,"AA":true,"query":"www.cisco.com","rcode":0,"rcode_name":"NOERROR","TC":false,"RA":true,"source.type":"bro","RD":true,"ip_src_port":33976,"proto
":"udp","guid":"this-is-random-uuid-will-be-36-chars"}
+{"bro_timestamp":"1402307733.473","status_code":200,"method":"GET","ip_dst_port":80,"request_body_len":0,"uri":"\/","tags":[],"source.type":"bro","uid":"CTo78A11g7CYbbOHvj","resp_mime_types":["text\/html"],"trans_depth":1,"protocol":"http","original_string":"HTTP | id.orig_p:58808 status_code:200 method:GET request_body_len:0 id.resp_p:80 uri:\/ tags:[] uid:CTo78A11g7CYbbOHvj resp_mime_types:[\"text\\\/html\"] trans_depth:1 host:www.cisco.com status_msg:OK id.orig_h:192.249.113.37 response_body_len:25523 user_agent:curl\/7.22.0 (x86_64-pc-linux-gnu) libcurl\/7.22.0 OpenSSL\/1.0.1 zlib\/1.2.3.4 libidn\/1.23 librtmp\/2.3 ts:1402307733.473 id.resp_h:72.163.4.161 resp_fuids:[\"FJDyMC15lxUn5ngPfd\"]","ip_dst_addr":"72.163.4.161","ip_src_port":58808,"host":"www.cisco.com","status_msg":"OK","response_body_len":25523,"ip_src_addr":"192.249.113.37","user_agent":"curl\/7.22.0 (x86_64-pc-linux-gnu) libcurl\/7.22.0 OpenSSL\/1.0.1 zlib\/1.2.3.4 libidn\/1.23 librtmp\/2.3","resp_fuids":["FJDyMC15l
xUn5ngPfd"],"timestamp":1402307733473,"guid":"this-is-random-uuid-will-be-36-chars"}
+{"TTLs":[3600.0,289.0,14.0],"qclass_name":"C_INTERNET","bro_timestamp":"1402308259.609","qtype_name":"AAAA","ip_dst_port":53,"qtype":28,"rejected":false,"answers":["www.cisco.com.akadns.net","origin-www.cisco.com","2001:420:1201:2::a"],"trans_id":62418,"uid":"CuJT272SKaJSuqO0Ia","protocol":"dns","original_string":"DNS | AA:true TTLs:[3600.0,289.0,14.0] qclass_name:C_INTERNET id.orig_p:33976 qtype_name:AAAA qtype:28 rejected:false id.resp_p:53 query:www.cisco.com answers:[\"www.cisco.com.akadns.net\",\"origin-www.cisco.com\",\"2001:420:1201:2::a\"] trans_id:62418 rcode:0 rcode_name:NOERROR TC:false RA:true uid:CuJT272SKaJSuqO0Ia RD:true proto:udp id.orig_h:10.122.196.204 Z:0 qclass:1 ts:1402308259.609 id.resp_h:144.254.71.184","ip_dst_addr":"144.254.71.184","Z":0,"ip_src_addr":"10.122.196.204","qclass":1,"timestamp":1402308259609,"AA":true,"query":"www.cisco.com","rcode":0,"rcode_name":"NOERROR","TC":false,"RA":true,"source.type":"bro","RD":true,"ip_src_port":33976,"proto":"udp","gui
d":"this-is-random-uuid-will-be-36-chars"}
+{"bro_timestamp":"1402307733.473","status_code":200,"method":"GET","ip_dst_port":80,"request_body_len":0,"uri":"\/","tags":[],"source.type":"bro","uid":"KIRAN","resp_mime_types":["text\/html"],"trans_depth":1,"protocol":"http","original_string":"HTTP | id.orig_p:58808 status_code:200 method:GET request_body_len:0 id.resp_p:80 uri:\/ tags:[] uid:KIRAN resp_mime_types:[\"text\\\/html\"] trans_depth:1 host:www.cisco.com status_msg:OK id.orig_h:10.122.196.204 response_body_len:25523 user_agent:curl\/7.22.0 (x86_64-pc-linux-gnu) libcurl\/7.22.0 OpenSSL\/1.0.1 zlib\/1.2.3.4 libidn\/1.23 librtmp\/2.3 ts:1402307733.473 id.resp_h:72.163.4.161 resp_fuids:[\"FJDyMC15lxUn5ngPfd\"]","ip_dst_addr":"72.163.4.161","ip_src_port":58808,"host":"www.cisco.com","status_msg":"OK","response_body_len":25523,"ip_src_addr":"10.122.196.204","user_agent":"curl\/7.22.0 (x86_64-pc-linux-gnu) libcurl\/7.22.0 OpenSSL\/1.0.1 zlib\/1.2.3.4 libidn\/1.23 librtmp\/2.3","resp_fuids":["FJDyMC15lxUn5ngPfd"],"timestamp":14
02307733473,"guid":"this-is-random-uuid-will-be-36-chars"}
http://git-wip-us.apache.org/repos/asf/incubator-metron/blob/27b0d6e3/metron-platform/metron-integration-test/src/main/sample/data/jsonMap/parsed/jsonMapExampleParsed
----------------------------------------------------------------------
diff --git a/metron-platform/metron-integration-test/src/main/sample/data/jsonMap/parsed/jsonMapExampleParsed b/metron-platform/metron-integration-test/src/main/sample/data/jsonMap/parsed/jsonMapExampleParsed
index 795ed45..7e00c0e 100644
--- a/metron-platform/metron-integration-test/src/main/sample/data/jsonMap/parsed/jsonMapExampleParsed
+++ b/metron-platform/metron-integration-test/src/main/sample/data/jsonMap/parsed/jsonMapExampleParsed
@@ -1,2 +1,2 @@
-{ "string" : "bar", "number" : 2, "ignored" : [ "blah" ], "original_string":"{ \"string\" : \"bar\", \"number\" : 2, \"ignored\" : [ \"blah\" ] }","timestamp":1000000000000, "source.type":"jsonMap" }
-{ "number" : 7 , "original_string" : "{ \"number\" : 7 }", "source.type":"jsonMap","timestamp":1000000000000}
+{ "string" : "bar", "number" : 2, "ignored" : [ "blah" ], "original_string":"{ \"string\" : \"bar\", \"number\" : 2, \"ignored\" : [ \"blah\" ] }","timestamp":1000000000000, "source.type":"jsonMap","guid":"this-is-random-uuid-will-be-36-chars" }
+{ "number" : 7 , "original_string" : "{ \"number\" : 7 }", "source.type":"jsonMap","timestamp":1000000000000,"guid":"this-is-random-uuid-will-be-36-chars"}
http://git-wip-us.apache.org/repos/asf/incubator-metron/blob/27b0d6e3/metron-platform/metron-integration-test/src/main/sample/data/snort/parsed/SnortParsed
----------------------------------------------------------------------
diff --git a/metron-platform/metron-integration-test/src/main/sample/data/snort/parsed/SnortParsed b/metron-platform/metron-integration-test/src/main/sample/data/snort/parsed/SnortParsed
index 8dc6c0e..02d519e 100644
--- a/metron-platform/metron-integration-test/src/main/sample/data/snort/parsed/SnortParsed
+++ b/metron-platform/metron-integration-test/src/main/sample/data/snort/parsed/SnortParsed
@@ -1,3 +1,3 @@
-{"msg":"Consecutive TCP small segments exceeding threshold","sig_rev":"1","ip_dst_addr":"10.0.2.15","ip_dst_port":"22","ethsrc":"52:54:00:12:35:02","tcpseq":"0x9AFF3D7","dgmlen":"64","icmpid":"","tcplen":"","tcpwindow":"0xFFFF","icmpseq":"","tcpack":"0xC8761D52","original_string":"01\/27\/16-16:01:04.877970 ,129,12,1,\"Consecutive TCP small segments exceeding threshold\",TCP,10.0.2.2,56642,10.0.2.15,22,52:54:00:12:35:02,08:00:27:7F:93:2D,0x4E,***AP***,0x9AFF3D7,0xC8761D52,,0xFFFF,64,0,59677,64,65536,,,,","icmpcode":"","tos":"0","id":"59677","timestamp":1453932941970,"ethdst":"08:00:27:7F:93:2D","ip_src_addr":"10.0.2.2","ttl":"64","source.type":"snort","ethlen":"0x4E","iplen":"65536","icmptype":"","protocol":"TCP","ip_src_port":"56642","tcpflags":"***AP***","sig_id":"12","sig_generator":"129", "is_alert" : "true"}
-{"msg":"Consecutive TCP small segments exceeding threshold","sig_rev":"1","ip_dst_addr":"10.0.2.15","ip_dst_port":"50895","ethsrc":"52:54:00:12:35:02","tcpseq":"0xDB45F7A","dgmlen":"96","icmpid":"","tcplen":"","tcpwindow":"0xFFFF","icmpseq":"","tcpack":"0x7701DD5B","original_string":"02\/22\/16-15:56:48.612494 ,129,12,1,\"Consecutive TCP small segments exceeding threshold\",TCP,96.44.142.5,80,10.0.2.15,50895,52:54:00:12:35:02,08:00:27:7F:93:2D,0x6E,***AP***,0xDB45F7A,0x7701DD5B,,0xFFFF,64,0,16785,96,98304,,,,","icmpcode":"","tos":"0","id":"16785","timestamp":1456178820494,"ethdst":"08:00:27:7F:93:2D","ip_src_addr":"96.44.142.5","ttl":"64","source.type":"snort","ethlen":"0x6E","iplen":"98304","icmptype":"","protocol":"TCP","ip_src_port":"80","tcpflags":"***AP***","sig_id":"12","sig_generator":"129", "is_alert" : "true"}
-{"msg":"Consecutive TCP small segments exceeding threshold","sig_rev":"1","ip_dst_addr":"10.0.2.15","ip_dst_port":"50895","ethsrc":"52:54:00:12:35:02","tcpseq":"0xDB508F2","dgmlen":"152","icmpid":"","tcplen":"","tcpwindow":"0xFFFF","icmpseq":"","tcpack":"0x7701DD5B","original_string":"02\/22\/16-15:56:48.616775 ,129,12,1,\"Consecutive TCP small segments exceeding threshold\",TCP,96.44.142.5,80,10.0.2.15,50895,52:54:00:12:35:02,08:00:27:7F:93:2D,0xA6,***AP***,0xDB508F2,0x7701DD5B,,0xFFFF,64,0,16824,152,155648,,,,","icmpcode":"","tos":"0","id":"16824","timestamp":1456178824775,"ethdst":"08:00:27:7F:93:2D","ip_src_addr":"96.44.142.5","ttl":"64","source.type":"snort","ethlen":"0xA6","iplen":"155648","icmptype":"","protocol":"TCP","ip_src_port":"80","tcpflags":"***AP***","sig_id":"12","sig_generator":"129", "is_alert" : "true"}
+{"msg":"Consecutive TCP small segments exceeding threshold","sig_rev":"1","ip_dst_addr":"10.0.2.15","ip_dst_port":"22","ethsrc":"52:54:00:12:35:02","tcpseq":"0x9AFF3D7","dgmlen":"64","icmpid":"","tcplen":"","tcpwindow":"0xFFFF","icmpseq":"","tcpack":"0xC8761D52","original_string":"01\/27\/16-16:01:04.877970 ,129,12,1,\"Consecutive TCP small segments exceeding threshold\",TCP,10.0.2.2,56642,10.0.2.15,22,52:54:00:12:35:02,08:00:27:7F:93:2D,0x4E,***AP***,0x9AFF3D7,0xC8761D52,,0xFFFF,64,0,59677,64,65536,,,,","icmpcode":"","tos":"0","id":"59677","timestamp":1453932941970,"ethdst":"08:00:27:7F:93:2D","ip_src_addr":"10.0.2.2","ttl":"64","source.type":"snort","ethlen":"0x4E","iplen":"65536","icmptype":"","protocol":"TCP","ip_src_port":"56642","tcpflags":"***AP***","sig_id":"12","sig_generator":"129", "is_alert" : "true","guid":"this-is-random-uuid-will-be-36-chars"}
+{"msg":"Consecutive TCP small segments exceeding threshold","sig_rev":"1","ip_dst_addr":"10.0.2.15","ip_dst_port":"50895","ethsrc":"52:54:00:12:35:02","tcpseq":"0xDB45F7A","dgmlen":"96","icmpid":"","tcplen":"","tcpwindow":"0xFFFF","icmpseq":"","tcpack":"0x7701DD5B","original_string":"02\/22\/16-15:56:48.612494 ,129,12,1,\"Consecutive TCP small segments exceeding threshold\",TCP,96.44.142.5,80,10.0.2.15,50895,52:54:00:12:35:02,08:00:27:7F:93:2D,0x6E,***AP***,0xDB45F7A,0x7701DD5B,,0xFFFF,64,0,16785,96,98304,,,,","icmpcode":"","tos":"0","id":"16785","timestamp":1456178820494,"ethdst":"08:00:27:7F:93:2D","ip_src_addr":"96.44.142.5","ttl":"64","source.type":"snort","ethlen":"0x6E","iplen":"98304","icmptype":"","protocol":"TCP","ip_src_port":"80","tcpflags":"***AP***","sig_id":"12","sig_generator":"129", "is_alert" : "true","guid":"this-is-random-uuid-will-be-36-chars"}
+{"msg":"Consecutive TCP small segments exceeding threshold","sig_rev":"1","ip_dst_addr":"10.0.2.15","ip_dst_port":"50895","ethsrc":"52:54:00:12:35:02","tcpseq":"0xDB508F2","dgmlen":"152","icmpid":"","tcplen":"","tcpwindow":"0xFFFF","icmpseq":"","tcpack":"0x7701DD5B","original_string":"02\/22\/16-15:56:48.616775 ,129,12,1,\"Consecutive TCP small segments exceeding threshold\",TCP,96.44.142.5,80,10.0.2.15,50895,52:54:00:12:35:02,08:00:27:7F:93:2D,0xA6,***AP***,0xDB508F2,0x7701DD5B,,0xFFFF,64,0,16824,152,155648,,,,","icmpcode":"","tos":"0","id":"16824","timestamp":1456178824775,"ethdst":"08:00:27:7F:93:2D","ip_src_addr":"96.44.142.5","ttl":"64","source.type":"snort","ethlen":"0xA6","iplen":"155648","icmptype":"","protocol":"TCP","ip_src_port":"80","tcpflags":"***AP***","sig_id":"12","sig_generator":"129", "is_alert" : "true","guid":"this-is-random-uuid-will-be-36-chars"}
http://git-wip-us.apache.org/repos/asf/incubator-metron/blob/27b0d6e3/metron-platform/metron-integration-test/src/main/sample/data/squid/parsed/SquidExampleParsed
----------------------------------------------------------------------
diff --git a/metron-platform/metron-integration-test/src/main/sample/data/squid/parsed/SquidExampleParsed b/metron-platform/metron-integration-test/src/main/sample/data/squid/parsed/SquidExampleParsed
index 9a8b981..aad1f9f 100644
--- a/metron-platform/metron-integration-test/src/main/sample/data/squid/parsed/SquidExampleParsed
+++ b/metron-platform/metron-integration-test/src/main/sample/data/squid/parsed/SquidExampleParsed
@@ -1,2 +1,2 @@
-{"elapsed":161,"code":200,"ip_dst_addr":"199.27.79.73","original_string":"1461576382.642 161 127.0.0.1 TCP_MISS\/200 103701 GET http:\/\/www.cnn.com\/ - DIRECT\/199.27.79.73 text\/html","method":"GET","bytes":103701,"action":"TCP_MISS","ip_src_addr":"127.0.0.1","url":"http://www.cnn.com/","full_hostname":"www.cnn.com", "domain_without_subdomains": "cnn.com", "timestamp":1461576382642,"source.type":"squid"}
-{"elapsed":159,"code":200,"ip_dst_addr":"66.210.41.9","original_string":"1461576442.228 159 127.0.0.1 TCP_MISS\/200 137183 GET http:\/\/www.nba.com\/ - DIRECT\/66.210.41.9 text\/html","method":"GET","bytes":137183,"action":"TCP_MISS","ip_src_addr":"127.0.0.1","url":"http://www.nba.com/", "full_hostname":"www.nba.com", "domain_without_subdomains" : "nba.com", "timestamp":1461576442228,"source.type":"squid"}
\ No newline at end of file
+{"elapsed":161,"code":200,"ip_dst_addr":"199.27.79.73","original_string":"1461576382.642 161 127.0.0.1 TCP_MISS\/200 103701 GET http:\/\/www.cnn.com\/ - DIRECT\/199.27.79.73 text\/html","method":"GET","bytes":103701,"action":"TCP_MISS","ip_src_addr":"127.0.0.1","url":"http://www.cnn.com/","full_hostname":"www.cnn.com", "domain_without_subdomains": "cnn.com", "timestamp":1461576382642,"source.type":"squid","guid":"this-is-random-uuid-will-be-36-chars"}
+{"elapsed":159,"code":200,"ip_dst_addr":"66.210.41.9","original_string":"1461576442.228 159 127.0.0.1 TCP_MISS\/200 137183 GET http:\/\/www.nba.com\/ - DIRECT\/66.210.41.9 text\/html","method":"GET","bytes":137183,"action":"TCP_MISS","ip_src_addr":"127.0.0.1","url":"http://www.nba.com/", "full_hostname":"www.nba.com", "domain_without_subdomains" : "nba.com", "timestamp":1461576442228,"source.type":"squid","guid":"this-is-random-uuid-will-be-36-chars"}
\ No newline at end of file
http://git-wip-us.apache.org/repos/asf/incubator-metron/blob/27b0d6e3/metron-platform/metron-integration-test/src/main/sample/data/websphere/parsed/WebsphereParsed
----------------------------------------------------------------------
diff --git a/metron-platform/metron-integration-test/src/main/sample/data/websphere/parsed/WebsphereParsed b/metron-platform/metron-integration-test/src/main/sample/data/websphere/parsed/WebsphereParsed
index 86e3895..0f5b0fc 100644
--- a/metron-platform/metron-integration-test/src/main/sample/data/websphere/parsed/WebsphereParsed
+++ b/metron-platform/metron-integration-test/src/main/sample/data/websphere/parsed/WebsphereParsed
@@ -1,5 +1,5 @@
-{"severity":"notice","hostname":"ABCXML1413","event_type":"auth","original_string":"<133>Apr 15 17:47:28 ABCXML1413 [rojOut][0x81000033][auth][notice] user(rick007): [120.43.200.6]: User logged into 'cohlOut'.","event_code":"0x81000033","security_domain":"rojOut","event_subtype":"login","priority":133,"ip_src_addr":"120.43.200.6","timestamp":1460742448000,"username":"rick007","source.type":"websphere"}
-{"severity":"info","hostname":"PHIXML3RWD","event_type":"auth","original_string":"<134>Apr 15 18:02:27 PHIXML3RWD [0x81000019][auth][info] [14.122.2.201]: User 'hjpotter' logged out from 'default'.","event_code":"0x81000019","security_domain":"default","event_subtype":"logout","priority":134,"ip_src_addr":"14.122.2.201","timestamp":1460743347000,"username":"hjpotter","source.type":"websphere"}
-{"severity":"error","hostname":"ROBXML3QRS","process":"rbm","event_type":"auth","original_string":"<131>Apr 15 17:36:35 ROBXML3QRS [0x80800018][auth][error] rbm(RBM-Settings): trans(3502888135)[request] gtid(3502888135): RBM: Resource access denied.","event_code":"0x80800018","message":"trans(3502888135)[request] gtid(3502888135): RBM: Resource access denied.","priority":131,"timestamp":1460741795000,"source.type":"websphere"}
-{"severity":"info","hostname":"SAGPXMLQA333","process":"trans","event_type":"audit","original_string":"<134>Apr 15 17:17:34 SAGPXMLQA333 [0x8240001c][audit][info] trans(191): (admin:default:system:*): ntp-service 'NTP Service' - Operational state down","event_code":"0x8240001c","message":"(admin:default:system:*): ntp-service 'NTP Service' - Operational state down","priority":134,"timestamp":1460740654000,"source.type":"websphere"}
-{"severity":"info","hostname":"DOMXML3PUZ","event_type":"auth","original_string":"<134>Apr 15 17:46:52 DOMXML3PUZ [0x8100448e][auth][info] CLI timeout occurred.","event_code":"0x8100448e","message":"CLI timeout occurred.","priority":134,"timestamp":1460742412000,"source.type":"websphere"}
\ No newline at end of file
+{"severity":"notice","hostname":"ABCXML1413","event_type":"auth","original_string":"<133>Apr 15 17:47:28 ABCXML1413 [rojOut][0x81000033][auth][notice] user(rick007): [120.43.200.6]: User logged into 'cohlOut'.","event_code":"0x81000033","security_domain":"rojOut","event_subtype":"login","priority":133,"ip_src_addr":"120.43.200.6","timestamp":1460742448000,"username":"rick007","source.type":"websphere","guid":"this-is-random-uuid-will-be-36-chars"}
+{"severity":"info","hostname":"PHIXML3RWD","event_type":"auth","original_string":"<134>Apr 15 18:02:27 PHIXML3RWD [0x81000019][auth][info] [14.122.2.201]: User 'hjpotter' logged out from 'default'.","event_code":"0x81000019","security_domain":"default","event_subtype":"logout","priority":134,"ip_src_addr":"14.122.2.201","timestamp":1460743347000,"username":"hjpotter","source.type":"websphere","guid":"this-is-random-uuid-will-be-36-chars"}
+{"severity":"error","hostname":"ROBXML3QRS","process":"rbm","event_type":"auth","original_string":"<131>Apr 15 17:36:35 ROBXML3QRS [0x80800018][auth][error] rbm(RBM-Settings): trans(3502888135)[request] gtid(3502888135): RBM: Resource access denied.","event_code":"0x80800018","message":"trans(3502888135)[request] gtid(3502888135): RBM: Resource access denied.","priority":131,"timestamp":1460741795000,"source.type":"websphere","guid":"this-is-random-uuid-will-be-36-chars"}
+{"severity":"info","hostname":"SAGPXMLQA333","process":"trans","event_type":"audit","original_string":"<134>Apr 15 17:17:34 SAGPXMLQA333 [0x8240001c][audit][info] trans(191): (admin:default:system:*): ntp-service 'NTP Service' - Operational state down","event_code":"0x8240001c","message":"(admin:default:system:*): ntp-service 'NTP Service' - Operational state down","priority":134,"timestamp":1460740654000,"source.type":"websphere","guid":"this-is-random-uuid-will-be-36-chars"}
+{"severity":"info","hostname":"DOMXML3PUZ","event_type":"auth","original_string":"<134>Apr 15 17:46:52 DOMXML3PUZ [0x8100448e][auth][info] CLI timeout occurred.","event_code":"0x8100448e","message":"CLI timeout occurred.","priority":134,"timestamp":1460742412000,"source.type":"websphere","guid":"this-is-random-uuid-will-be-36-chars"}
\ No newline at end of file
http://git-wip-us.apache.org/repos/asf/incubator-metron/blob/27b0d6e3/metron-platform/metron-integration-test/src/main/sample/data/yaf/parsed/YafExampleParsed
----------------------------------------------------------------------
diff --git a/metron-platform/metron-integration-test/src/main/sample/data/yaf/parsed/YafExampleParsed b/metron-platform/metron-integration-test/src/main/sample/data/yaf/parsed/YafExampleParsed
index 9d51813..6ee2b2f 100644
--- a/metron-platform/metron-integration-test/src/main/sample/data/yaf/parsed/YafExampleParsed
+++ b/metron-platform/metron-integration-test/src/main/sample/data/yaf/parsed/YafExampleParsed
@@ -1,10 +1,10 @@
-{"iflags":"AS","uflags":0,"isn":"22efa001","ip_dst_addr":"10.0.2.15","ip_dst_port":39468,"duration":"0.000","rpkt":0,"original_string":"2016-01-28 15:29:48.512|2016-01-28 15:29:48.512| 0.000| 0.000| 6| 216.21.170.221| 80| 10.0.2.15|39468| AS| 0| 0| 0|22efa001|00000000|000|000| 1| 44| 0| 0| 0|idle","pkt":1,"ruflags":0,"roct":0,"ip_src_addr":"216.21.170.221","tag":0,"rtag":0,"ip_src_port":80,"timestamp":1453994988512,"app":0,"oct":44,"end_reason":"idle","risn":0,"end_time":1453994988512,"source.type":"yaf","start_time":1453994988512,"riflags":0,"rtt":"0.000","protocol":"TCP"}
-{"iflags":"A","uflags":0,"isn":10000000,"ip_dst_addr":"10.0.2.3","ip_dst_port":53,"duration":"0.000","rpkt":0,"original_string":"2016-01-28 15:29:48.502|2016-01-28 15:29:48.502| 0.000| 0.000| 17| 10.0.2.15|37299| 10.0.2.3| 53| A| 0| 0| 0|10000000|00000000|000|000| 1| 56| 0| 0| 0|idle","pkt":1,"ruflags":0,"roct":0,"ip_src_addr":"10.0.2.15","tag":0,"rtag":0,"ip_src_port":37299,"timestamp":1453994988502,"app":0,"oct":56,"end_reason":"idle","risn":0,"end_time":1453994988502,"source.type":"yaf","start_time":1453994988502,"riflags":0,"rtt":"0.000","protocol":"UDP"}
-{"iflags":"A","uflags":0,"isn":0,"ip_dst_addr":"10.0.2.15","ip_dst_port":37299,"duration":"0.000","rpkt":0,"original_string":"2016-01-28 15:29:48.504|2016-01-28 15:29:48.504| 0.000| 0.000| 17| 10.0.2.3| 53| 10.0.2.15|37299| A| 0| 0| 0|00000000|00000000|000|000| 1| 312| 0| 0| 0|idle","pkt":1,"ruflags":0,"roct":0,"ip_src_addr":"10.0.2.3","tag":0,"rtag":0,"ip_src_port":53,"timestamp":1453994988504,"app":0,"oct":312,"end_reason":"idle","risn":0,"end_time":1453994988504,"source.type":"yaf","start_time":1453994988504,"riflags":0,"rtt":"0.000","protocol":"UDP"}
-{"iflags":"A","uflags":0,"isn":0,"ip_dst_addr":"10.0.2.3","ip_dst_port":53,"duration":"0.000","rpkt":0,"original_string":"2016-01-28 15:29:48.504|2016-01-28 15:29:48.504| 0.000| 0.000| 17| 10.0.2.15|56303| 10.0.2.3| 53| A| 0| 0| 0|00000000|00000000|000|000| 1| 56| 0| 0| 0|idle","pkt":1,"ruflags":0,"roct":0,"ip_src_addr":"10.0.2.15","tag":0,"rtag":0,"ip_src_port":56303,"timestamp":1453994988504,"app":0,"oct":56,"end_reason":"idle","risn":0,"end_time":1453994988504,"source.type":"yaf","start_time":1453994988504,"riflags":0,"rtt":"0.000","protocol":"UDP"}
-{"iflags":"A","uflags":0,"isn":0,"ip_dst_addr":"10.0.2.15","ip_dst_port":56303,"duration":"0.000","rpkt":0,"original_string":"2016-01-28 15:29:48.506|2016-01-28 15:29:48.506| 0.000| 0.000| 17| 10.0.2.3| 53| 10.0.2.15|56303| A| 0| 0| 0|00000000|00000000|000|000| 1| 84| 0| 0| 0|idle","pkt":1,"ruflags":0,"roct":0,"ip_src_addr":"10.0.2.3","tag":0,"rtag":0,"ip_src_port":53,"timestamp":1453994988506,"app":0,"oct":84,"end_reason":"idle","risn":0,"end_time":1453994988506,"source.type":"yaf","start_time":1453994988506,"riflags":0,"rtt":"0.000","protocol":"UDP"}
-{"iflags":"S","uflags":0,"isn":"58c52fca","ip_dst_addr":"216.21.170.221","ip_dst_port":80,"duration":"0.000","rpkt":0,"original_string":"2016-01-28 15:29:48.508|2016-01-28 15:29:48.508| 0.000| 0.000| 6| 10.0.2.15|39468| 216.21.170.221| 80| S| 0| 0| 0|58c52fca|00000000|000|000| 1| 60| 0| 0| 0|idle","pkt":1,"ruflags":0,"roct":0,"ip_src_addr":"10.0.2.15","tag":0,"rtag":0,"ip_src_port":39468,"timestamp":1453994988508,"app":0,"oct":60,"end_reason":"idle","risn":0,"end_time":1453994988508,"source.type":"yaf","start_time":1453994988508,"riflags":0,"rtt":"0.000","protocol":"TCP"}
-{"iflags":"A","uflags":0,"isn":"58c52fcb","ip_dst_addr":"216.21.170.221","ip_dst_port":80,"duration":"0.000","rpkt":0,"original_string":"2016-01-28 15:29:48.512|2016-01-28 15:29:48.512| 0.000| 0.000| 6| 10.0.2.15|39468| 216.21.170.221| 80| A| 0| 0| 0|58c52fcb|00000000|000|000| 1| 40| 0| 0| 0|idle ","pkt":1,"ruflags":0,"roct":0,"ip_src_addr":"10.0.2.15","tag":0,"rtag":0,"ip_src_port":39468,"timestamp":1453994988512,"app":0,"oct":40,"end_reason":"idle ","risn":0,"end_time":1453994988512,"source.type":"yaf","start_time":1453994988512,"riflags":0,"rtt":"0.000","protocol":"TCP"}
-{"iflags":"AP","uflags":0,"isn":"58c52fcb","ip_dst_addr":"216.21.170.221","ip_dst_port":80,"duration":"0.000","rpkt":0,"original_string":"2016-01-28 15:29:48.512|2016-01-28 15:29:48.512| 0.000| 0.000| 6| 10.0.2.15|39468| 216.21.170.221| 80| AP| 0| 0| 0|58c52fcb|00000000|000|000| 1| 148| 0| 0| 0|idle ","pkt":1,"ruflags":0,"roct":0,"ip_src_addr":"10.0.2.15","tag":0,"rtag":0,"ip_src_port":39468,"timestamp":1453994988512,"app":0,"oct":148,"end_reason":"idle ","risn":0,"end_time":1453994988512,"source.type":"yaf","start_time":1453994988512,"riflags":0,"rtt":"0.000","protocol":"TCP"}
-{"iflags":"A","uflags":0,"isn":"22efa002","ip_dst_addr":"10.0.2.15","ip_dst_port":39468,"duration":"0.000","rpkt":0,"original_string":"2016-01-28 15:29:48.512|2016-01-28 15:29:48.512| 0.000| 0.000| 6| 216.21.170.221| 80| 10.0.2.15|39468| A| 0| 0| 0|22efa002|00000000|000|000| 1| 40| 0| 0| 0|idle ","pkt":1,"ruflags":0,"roct":0,"ip_src_addr":"216.21.170.221","tag":0,"rtag":0,"ip_src_port":80,"timestamp":1453994988512,"app":0,"oct":40,"end_reason":"idle ","risn":0,"end_time":1453994988512,"source.type":"yaf","start_time":1453994988512,"riflags":0,"rtt":"0.000","protocol":"TCP"}
-{"iflags":"AP","uflags":0,"isn":"22efa002","ip_dst_addr":"10.0.2.15","ip_dst_port":39468,"duration":"0.000","rpkt":0,"original_string":"2016-01-28 15:29:48.562|2016-01-28 15:29:48.562| 0.000| 0.000| 6| 216.21.170.221| 80| 10.0.2.15|39468| AP| 0| 0| 0|22efa002|00000000|000|000| 1| 604| 0| 0| 0|idle","pkt":1,"ruflags":0,"roct":0,"ip_src_addr":"216.21.170.221","tag":0,"rtag":0,"ip_src_port":80,"timestamp":1453994988562,"app":0,"oct":604,"end_reason":"idle","risn":0,"end_time":1453994988562,"source.type":"yaf","start_time":1453994988562,"riflags":0,"rtt":"0.000","protocol":"TCP"}
+{"iflags":"AS","uflags":0,"isn":"22efa001","ip_dst_addr":"10.0.2.15","ip_dst_port":39468,"duration":"0.000","rpkt":0,"original_string":"2016-01-28 15:29:48.512|2016-01-28 15:29:48.512| 0.000| 0.000| 6| 216.21.170.221| 80| 10.0.2.15|39468| AS| 0| 0| 0|22efa001|00000000|000|000| 1| 44| 0| 0| 0|idle","pkt":1,"ruflags":0,"roct":0,"ip_src_addr":"216.21.170.221","tag":0,"rtag":0,"ip_src_port":80,"timestamp":1453994988512,"app":0,"oct":44,"end_reason":"idle","risn":0,"end_time":1453994988512,"source.type":"yaf","start_time":1453994988512,"riflags":0,"rtt":"0.000","protocol":"TCP","guid":"this-is-random-uuid-will-be-36-chars"}
+{"iflags":"A","uflags":0,"isn":10000000,"ip_dst_addr":"10.0.2.3","ip_dst_port":53,"duration":"0.000","rpkt":0,"original_string":"2016-01-28 15:29:48.502|2016-01-28 15:29:48.502| 0.000| 0.000| 17| 10.0.2.15|37299| 10.0.2.3| 53| A| 0| 0| 0|10000000|00000000|000|000| 1| 56| 0| 0| 0|idle","pkt":1,"ruflags":0,"roct":0,"ip_src_addr":"10.0.2.15","tag":0,"rtag":0,"ip_src_port":37299,"timestamp":1453994988502,"app":0,"oct":56,"end_reason":"idle","risn":0,"end_time":1453994988502,"source.type":"yaf","start_time":1453994988502,"riflags":0,"rtt":"0.000","protocol":"UDP","guid":"this-is-random-uuid-will-be-36-chars"}
+{"iflags":"A","uflags":0,"isn":0,"ip_dst_addr":"10.0.2.15","ip_dst_port":37299,"duration":"0.000","rpkt":0,"original_string":"2016-01-28 15:29:48.504|2016-01-28 15:29:48.504| 0.000| 0.000| 17| 10.0.2.3| 53| 10.0.2.15|37299| A| 0| 0| 0|00000000|00000000|000|000| 1| 312| 0| 0| 0|idle","pkt":1,"ruflags":0,"roct":0,"ip_src_addr":"10.0.2.3","tag":0,"rtag":0,"ip_src_port":53,"timestamp":1453994988504,"app":0,"oct":312,"end_reason":"idle","risn":0,"end_time":1453994988504,"source.type":"yaf","start_time":1453994988504,"riflags":0,"rtt":"0.000","protocol":"UDP","guid":"this-is-random-uuid-will-be-36-chars"}
+{"iflags":"A","uflags":0,"isn":0,"ip_dst_addr":"10.0.2.3","ip_dst_port":53,"duration":"0.000","rpkt":0,"original_string":"2016-01-28 15:29:48.504|2016-01-28 15:29:48.504| 0.000| 0.000| 17| 10.0.2.15|56303| 10.0.2.3| 53| A| 0| 0| 0|00000000|00000000|000|000| 1| 56| 0| 0| 0|idle","pkt":1,"ruflags":0,"roct":0,"ip_src_addr":"10.0.2.15","tag":0,"rtag":0,"ip_src_port":56303,"timestamp":1453994988504,"app":0,"oct":56,"end_reason":"idle","risn":0,"end_time":1453994988504,"source.type":"yaf","start_time":1453994988504,"riflags":0,"rtt":"0.000","protocol":"UDP","guid":"this-is-random-uuid-will-be-36-chars"}
+{"iflags":"A","uflags":0,"isn":0,"ip_dst_addr":"10.0.2.15","ip_dst_port":56303,"duration":"0.000","rpkt":0,"original_string":"2016-01-28 15:29:48.506|2016-01-28 15:29:48.506| 0.000| 0.000| 17| 10.0.2.3| 53| 10.0.2.15|56303| A| 0| 0| 0|00000000|00000000|000|000| 1| 84| 0| 0| 0|idle","pkt":1,"ruflags":0,"roct":0,"ip_src_addr":"10.0.2.3","tag":0,"rtag":0,"ip_src_port":53,"timestamp":1453994988506,"app":0,"oct":84,"end_reason":"idle","risn":0,"end_time":1453994988506,"source.type":"yaf","start_time":1453994988506,"riflags":0,"rtt":"0.000","protocol":"UDP","guid":"this-is-random-uuid-will-be-36-chars"}
+{"iflags":"S","uflags":0,"isn":"58c52fca","ip_dst_addr":"216.21.170.221","ip_dst_port":80,"duration":"0.000","rpkt":0,"original_string":"2016-01-28 15:29:48.508|2016-01-28 15:29:48.508| 0.000| 0.000| 6| 10.0.2.15|39468| 216.21.170.221| 80| S| 0| 0| 0|58c52fca|00000000|000|000| 1| 60| 0| 0| 0|idle","pkt":1,"ruflags":0,"roct":0,"ip_src_addr":"10.0.2.15","tag":0,"rtag":0,"ip_src_port":39468,"timestamp":1453994988508,"app":0,"oct":60,"end_reason":"idle","risn":0,"end_time":1453994988508,"source.type":"yaf","start_time":1453994988508,"riflags":0,"rtt":"0.000","protocol":"TCP","guid":"this-is-random-uuid-will-be-36-chars"}
+{"iflags":"A","uflags":0,"isn":"58c52fcb","ip_dst_addr":"216.21.170.221","ip_dst_port":80,"duration":"0.000","rpkt":0,"original_string":"2016-01-28 15:29:48.512|2016-01-28 15:29:48.512| 0.000| 0.000| 6| 10.0.2.15|39468| 216.21.170.221| 80| A| 0| 0| 0|58c52fcb|00000000|000|000| 1| 40| 0| 0| 0|idle ","pkt":1,"ruflags":0,"roct":0,"ip_src_addr":"10.0.2.15","tag":0,"rtag":0,"ip_src_port":39468,"timestamp":1453994988512,"app":0,"oct":40,"end_reason":"idle ","risn":0,"end_time":1453994988512,"source.type":"yaf","start_time":1453994988512,"riflags":0,"rtt":"0.000","protocol":"TCP","guid":"this-is-random-uuid-will-be-36-chars"}
+{"iflags":"AP","uflags":0,"isn":"58c52fcb","ip_dst_addr":"216.21.170.221","ip_dst_port":80,"duration":"0.000","rpkt":0,"original_string":"2016-01-28 15:29:48.512|2016-01-28 15:29:48.512| 0.000| 0.000| 6| 10.0.2.15|39468| 216.21.170.221| 80| AP| 0| 0| 0|58c52fcb|00000000|000|000| 1| 148| 0| 0| 0|idle ","pkt":1,"ruflags":0,"roct":0,"ip_src_addr":"10.0.2.15","tag":0,"rtag":0,"ip_src_port":39468,"timestamp":1453994988512,"app":0,"oct":148,"end_reason":"idle ","risn":0,"end_time":1453994988512,"source.type":"yaf","start_time":1453994988512,"riflags":0,"rtt":"0.000","protocol":"TCP","guid":"this-is-random-uuid-will-be-36-chars"}
+{"iflags":"A","uflags":0,"isn":"22efa002","ip_dst_addr":"10.0.2.15","ip_dst_port":39468,"duration":"0.000","rpkt":0,"original_string":"2016-01-28 15:29:48.512|2016-01-28 15:29:48.512| 0.000| 0.000| 6| 216.21.170.221| 80| 10.0.2.15|39468| A| 0| 0| 0|22efa002|00000000|000|000| 1| 40| 0| 0| 0|idle ","pkt":1,"ruflags":0,"roct":0,"ip_src_addr":"216.21.170.221","tag":0,"rtag":0,"ip_src_port":80,"timestamp":1453994988512,"app":0,"oct":40,"end_reason":"idle ","risn":0,"end_time":1453994988512,"source.type":"yaf","start_time":1453994988512,"riflags":0,"rtt":"0.000","protocol":"TCP","guid":"this-is-random-uuid-will-be-36-chars"}
+{"iflags":"AP","uflags":0,"isn":"22efa002","ip_dst_addr":"10.0.2.15","ip_dst_port":39468,"duration":"0.000","rpkt":0,"original_string":"2016-01-28 15:29:48.562|2016-01-28 15:29:48.562| 0.000| 0.000| 6| 216.21.170.221| 80| 10.0.2.15|39468| AP| 0| 0| 0|22efa002|00000000|000|000| 1| 604| 0| 0| 0|idle","pkt":1,"ruflags":0,"roct":0,"ip_src_addr":"216.21.170.221","tag":0,"rtag":0,"ip_src_port":80,"timestamp":1453994988562,"app":0,"oct":604,"end_reason":"idle","risn":0,"end_time":1453994988562,"source.type":"yaf","start_time":1453994988562,"riflags":0,"rtt":"0.000","protocol":"TCP","guid":"this-is-random-uuid-will-be-36-chars"}
http://git-wip-us.apache.org/repos/asf/incubator-metron/blob/27b0d6e3/metron-platform/metron-parsers/src/main/java/org/apache/metron/parsers/bolt/ParserBolt.java
----------------------------------------------------------------------
diff --git a/metron-platform/metron-parsers/src/main/java/org/apache/metron/parsers/bolt/ParserBolt.java b/metron-platform/metron-parsers/src/main/java/org/apache/metron/parsers/bolt/ParserBolt.java
index 0b1ea3d..e73b836 100644
--- a/metron-platform/metron-parsers/src/main/java/org/apache/metron/parsers/bolt/ParserBolt.java
+++ b/metron-platform/metron-parsers/src/main/java/org/apache/metron/parsers/bolt/ParserBolt.java
@@ -49,6 +49,7 @@ import java.util.List;
import java.util.Map;
import java.util.Optional;
import java.util.Set;
+import java.util.UUID;
import java.util.stream.Collectors;
public class ParserBolt extends ConfiguredParserBolt implements Serializable {
@@ -137,6 +138,9 @@ public class ParserBolt extends ConfiguredParserBolt implements Serializable {
handler.transformAndUpdate(message, sensorParserConfig.getParserConfig(), stellarContext);
}
}
+ if(!message.containsKey(Constants.GUID)) {
+ message.put(Constants.GUID, UUID.randomUUID().toString());
+ }
if (parser.validate(message) && (filter == null || filter.emitTuple(message, stellarContext))) {
numWritten++;
List<FieldValidator> failedValidators = getFailedValidators(message, fieldValidations);
http://git-wip-us.apache.org/repos/asf/incubator-metron/blob/27b0d6e3/metron-platform/metron-parsers/src/test/java/org/apache/metron/parsers/bolt/ParserBoltTest.java
----------------------------------------------------------------------
diff --git a/metron-platform/metron-parsers/src/test/java/org/apache/metron/parsers/bolt/ParserBoltTest.java b/metron-platform/metron-parsers/src/test/java/org/apache/metron/parsers/bolt/ParserBoltTest.java
index b3e15b2..e924d50 100644
--- a/metron-platform/metron-parsers/src/test/java/org/apache/metron/parsers/bolt/ParserBoltTest.java
+++ b/metron-platform/metron-parsers/src/test/java/org/apache/metron/parsers/bolt/ParserBoltTest.java
@@ -184,7 +184,6 @@ public class ParserBoltTest extends BaseBoltTest {
}
};
}
-
};
buildGlobalConfig(parserBolt);
@@ -197,6 +196,7 @@ public class ParserBoltTest extends BaseBoltTest {
when(tuple.getBinary(0)).thenReturn(sampleBinary);
JSONObject parsedMessage = new JSONObject();
parsedMessage.put("field", "invalidValue");
+ parsedMessage.put("guid", "this-is-unique-identifier-for-tuple");
List<JSONObject> messageList = new ArrayList<>();
messageList.add(parsedMessage);
when(parser.parseOptional(sampleBinary)).thenReturn(Optional.of(messageList));
@@ -210,6 +210,7 @@ public class ParserBoltTest extends BaseBoltTest {
.addRawMessage(new JSONObject(){{
put("field", "invalidValue");
put("source.type", "yaf");
+ put("guid", "this-is-unique-identifier-for-tuple");
}});
verify(outputCollector, times(1)).emit(eq(Constants.ERROR_STREAM), argThat(new MetronErrorJSONMatcher(error.getJSONObject())));
}
@@ -234,9 +235,7 @@ public class ParserBoltTest extends BaseBoltTest {
}
};
}
-
};
-
parserBolt.setCuratorFramework(client);
parserBolt.setTreeCache(cache);
parserBolt.prepare(new HashMap(), topologyContext, outputCollector);
@@ -244,14 +243,14 @@ public class ParserBoltTest extends BaseBoltTest {
verify(writer, times(1)).init();
byte[] sampleBinary = "some binary message".getBytes();
JSONParser jsonParser = new JSONParser();
- final JSONObject sampleMessage1 = (JSONObject) jsonParser.parse("{ \"field1\":\"value1\" }");
- final JSONObject sampleMessage2 = (JSONObject) jsonParser.parse("{ \"field2\":\"value2\" }");
+ final JSONObject sampleMessage1 = (JSONObject) jsonParser.parse("{ \"field1\":\"value1\", \"guid\": \"this-is-unique-identifier-for-tuple\" }");
+ final JSONObject sampleMessage2 = (JSONObject) jsonParser.parse("{ \"field2\":\"value2\", \"guid\": \"this-is-unique-identifier-for-tuple\" }");
List<JSONObject> messages = new ArrayList<JSONObject>() {{
add(sampleMessage1);
add(sampleMessage2);
}};
- final JSONObject finalMessage1 = (JSONObject) jsonParser.parse("{ \"field1\":\"value1\", \"source.type\":\"" + sensorType + "\" }");
- final JSONObject finalMessage2 = (JSONObject) jsonParser.parse("{ \"field2\":\"value2\", \"source.type\":\"" + sensorType + "\" }");
+ final JSONObject finalMessage1 = (JSONObject) jsonParser.parse("{ \"field1\":\"value1\", \"source.type\":\"" + sensorType + "\", \"guid\": \"this-is-unique-identifier-for-tuple\" }");
+ final JSONObject finalMessage2 = (JSONObject) jsonParser.parse("{ \"field2\":\"value2\", \"source.type\":\"" + sensorType + "\", \"guid\": \"this-is-unique-identifier-for-tuple\" }");
when(tuple.getBinary(0)).thenReturn(sampleBinary);
when(parser.parseOptional(sampleBinary)).thenReturn(Optional.of(messages));
when(parser.validate(eq(messages.get(0)))).thenReturn(true);
http://git-wip-us.apache.org/repos/asf/incubator-metron/blob/27b0d6e3/metron-platform/metron-parsers/src/test/java/org/apache/metron/writers/integration/SimpleHbaseEnrichmentWriterIntegrationTest.java
----------------------------------------------------------------------
diff --git a/metron-platform/metron-parsers/src/test/java/org/apache/metron/writers/integration/SimpleHbaseEnrichmentWriterIntegrationTest.java b/metron-platform/metron-parsers/src/test/java/org/apache/metron/writers/integration/SimpleHbaseEnrichmentWriterIntegrationTest.java
index 2c44a08..4efe28b 100644
--- a/metron-platform/metron-parsers/src/test/java/org/apache/metron/writers/integration/SimpleHbaseEnrichmentWriterIntegrationTest.java
+++ b/metron-platform/metron-parsers/src/test/java/org/apache/metron/writers/integration/SimpleHbaseEnrichmentWriterIntegrationTest.java
@@ -157,7 +157,7 @@ public class SimpleHbaseEnrichmentWriterIntegrationTest extends BaseIntegrationT
for (Map.Entry<String, String> x : metadata.entrySet()) {
Assert.assertEquals(kv.getValue().getMetadata().get(x.getKey()), x.getValue());
}
- Assert.assertEquals(metadata.size() + 3, kv.getValue().getMetadata().size());
+ Assert.assertEquals(metadata.size() + 4, kv.getValue().getMetadata().size());
}
}
finally {
http://git-wip-us.apache.org/repos/asf/incubator-metron/blob/27b0d6e3/metron-platform/metron-test-utilities/src/main/java/org/apache/metron/test/utils/ValidationUtils.java
----------------------------------------------------------------------
diff --git a/metron-platform/metron-test-utilities/src/main/java/org/apache/metron/test/utils/ValidationUtils.java b/metron-platform/metron-test-utilities/src/main/java/org/apache/metron/test/utils/ValidationUtils.java
index e08c697..279caa3 100644
--- a/metron-platform/metron-test-utilities/src/main/java/org/apache/metron/test/utils/ValidationUtils.java
+++ b/metron-platform/metron-test-utilities/src/main/java/org/apache/metron/test/utils/ValidationUtils.java
@@ -36,7 +36,7 @@ public class ValidationUtils {
if(v2 == null) {
Assert.fail("Unable to find key: " + k + " in output");
}
- if(k.equals("timestamp")) {
+ if(k.equals("timestamp") || k.equals("guid")) {
//TODO: Take the ?!?@ timestamps out of the reference file.
Assert.assertEquals(v1.toString().length(), v2.toString().length());
}
[2/3] incubator-metron git commit: METRON-765: Add GUID to messages
(iraghumitra via cestella) closes apache/incubator-metron#483
Posted by ce...@apache.org.
http://git-wip-us.apache.org/repos/asf/incubator-metron/blob/27b0d6e3/metron-platform/metron-integration-test/src/main/sample/data/asa/parsed/asa_parsed
----------------------------------------------------------------------
diff --git a/metron-platform/metron-integration-test/src/main/sample/data/asa/parsed/asa_parsed b/metron-platform/metron-integration-test/src/main/sample/data/asa/parsed/asa_parsed
index 5c097ec..bbf4cd0 100755
--- a/metron-platform/metron-integration-test/src/main/sample/data/asa/parsed/asa_parsed
+++ b/metron-platform/metron-integration-test/src/main/sample/data/asa/parsed/asa_parsed
@@ -1,128 +1,128 @@
-{"syslog_host":"10.22.8.216","original_string":"<167>Jan 5 08:52:35 10.22.8.216 %ASA-7-609001: Built local-host inside:10.22.8.205","ciscotag":"ASA-7-609001","syslog_facility":"local4","syslog_severity":"debug","timestamp":1451983955000,"source.type":"asa"}
-{"syslog_host":"10.22.8.216","protocol":"icmp","original_string":"<166>Jan 5 08:52:35 10.22.8.216 %ASA-6-302021: Teardown ICMP connection for faddr 10.22.8.74\/0(LOCAL\\user.name) gaddr 10.22.8.205\/0 laddr 10.22.8.205\/0","ip_dst_addr":"10.22.8.74","ciscotag":"ASA-6-302021","syslog_facility":"local4","action":"teardown","ip_src_addr":"10.22.8.205","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa"}
-{"syslog_host":"10.22.8.216","original_string":"<167>Jan 5 08:52:35 10.22.8.216 %ASA-7-609002: Teardown local-host inside:10.22.8.205 duration 0:00:00","ciscotag":"ASA-7-609002","syslog_facility":"local4","syslog_severity":"debug","timestamp":1451983955000,"source.type":"asa"}
-{"syslog_host":"10.22.8.201","protocol":"tcp","original_string":"<142>Jan 5 08:52:35 10.22.8.201 %ASA-6-302014: Teardown TCP connection 488167725 for Outside_VPN:147.111.72.16\/26436 to DMZ-Inside:10.22.8.53\/443 duration 0:00:00 bytes 9687 TCP FINs","ip_dst_addr":"10.22.8.53","ip_src_port":26436,"ip_dst_port":443,"ciscotag":"ASA-6-302014","syslog_facility":"local1","action":"teardown","ip_src_addr":"147.111.72.16","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa"}
-{"syslog_host":"10.22.8.216","protocol":"tcp","original_string":"<166>Jan 5 08:52:35 10.22.8.216 %ASA-6-302014: Teardown TCP connection 212805593 for outside:10.22.8.223\/59614(LOCAL\\user.name) to inside:10.22.8.78\/8102 duration 0:00:07 bytes 3433 TCP FINs (user.name)","ip_dst_addr":"10.22.8.78","ip_src_port":59614,"ip_dst_port":8102,"ciscotag":"ASA-6-302014","syslog_facility":"local4","action":"teardown","ip_src_addr":"10.22.8.223","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa"}
-{"syslog_host":"10.22.8.212","protocol":"tcp","original_string":"<174>Jan 5 14:52:35 10.22.8.212 %ASA-6-302013: Built inbound TCP connection 76245503 for outside:10.22.8.233\/54209 (10.22.8.233\/54209) to inside:198.111.72.238\/443 (198.111.72.238\/443) (user.name)","ip_dst_addr":"198.111.72.238","ip_src_port":54209,"ip_dst_port":443,"ciscotag":"ASA-6-302013","syslog_facility":"local5","action":"built","ip_src_addr":"10.22.8.233","syslog_severity":"info","timestamp":1452005555000,"source.type":"asa"}
-{"syslog_host":"10.22.8.216","protocol":"tcp","original_string":"<166>Jan 5 08:52:35 10.22.8.216 %ASA-6-302013: Built inbound TCP connection 212806031 for outside:10.22.8.17\/58633 (10.22.8.17\/58633)(LOCAL\\user.name) to inside:10.22.8.12\/389 (10.22.8.12\/389) (user.name)","ip_dst_addr":"10.22.8.12","ip_src_port":58633,"ip_dst_port":389,"ciscotag":"ASA-6-302013","syslog_facility":"local4","action":"built","ip_src_addr":"10.22.8.17","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa"}
-{"syslog_host":"10.22.8.201","protocol":"tcp","original_string":"<142>Jan 5 08:52:35 10.22.8.201 %ASA-6-302014: Teardown TCP connection 488168292 for DMZ-Inside:10.22.8.51\/51231 to Inside-Trunk:10.22.8.174\/40004 duration 0:00:00 bytes 2103 TCP FINs","ip_dst_addr":"10.22.8.174","ip_src_port":51231,"ip_dst_port":40004,"ciscotag":"ASA-6-302014","syslog_facility":"local1","action":"teardown","ip_src_addr":"10.22.8.51","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa"}
-{"syslog_host":"10.22.8.201","protocol":"tcp","original_string":"<142>Jan 5 08:52:35 10.22.8.201 %ASA-6-106015: Deny TCP (no connection) from 186.111.72.11\/80 to 204.111.72.226\/45019 flags SYN ACK on interface Outside_VPN","ip_dst_addr":"204.111.72.226","ip_src_port":80,"ip_dst_port":45019,"ciscotag":"ASA-6-106015","syslog_facility":"local1","action":"deny","ip_src_addr":"186.111.72.11","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa"}
-{"syslog_host":"10.22.8.12","protocol":"tcp","original_string":"<166>Jan 5 09:52:35 10.22.8.12 %ASA-6-302014: Teardown TCP connection 17604987 for outside:209.111.72.151\/443 to inside:10.22.8.188\/64306 duration 0:00:31 bytes 10128 TCP FINs","ip_dst_addr":"10.22.8.188","ip_src_port":443,"ip_dst_port":64306,"ciscotag":"ASA-6-302014","syslog_facility":"local4","action":"teardown","ip_src_addr":"209.111.72.151","syslog_severity":"info","timestamp":1451987555000,"source.type":"asa"}
-{"syslog_host":"10.22.8.12","protocol":"tcp","original_string":"<166>Jan 5 09:52:35 10.22.8.12 %ASA-6-302014: Teardown TCP connection 17604999 for outside:209.111.72.151\/443 to inside:10.22.8.188\/64307 duration 0:00:30 bytes 6370 TCP FINs","ip_dst_addr":"10.22.8.188","ip_src_port":443,"ip_dst_port":64307,"ciscotag":"ASA-6-302014","syslog_facility":"local4","action":"teardown","ip_src_addr":"209.111.72.151","syslog_severity":"info","timestamp":1451987555000,"source.type":"asa"}
-{"syslog_host":"10.22.8.201","protocol":"tcp","original_string":"<142>Jan 5 08:52:35 10.22.8.201 %ASA-6-302014: Teardown TCP connection 488167347 for Outside_VPN:198.111.72.24\/2134 to DMZ-Inside:10.22.8.53\/443 duration 0:00:01 bytes 9785 TCP FINs","ip_dst_addr":"10.22.8.53","ip_src_port":2134,"ip_dst_port":443,"ciscotag":"ASA-6-302014","syslog_facility":"local1","action":"teardown","ip_src_addr":"198.111.72.24","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa"}
-{"syslog_host":"10.22.8.212","protocol":"udp","original_string":"<174>Jan 5 14:52:35 10.22.8.212 %ASA-6-302015: Built inbound UDP connection 76245506 for outside:10.22.8.110\/49886 (10.22.8.110\/49886) to inside:192.111.72.8\/8612 (192.111.72.8\/8612) (user.name)","ip_dst_addr":"192.111.72.8","ip_src_port":49886,"ip_dst_port":8612,"ciscotag":"ASA-6-302015","syslog_facility":"local5","action":"built","ip_src_addr":"10.22.8.110","syslog_severity":"info","timestamp":1452005555000,"source.type":"asa"}
-{"syslog_host":"10.22.8.216","protocol":"tcp","original_string":"<166>Jan 5 08:52:35 10.22.8.216 %ASA-6-302014: Teardown TCP connection 212805993 for outside:10.22.8.89\/56917(LOCAL\\user.name) to inside:216.111.72.126\/443 duration 0:00:00 bytes 0 TCP FINs (user.name)","ip_dst_addr":"216.111.72.126","ip_src_port":56917,"ip_dst_port":443,"ciscotag":"ASA-6-302014","syslog_facility":"local4","action":"teardown","ip_src_addr":"10.22.8.89","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa"}
-{"syslog_host":"10.22.8.216","protocol":"udp","original_string":"<167>Jan 5 08:52:35 10.22.8.216 %ASA-7-710005: UDP request discarded from 10.22.8.223\/49192 to outside:224.111.72.252\/5355","ip_dst_addr":"224.111.72.252","ip_src_port":49192,"ip_dst_port":5355,"ciscotag":"ASA-7-710005","syslog_facility":"local4","action":"discarded","ip_src_addr":"10.22.8.223","syslog_severity":"debug","timestamp":1451983955000,"source.type":"asa"}
-{"syslog_host":"10.22.8.201","protocol":"tcp","original_string":"<142>Jan 5 08:52:35 10.22.8.201 %ASA-6-302014: Teardown TCP connection 488166143 for Outside_VPN:198.111.72.64\/80 to Inside-Trunk:10.22.8.39\/54883 duration 0:00:04 bytes 1148 TCP FINs","ip_dst_addr":"10.22.8.39","ip_src_port":80,"ip_dst_port":54883,"ciscotag":"ASA-6-302014","syslog_facility":"local1","action":"teardown","ip_src_addr":"198.111.72.64","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa"}
-{"syslog_host":"10.22.8.216","protocol":"tcp","original_string":"<166>Jan 5 08:52:35 10.22.8.216 %ASA-6-106015: Deny TCP (no connection) from 10.22.8.84\/445 to 10.22.8.219\/60726 flags ACK on interface inside","ip_dst_addr":"10.22.8.219","ip_src_port":445,"ip_dst_port":60726,"ciscotag":"ASA-6-106015","syslog_facility":"local4","action":"deny","ip_src_addr":"10.22.8.84","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa"}
-{"syslog_host":"10.22.8.201","protocol":"tcp","original_string":"<142>Jan 5 08:52:35 10.22.8.201 %ASA-6-302014: Teardown TCP connection 488168344 for DMZ-Inside:10.22.8.53\/61682 to Inside-Trunk:10.22.8.174\/40004 duration 0:00:00 bytes 5648 TCP FINs","ip_dst_addr":"10.22.8.174","ip_src_port":61682,"ip_dst_port":40004,"ciscotag":"ASA-6-302014","syslog_facility":"local1","action":"teardown","ip_src_addr":"10.22.8.53","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa"}
-{"syslog_host":"10.22.8.201","protocol":"tcp","original_string":"<142>Jan 5 08:52:35 10.22.8.201 %ASA-6-302014: Teardown TCP connection 488168345 for DMZ-Inside:10.22.8.16\/31454 to Inside-Trunk:10.22.8.21\/443 duration 0:00:00 bytes 756 TCP FINs","ip_dst_addr":"10.22.8.21","ip_src_port":31454,"ip_dst_port":443,"ciscotag":"ASA-6-302014","syslog_facility":"local1","action":"teardown","ip_src_addr":"10.22.8.16","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa"}
-{"syslog_host":"10.22.8.4","protocol":"icmp","original_string":"<182>Jan 5 20:22:35 10.22.8.4 %ASA-6-302020: Built inbound ICMP connection for faddr 10.22.8.12\/0 gaddr 10.22.8.45\/1 laddr 10.22.8.45\/1","ip_dst_addr":"10.22.8.12","ciscotag":"ASA-6-302020","syslog_facility":"local6","action":"built","ip_src_addr":"10.22.8.45","syslog_severity":"info","timestamp":1452025355000,"source.type":"asa"}
-{"syslog_host":"10.22.8.201","protocol":"tcp","original_string":"<142>Jan 5 08:52:35 10.22.8.201 %ASA-6-106015: Deny TCP (no connection) from 50.111.72.230\/80 to 204.111.72.254\/53077 flags RST on interface Outside_VPN","ip_dst_addr":"204.111.72.254","ip_src_port":80,"ip_dst_port":53077,"ciscotag":"ASA-6-106015","syslog_facility":"local1","action":"deny","ip_src_addr":"50.111.72.230","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa"}
-{"syslog_host":"10.22.8.12","protocol":"udp","original_string":"<166>Jan 5 09:52:35 10.22.8.12 %ASA-6-302016: Teardown UDP connection 17603649 for outside:206.111.72.2\/161 to inside:10.22.8.48\/63297 duration 0:02:01 bytes 209","ip_dst_addr":"10.22.8.48","ip_src_port":161,"ip_dst_port":63297,"ciscotag":"ASA-6-302016","syslog_facility":"local4","action":"teardown","ip_src_addr":"206.111.72.2","syslog_severity":"info","timestamp":1451987555000,"source.type":"asa"}
-{"syslog_host":"10.22.8.12","protocol":"udp","original_string":"<166>Jan 5 09:52:35 10.22.8.12 %ASA-6-302016: Teardown UDP connection 17603650 for outside:207.111.72.122\/161 to inside:10.22.8.48\/63298 duration 0:02:01 bytes 209","ip_dst_addr":"10.22.8.48","ip_src_port":161,"ip_dst_port":63298,"ciscotag":"ASA-6-302016","syslog_facility":"local4","action":"teardown","ip_src_addr":"207.111.72.122","syslog_severity":"info","timestamp":1451987555000,"source.type":"asa"}
-{"syslog_host":"10.22.8.12","protocol":"udp","original_string":"<166>Jan 5 09:52:35 10.22.8.12 %ASA-6-302016: Teardown UDP connection 17603652 for outside:206.111.72.2\/161 to inside:10.22.8.48\/63300 duration 0:02:01 bytes 115","ip_dst_addr":"10.22.8.48","ip_src_port":161,"ip_dst_port":63300,"ciscotag":"ASA-6-302016","syslog_facility":"local4","action":"teardown","ip_src_addr":"206.111.72.2","syslog_severity":"info","timestamp":1451987555000,"source.type":"asa"}
-{"syslog_host":"10.22.8.12","protocol":"udp","original_string":"<166>Jan 5 09:52:35 10.22.8.12 %ASA-6-302016: Teardown UDP connection 17603657 for outside:206.111.72.2\/161 to inside:10.22.8.48\/63306 duration 0:02:01 bytes 115","ip_dst_addr":"10.22.8.48","ip_src_port":161,"ip_dst_port":63306,"ciscotag":"ASA-6-302016","syslog_facility":"local4","action":"teardown","ip_src_addr":"206.111.72.2","syslog_severity":"info","timestamp":1451987555000,"source.type":"asa"}
-{"syslog_host":"10.22.8.201","protocol":"tcp","original_string":"<142>Jan 5 08:52:35 10.22.8.201 %ASA-6-302014: Teardown TCP connection 488168436 for DMZ-Inside:10.22.8.51\/51235 to Inside-Trunk:10.22.8.174\/40004 duration 0:00:00 bytes 2497 TCP FINs","ip_dst_addr":"10.22.8.174","ip_src_port":51235,"ip_dst_port":40004,"ciscotag":"ASA-6-302014","syslog_facility":"local1","action":"teardown","ip_src_addr":"10.22.8.51","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa"}
-{"syslog_host":"10.22.8.201","protocol":"tcp","original_string":"<142>Jan 5 08:52:35 10.22.8.201 %ASA-6-302014: Teardown TCP connection 488167656 for Outside_VPN:69.111.72.70\/21560 to DMZ-Inside:10.22.8.53\/443 duration 0:00:01 bytes 11410 TCP FINs","ip_dst_addr":"10.22.8.53","ip_src_port":21560,"ip_dst_port":443,"ciscotag":"ASA-6-302014","syslog_facility":"local1","action":"teardown","ip_src_addr":"69.111.72.70","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa"}
-{"syslog_host":"10.22.8.216","protocol":"udp","original_string":"<166>Jan 5 08:52:35 10.22.8.216 %ASA-6-302015: Built inbound UDP connection 212806050 for outside:10.22.8.62\/53965 (10.22.8.62\/53965)(LOCAL\\user.name) to inside:10.22.8.85\/53 (10.22.8.85\/53) (user.name)","ip_dst_addr":"10.22.8.85","ip_src_port":53965,"ip_dst_port":53,"ciscotag":"ASA-6-302015","syslog_facility":"local4","action":"built","ip_src_addr":"10.22.8.62","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa"}
-{"syslog_host":"10.22.8.216","protocol":"tcp","original_string":"<166>Jan 5 08:52:35 10.22.8.216 %ASA-6-302013: Built inbound TCP connection 212806052 for outside:10.22.8.62\/56500 (10.22.8.62\/56500)(LOCAL\\user.name) to inside:198.111.72.83\/443 (198.111.72.83\/443) (user.name)","ip_dst_addr":"198.111.72.83","ip_src_port":56500,"ip_dst_port":443,"ciscotag":"ASA-6-302013","syslog_facility":"local4","action":"built","ip_src_addr":"10.22.8.62","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa"}
-{"syslog_host":"10.22.8.216","protocol":"tcp","original_string":"<166>Jan 5 08:52:35 10.22.8.216 %ASA-6-302013: Built inbound TCP connection 212806054 for outside:10.22.8.62\/56502 (10.22.8.62\/56502)(LOCAL\\user.name) to inside:50.111.72.252\/443 (50.111.72.252\/443) (user.name)","ip_dst_addr":"50.111.72.252","ip_src_port":56502,"ip_dst_port":443,"ciscotag":"ASA-6-302013","syslog_facility":"local4","action":"built","ip_src_addr":"10.22.8.62","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa"}
-{"syslog_host":"10.22.8.12","protocol":"tcp","original_string":"<166>Jan 5 09:52:35 10.22.8.12 %ASA-6-305011: Built dynamic TCP translation from inside:10.22.8.188\/64340 to outside:206.111.72.41\/2013","ip_src_port":64340,"ciscotag":"ASA-6-305011","syslog_facility":"local4","action":"built","ip_src_addr":"10.22.8.188","syslog_severity":"info","timestamp":1451987555000,"source.type":"asa"}
-{"syslog_host":"10.22.8.33","protocol":"udp","original_string":"<166>Jan 5 15:52:35 10.22.8.33 %ASA-6-305012: Teardown dynamic UDP translation from inside:192.111.72.2\/62251 to outside:79.111.72.174\/21311 duration 0:02:30","ip_src_port":62251,"ciscotag":"ASA-6-305012","syslog_facility":"local4","action":"teardown","ip_src_addr":"192.111.72.2","syslog_severity":"info","timestamp":1452009155000,"source.type":"asa"}
-{"syslog_host":"10.22.8.216","protocol":"udp","original_string":"<166>Jan 5 08:52:35 10.22.8.216 %ASA-6-302015: Built inbound UDP connection 212806058 for outside:10.22.8.221\/56631 (10.22.8.221\/56631)(LOCAL\\user.name) to inside:10.22.8.26\/389 (10.22.8.26\/389) (user.name)","ip_dst_addr":"10.22.8.26","ip_src_port":56631,"ip_dst_port":389,"ciscotag":"ASA-6-302015","syslog_facility":"local4","action":"built","ip_src_addr":"10.22.8.221","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa"}
-{"syslog_host":"10.22.8.201","protocol":"tcp","original_string":"<142>Jan 5 08:52:35 10.22.8.201 %ASA-6-302014: Teardown TCP connection 488168189 for Outside_VPN:209.111.72.10\/56619 to DMZ-Inside:10.22.8.53\/443 duration 0:00:00 bytes 2477 TCP FINs","ip_dst_addr":"10.22.8.53","ip_src_port":56619,"ip_dst_port":443,"ciscotag":"ASA-6-302014","syslog_facility":"local1","action":"teardown","ip_src_addr":"209.111.72.10","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa"}
-{"syslog_host":"10.22.8.201","protocol":"tcp","original_string":"<142>Jan 5 08:52:35 10.22.8.201 %ASA-6-106015: Deny TCP (no connection) from 10.22.8.112\/52235 to 198.111.72.227\/80 flags ACK on interface Inside-Trunk","ip_dst_addr":"198.111.72.227","ip_src_port":52235,"ip_dst_port":80,"ciscotag":"ASA-6-106015","syslog_facility":"local1","action":"deny","ip_src_addr":"10.22.8.112","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa"}
-{"syslog_host":"10.22.8.201","protocol":"tcp","original_string":"<142>Jan 5 08:52:35 10.22.8.201 %ASA-6-302014: Teardown TCP connection 488167192 for Outside_VPN:115.111.72.7\/49196 to DMZ-Inside:10.22.8.57\/443 duration 0:00:02 bytes 20588 TCP Reset-O","ip_dst_addr":"10.22.8.57","ip_src_port":49196,"ip_dst_port":443,"ciscotag":"ASA-6-302014","syslog_facility":"local1","action":"teardown","ip_src_addr":"115.111.72.7","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa"}
-{"syslog_host":"10.22.8.216","protocol":"udp","original_string":"<166>Jan 5 08:52:35 10.22.8.216 %ASA-6-302016: Teardown UDP connection 212806055 for outside:10.22.8.62\/55383(LOCAL\\user.name) to inside:10.22.8.85\/53 duration 0:00:00 bytes 349 (user.name)","ip_dst_addr":"10.22.8.85","ip_src_port":55383,"ip_dst_port":53,"ciscotag":"ASA-6-302016","syslog_facility":"local4","action":"teardown","ip_src_addr":"10.22.8.62","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa"}
-{"syslog_host":"10.22.8.201","protocol":"tcp","original_string":"<142>Jan 5 08:52:35 10.22.8.201 %ASA-6-302014: Teardown TCP connection 488168380 for Outside_VPN:74.111.72.12\/443 to Inside-Trunk:10.22.8.39\/54894 duration 0:00:00 bytes 5701 TCP FINs","ip_dst_addr":"10.22.8.39","ip_src_port":443,"ip_dst_port":54894,"ciscotag":"ASA-6-302014","syslog_facility":"local1","action":"teardown","ip_src_addr":"74.111.72.12","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa"}
-{"syslog_host":"10.22.8.212","protocol":"tcp","original_string":"<174>Jan 5 14:52:35 10.22.8.212 %ASA-6-302013: Built inbound TCP connection 76245522 for outside:10.22.8.147\/56343 (10.22.8.147\/56343) to inside:209.111.72.151\/443 (209.111.72.151\/443) (user.name)","ip_dst_addr":"209.111.72.151","ip_src_port":56343,"ip_dst_port":443,"ciscotag":"ASA-6-302013","syslog_facility":"local5","action":"built","ip_src_addr":"10.22.8.147","syslog_severity":"info","timestamp":1452005555000,"source.type":"asa"}
-{"syslog_host":"10.22.8.201","protocol":"tcp","original_string":"<142>Jan 5 08:52:35 10.22.8.201 %ASA-6-302014: Teardown TCP connection 488168443 for Outside_VPN:23.111.72.27\/80 to Inside-Trunk:10.22.8.81\/64713 duration 0:00:00 bytes 2426 TCP FINs","ip_dst_addr":"10.22.8.81","ip_src_port":80,"ip_dst_port":64713,"ciscotag":"ASA-6-302014","syslog_facility":"local1","action":"teardown","ip_src_addr":"23.111.72.27","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa"}
-{"syslog_host":"10.22.8.201","protocol":"tcp","original_string":"<142>Jan 5 08:52:35 10.22.8.201 %ASA-6-302014: Teardown TCP connection 488111566 for Outside_VPN:131.111.72.49\/443 to Inside-Trunk:10.22.8.127\/56558 duration 0:01:57 bytes 3614 TCP Reset-O","ip_dst_addr":"10.22.8.127","ip_src_port":443,"ip_dst_port":56558,"ciscotag":"ASA-6-302014","syslog_facility":"local1","action":"teardown","ip_src_addr":"131.111.72.49","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa"}
-{"syslog_host":"10.22.8.216","protocol":"tcp","original_string":"<166>Jan 5 08:52:35 10.22.8.216 %ASA-6-302013: Built inbound TCP connection 212806061 for outside:10.22.8.17\/58635 (10.22.8.17\/58635)(LOCAL\\user.name) to inside:10.22.8.12\/389 (10.22.8.12\/389) (user.name)","ip_dst_addr":"10.22.8.12","ip_src_port":58635,"ip_dst_port":389,"ciscotag":"ASA-6-302013","syslog_facility":"local4","action":"built","ip_src_addr":"10.22.8.17","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa"}
-{"syslog_host":"10.22.8.216","protocol":"tcp","original_string":"<166>Jan 5 08:52:35 10.22.8.216 %ASA-6-302014: Teardown TCP connection 212806010 for outside:10.22.8.33\/60223(LOCAL\\user.name) to inside:10.22.8.86\/389 duration 0:00:00 bytes 416 TCP Reset-I (user.name)","ip_dst_addr":"10.22.8.86","ip_src_port":60223,"ip_dst_port":389,"ciscotag":"ASA-6-302014","syslog_facility":"local4","action":"teardown","ip_src_addr":"10.22.8.33","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa"}
-{"syslog_host":"10.22.8.216","protocol":"udp","original_string":"<166>Jan 5 08:52:35 10.22.8.216 %ASA-6-302015: Built inbound UDP connection 212806062 for outside:10.22.8.221\/56632 (10.22.8.221\/56632)(LOCAL\\user.name) to inside:10.22.8.73\/389 (10.22.8.73\/389) (user.name)","ip_dst_addr":"10.22.8.73","ip_src_port":56632,"ip_dst_port":389,"ciscotag":"ASA-6-302015","syslog_facility":"local4","action":"built","ip_src_addr":"10.22.8.221","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa"}
-{"syslog_host":"10.22.8.216","original_string":"<167>Jan 5 08:52:35 10.22.8.216 %ASA-7-609002: Teardown local-host inside:10.22.8.205 duration 0:00:00","ciscotag":"ASA-7-609002","syslog_facility":"local4","syslog_severity":"debug","timestamp":1451983955000,"source.type":"asa"}
-{"syslog_host":"10.22.8.201","protocol":"tcp","original_string":"<142>Jan 5 08:52:35 10.22.8.201 %ASA-6-302014: Teardown TCP connection 488168231 for Outside_VPN:204.111.72.243\/3011 to Inside-Trunk:10.22.8.208\/60037 duration 0:00:00 bytes 19415 TCP FINs","ip_dst_addr":"10.22.8.208","ip_src_port":3011,"ip_dst_port":60037,"ciscotag":"ASA-6-302014","syslog_facility":"local1","action":"teardown","ip_src_addr":"204.111.72.243","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa"}
-{"syslog_host":"10.22.8.41","protocol":"tcp","original_string":"<166>Jan 5 16:52:35 10.22.8.41 %ASA-6-302013: Built inbound TCP connection 45476108 for Outside:10.22.8.97\/53484 (10.22.8.97\/53484)(LOCAL\\user.name) to Inside:141.111.72.70\/7576 (141.111.72.70\/7576) (user.name)","ip_dst_addr":"141.111.72.70","ip_src_port":53484,"ip_dst_port":7576,"ciscotag":"ASA-6-302013","syslog_facility":"local4","action":"built","ip_src_addr":"10.22.8.97","syslog_severity":"info","timestamp":1452012755000,"source.type":"asa"}
-{"syslog_host":"10.22.8.212","protocol":"tcp","original_string":"<174>Jan 5 14:52:35 10.22.8.212 %ASA-6-302013: Built inbound TCP connection 76245527 for outside:10.22.8.97\/65195 (10.22.8.97\/65195) to inside:17.111.72.212\/5223 (17.111.72.212\/5223) (user.name)","ip_dst_addr":"17.111.72.212","ip_src_port":65195,"ip_dst_port":5223,"ciscotag":"ASA-6-302013","syslog_facility":"local5","action":"built","ip_src_addr":"10.22.8.97","syslog_severity":"info","timestamp":1452005555000,"source.type":"asa"}
-{"syslog_host":"10.22.8.216","protocol":"tcp","original_string":"<166>Jan 5 08:52:35 10.22.8.216 %ASA-6-302014: Teardown TCP connection 212806018 for outside:10.22.8.17\/58632(LOCAL\\user.name) to inside:10.22.8.12\/389 duration 0:00:00 bytes 0 TCP FINs (user.name)","ip_dst_addr":"10.22.8.12","ip_src_port":58632,"ip_dst_port":389,"ciscotag":"ASA-6-302014","syslog_facility":"local4","action":"teardown","ip_src_addr":"10.22.8.17","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa"}
-{"syslog_host":"10.22.8.201","protocol":"tcp","original_string":"<142>Jan 5 08:52:35 10.22.8.201 %ASA-6-302014: Teardown TCP connection 488168562 for DMZ-Inside:10.22.8.51\/51236 to Inside-Trunk:10.22.8.174\/40004 duration 0:00:00 bytes 2273 TCP FINs","ip_dst_addr":"10.22.8.174","ip_src_port":51236,"ip_dst_port":40004,"ciscotag":"ASA-6-302014","syslog_facility":"local1","action":"teardown","ip_src_addr":"10.22.8.51","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa"}
-{"syslog_host":"10.22.8.216","protocol":"udp","original_string":"<166>Jan 5 08:52:35 10.22.8.216 %ASA-6-302015: Built inbound UDP connection 212806065 for outside:10.22.8.62\/59829 (10.22.8.62\/59829)(LOCAL\\user.name) to inside:10.22.8.85\/53 (10.22.8.85\/53) (user.name)","ip_dst_addr":"10.22.8.85","ip_src_port":59829,"ip_dst_port":53,"ciscotag":"ASA-6-302015","syslog_facility":"local4","action":"built","ip_src_addr":"10.22.8.62","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa"}
-{"syslog_host":"10.22.8.216","protocol":"tcp","original_string":"<166>Jan 5 08:52:35 10.22.8.216 %ASA-6-302013: Built inbound TCP connection 212806067 for outside:10.22.8.143\/62675 (10.22.8.143\/62675)(LOCAL\\user.name) to inside:141.111.72.12\/389 (141.111.72.12\/389) (user.name)","ip_dst_addr":"141.111.72.12","ip_src_port":62675,"ip_dst_port":389,"ciscotag":"ASA-6-302013","syslog_facility":"local4","action":"built","ip_src_addr":"10.22.8.143","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa"}
-{"syslog_host":"10.22.8.216","protocol":"udp","original_string":"<167>Jan 5 08:52:35 10.22.8.216 %ASA-7-710005: UDP request discarded from 10.22.8.223\/61122 to outside:224.111.72.252\/5355","ip_dst_addr":"224.111.72.252","ip_src_port":61122,"ip_dst_port":5355,"ciscotag":"ASA-7-710005","syslog_facility":"local4","action":"discarded","ip_src_addr":"10.22.8.223","syslog_severity":"debug","timestamp":1451983955000,"source.type":"asa"}
-{"syslog_host":"10.22.8.216","protocol":"icmp","original_string":"<166>Jan 5 08:52:35 10.22.8.216 %ASA-6-302020: Built inbound ICMP connection for faddr 10.22.8.143\/0(LOCAL\\user.name) gaddr 141.111.72.12\/0 laddr 141.111.72.12\/0 (user.name)","ip_dst_addr":"10.22.8.143","ciscotag":"ASA-6-302020","syslog_facility":"local4","action":"built","ip_src_addr":"141.111.72.12","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa"}
-{"syslog_host":"10.22.8.201","protocol":"tcp","original_string":"<142>Jan 5 08:52:35 10.22.8.201 %ASA-6-302014: Teardown TCP connection 488168547 for Outside_VPN:107.111.72.102\/80 to Inside-Trunk:10.22.8.54\/61676 duration 0:00:00 bytes 1030 TCP FINs","ip_dst_addr":"10.22.8.54","ip_src_port":80,"ip_dst_port":61676,"ciscotag":"ASA-6-302014","syslog_facility":"local1","action":"teardown","ip_src_addr":"107.111.72.102","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa"}
-{"syslog_host":"10.22.8.216","protocol":"udp","original_string":"<166>Jan 5 08:52:35 10.22.8.216 %ASA-6-302015: Built inbound UDP connection 212806078 for outside:10.22.8.221\/56633 (10.22.8.221\/56633)(LOCAL\\user.name) to inside:10.22.8.20\/389 (10.22.8.20\/389) (user.name)","ip_dst_addr":"10.22.8.20","ip_src_port":56633,"ip_dst_port":389,"ciscotag":"ASA-6-302015","syslog_facility":"local4","action":"built","ip_src_addr":"10.22.8.221","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa"}
-{"syslog_host":"10.22.8.12","protocol":"tcp","original_string":"<166>Jan 5 09:52:35 10.22.8.12 %ASA-6-305011: Built dynamic TCP translation from inside:10.22.8.83\/59915 to outside:206.111.72.41\/22776","ip_src_port":59915,"ciscotag":"ASA-6-305011","syslog_facility":"local4","action":"built","ip_src_addr":"10.22.8.83","syslog_severity":"info","timestamp":1451987555000,"source.type":"asa"}
-{"syslog_host":"10.22.8.201","protocol":"tcp","original_string":"<142>Jan 5 08:52:36 10.22.8.201 %ASA-6-302014: Teardown TCP connection 488168044 for Outside_VPN:50.111.72.39\/80 to Inside-Trunk:10.22.8.75\/60877 duration 0:00:01 bytes 13304 TCP FINs","ip_dst_addr":"10.22.8.75","ip_src_port":80,"ip_dst_port":60877,"ciscotag":"ASA-6-302014","syslog_facility":"local1","action":"teardown","ip_src_addr":"50.111.72.39","syslog_severity":"info","timestamp":1451983956000,"source.type":"asa"}
-{"syslog_host":"10.22.8.201","protocol":"tcp","original_string":"<142>Jan 5 08:52:36 10.22.8.201 %ASA-6-302014: Teardown TCP connection 488118326 for Outside_VPN:23.111.72.27\/80 to Inside-Trunk:10.22.8.229\/57901 duration 0:01:45 bytes 1942 TCP FINs","ip_dst_addr":"10.22.8.229","ip_src_port":80,"ip_dst_port":57901,"ciscotag":"ASA-6-302014","syslog_facility":"local1","action":"teardown","ip_src_addr":"23.111.72.27","syslog_severity":"info","timestamp":1451983956000,"source.type":"asa"}
-{"syslog_host":"10.22.8.201","protocol":"tcp","original_string":"<142>Jan 5 08:52:36 10.22.8.201 %ASA-6-302014: Teardown TCP connection 488160565 for Outside_VPN:72.111.72.29\/80 to Inside-Trunk:10.22.8.42\/57520 duration 0:00:15 bytes 1025 TCP FINs","ip_dst_addr":"10.22.8.42","ip_src_port":80,"ip_dst_port":57520,"ciscotag":"ASA-6-302014","syslog_facility":"local1","action":"teardown","ip_src_addr":"72.111.72.29","syslog_severity":"info","timestamp":1451983956000,"source.type":"asa"}
-{"syslog_host":"10.22.8.201","protocol":"tcp","original_string":"<142>Jan 5 08:52:36 10.22.8.201 %ASA-6-302014: Teardown TCP connection 488096423 for Outside_VPN:72.111.72.43\/80 to Inside-Trunk:10.22.8.127\/59096 duration 0:02:27 bytes 99347 TCP Reset-O","ip_dst_addr":"10.22.8.127","ip_src_port":80,"ip_dst_port":59096,"ciscotag":"ASA-6-302014","syslog_facility":"local1","action":"teardown","ip_src_addr":"72.111.72.43","syslog_severity":"info","timestamp":1451983956000,"source.type":"asa"}
-{"syslog_host":"10.22.8.201","protocol":"tcp","original_string":"<142>Jan 5 08:52:36 10.22.8.201 %ASA-6-302014: Teardown TCP connection 488095522 for Outside_VPN:72.111.72.43\/80 to Inside-Trunk:10.22.8.127\/59087 duration 0:02:29 bytes 154785 TCP Reset-O","ip_dst_addr":"10.22.8.127","ip_src_port":80,"ip_dst_port":59087,"ciscotag":"ASA-6-302014","syslog_facility":"local1","action":"teardown","ip_src_addr":"72.111.72.43","syslog_severity":"info","timestamp":1451983956000,"source.type":"asa"}
-{"syslog_host":"10.22.8.201","protocol":"tcp","original_string":"<142>Jan 5 08:52:36 10.22.8.201 %ASA-6-302014: Teardown TCP connection 488106557 for Outside_VPN:72.111.72.43\/80 to Inside-Trunk:10.22.8.127\/59134 duration 0:02:09 bytes 25319 TCP Reset-O","ip_dst_addr":"10.22.8.127","ip_src_port":80,"ip_dst_port":59134,"ciscotag":"ASA-6-302014","syslog_facility":"local1","action":"teardown","ip_src_addr":"72.111.72.43","syslog_severity":"info","timestamp":1451983956000,"source.type":"asa"}
-{"syslog_host":"10.22.8.201","protocol":"tcp","original_string":"<142>Jan 5 08:52:36 10.22.8.201 %ASA-6-302014: Teardown TCP connection 488096426 for Outside_VPN:72.111.72.43\/80 to Inside-Trunk:10.22.8.127\/59099 duration 0:02:27 bytes 26171 TCP Reset-O","ip_dst_addr":"10.22.8.127","ip_src_port":80,"ip_dst_port":59099,"ciscotag":"ASA-6-302014","syslog_facility":"local1","action":"teardown","ip_src_addr":"72.111.72.43","syslog_severity":"info","timestamp":1451983956000,"source.type":"asa"}
-{"syslog_host":"10.22.8.216","protocol":"tcp","original_string":"<166>Jan 5 08:52:36 10.22.8.216 %ASA-6-302014: Teardown TCP connection 212806005 for outside:10.22.8.17\/58630(LOCAL\\user.name) to inside:10.22.8.12\/389 duration 0:00:00 bytes 3942 TCP FINs (user.name)","ip_dst_addr":"10.22.8.12","ip_src_port":58630,"ip_dst_port":389,"ciscotag":"ASA-6-302014","syslog_facility":"local4","action":"teardown","ip_src_addr":"10.22.8.17","syslog_severity":"info","timestamp":1451983956000,"source.type":"asa"}
-{"syslog_host":"10.22.8.216","protocol":"udp","original_string":"<166>Jan 5 08:52:36 10.22.8.216 %ASA-6-302015: Built inbound UDP connection 212806085 for outside:10.22.8.143\/54018 (10.22.8.143\/54018)(LOCAL\\user.name) to inside:10.22.8.85\/53 (10.22.8.85\/53) (user.name)","ip_dst_addr":"10.22.8.85","ip_src_port":54018,"ip_dst_port":53,"ciscotag":"ASA-6-302015","syslog_facility":"local4","action":"built","ip_src_addr":"10.22.8.143","syslog_severity":"info","timestamp":1451983956000,"source.type":"asa"}
-{"syslog_host":"10.22.8.212","protocol":"icmp","original_string":"<174>Jan 5 14:52:36 10.22.8.212 %ASA-6-302020: Built inbound ICMP connection for faddr 10.22.8.96\/2708 gaddr 10.22.8.30\/0 laddr 10.22.8.30\/0 (user.name)","ip_dst_addr":"10.22.8.96","ciscotag":"ASA-6-302020","syslog_facility":"local5","action":"built","ip_src_addr":"10.22.8.30","syslog_severity":"info","timestamp":1452005556000,"source.type":"asa"}
-{"syslog_host":"10.22.8.212","protocol":"udp","original_string":"<174>Jan 5 14:52:36 10.22.8.212 %ASA-6-302015: Built inbound UDP connection 76245537 for outside:10.22.8.110\/49886 (10.22.8.110\/49886) to inside:192.111.72.11\/8612 (192.111.72.11\/8612) (user.name)","ip_dst_addr":"192.111.72.11","ip_src_port":49886,"ip_dst_port":8612,"ciscotag":"ASA-6-302015","syslog_facility":"local5","action":"built","ip_src_addr":"10.22.8.110","syslog_severity":"info","timestamp":1452005556000,"source.type":"asa"}
-{"syslog_host":"10.22.8.41","protocol":"tcp","original_string":"<166>Jan 5 16:52:36 10.22.8.41 %ASA-6-106015: Deny TCP (no connection) from 10.22.8.85\/58359 to 10.22.8.11\/88 flags RST ACK on interface Outside","ip_dst_addr":"10.22.8.11","ip_src_port":58359,"ip_dst_port":88,"ciscotag":"ASA-6-106015","syslog_facility":"local4","action":"deny","ip_src_addr":"10.22.8.85","syslog_severity":"info","timestamp":1452012756000,"source.type":"asa"}
-{"syslog_host":"10.22.8.216","protocol":"icmp","original_string":"<166>Jan 5 08:52:36 10.22.8.216 %ASA-6-302021: Teardown ICMP connection for faddr 10.22.8.82\/0(LOCAL\\user.name) gaddr 10.22.8.205\/0 laddr 10.22.8.205\/0","ip_dst_addr":"10.22.8.82","ciscotag":"ASA-6-302021","syslog_facility":"local4","action":"teardown","ip_src_addr":"10.22.8.205","syslog_severity":"info","timestamp":1451983956000,"source.type":"asa"}
-{"syslog_host":"10.22.8.216","protocol":"udp","original_string":"<166>Jan 5 08:52:36 10.22.8.216 %ASA-6-302016: Teardown UDP connection 212799832 for outside:10.22.8.230\/55549(LOCAL\\user.name) to inside:10.22.8.11\/389 duration 0:02:01 bytes 354 (user.name)","ip_dst_addr":"10.22.8.11","ip_src_port":55549,"ip_dst_port":389,"ciscotag":"ASA-6-302016","syslog_facility":"local4","action":"teardown","ip_src_addr":"10.22.8.230","syslog_severity":"info","timestamp":1451983956000,"source.type":"asa"}
-{"syslog_host":"10.22.8.216","protocol":"udp","original_string":"<166>Jan 5 08:52:36 10.22.8.216 %ASA-6-302016: Teardown UDP connection 212799867 for outside:10.22.8.240\/138(LOCAL\\user.name) to inside:10.22.8.255\/138 duration 0:02:01 bytes 214 (user.name)","ip_dst_addr":"10.22.8.255","ip_src_port":138,"ip_dst_port":138,"ciscotag":"ASA-6-302016","syslog_facility":"local4","action":"teardown","ip_src_addr":"10.22.8.240","syslog_severity":"info","timestamp":1451983956000,"source.type":"asa"}
-{"syslog_host":"10.22.8.216","original_string":"<167>Jan 5 08:52:36 10.22.8.216 %ASA-7-609001: Built local-host inside:67.111.72.204","ciscotag":"ASA-7-609001","syslog_facility":"local4","syslog_severity":"debug","timestamp":1451983956000,"source.type":"asa"}
-{"syslog_host":"10.22.8.212","protocol":"tcp","original_string":"<174>Jan 5 14:52:36 10.22.8.212 %ASA-6-302013: Built inbound TCP connection 76245544 for outside:10.22.8.227\/54540 (10.22.8.227\/54540) to inside:63.111.72.124\/80 (63.111.72.124\/80) (user.name)","ip_dst_addr":"63.111.72.124","ip_src_port":54540,"ip_dst_port":80,"ciscotag":"ASA-6-302013","syslog_facility":"local5","action":"built","ip_src_addr":"10.22.8.227","syslog_severity":"info","timestamp":1452005556000,"source.type":"asa"}
-{"syslog_host":"10.22.8.201","protocol":"tcp","original_string":"<142>Jan 5 08:52:36 10.22.8.201 %ASA-6-302014: Teardown TCP connection 488168135 for Outside_VPN:198.111.72.66\/36797 to DMZ-Inside:10.22.8.53\/80 duration 0:00:01 bytes 89039 TCP FINs","ip_dst_addr":"10.22.8.53","ip_src_port":36797,"ip_dst_port":80,"ciscotag":"ASA-6-302014","syslog_facility":"local1","action":"teardown","ip_src_addr":"198.111.72.66","syslog_severity":"info","timestamp":1451983956000,"source.type":"asa"}
-{"syslog_host":"10.22.8.216","protocol":"tcp","original_string":"<166>Jan 5 08:52:36 10.22.8.216 %ASA-6-302014: Teardown TCP connection 212805836 for outside:10.22.8.62\/56471(LOCAL\\user.name) to inside:208.111.72.1\/443 duration 0:00:04 bytes 1700 TCP FINs (user.name)","ip_dst_addr":"208.111.72.1","ip_src_port":56471,"ip_dst_port":443,"ciscotag":"ASA-6-302014","syslog_facility":"local4","action":"teardown","ip_src_addr":"10.22.8.62","syslog_severity":"info","timestamp":1451983956000,"source.type":"asa"}
-{"syslog_host":"10.22.8.212","protocol":"tcp","original_string":"<174>Jan 5 14:52:36 10.22.8.212 %ASA-6-302013: Built inbound TCP connection 76245546 for outside:10.22.8.227\/54542 (10.22.8.227\/54542) to inside:63.111.72.124\/80 (63.111.72.124\/80) (user.name)","ip_dst_addr":"63.111.72.124","ip_src_port":54542,"ip_dst_port":80,"ciscotag":"ASA-6-302013","syslog_facility":"local5","action":"built","ip_src_addr":"10.22.8.227","syslog_severity":"info","timestamp":1452005556000,"source.type":"asa"}
-{"syslog_host":"10.22.8.216","protocol":"icmp","original_string":"<166>Jan 5 08:52:36 10.22.8.216 %ASA-6-302021: Teardown ICMP connection for faddr 10.22.8.74\/0(LOCAL\\user.name) gaddr 10.22.8.205\/0 laddr 10.22.8.205\/0","ip_dst_addr":"10.22.8.74","ciscotag":"ASA-6-302021","syslog_facility":"local4","action":"teardown","ip_src_addr":"10.22.8.205","syslog_severity":"info","timestamp":1451983956000,"source.type":"asa"}
-{"syslog_host":"10.22.8.212","protocol":"icmp","original_string":"<174>Jan 5 14:52:36 10.22.8.212 %ASA-6-302020: Built outbound ICMP connection for faddr 10.22.8.96\/2708 gaddr 10.22.8.30\/0 laddr 10.22.8.30\/0","ip_dst_addr":"10.22.8.96","ciscotag":"ASA-6-302020","syslog_facility":"local5","action":"built","ip_src_addr":"10.22.8.30","syslog_severity":"info","timestamp":1452005556000,"source.type":"asa"}
-{"syslog_host":"10.22.8.201","protocol":"tcp","original_string":"<142>Jan 5 08:52:36 10.22.8.201 %ASA-6-302014: Teardown TCP connection 488168388 for DMZ-Inside:10.22.8.10\/49771 to Inside-Trunk:10.22.8.128\/443 duration 0:00:00 bytes 19132 TCP Reset-O","ip_dst_addr":"10.22.8.128","ip_src_port":49771,"ip_dst_port":443,"ciscotag":"ASA-6-302014","syslog_facility":"local1","action":"teardown","ip_src_addr":"10.22.8.10","syslog_severity":"info","timestamp":1451983956000,"source.type":"asa"}
-{"syslog_host":"10.22.8.201","protocol":"tcp","original_string":"<142>Jan 5 08:52:36 10.22.8.201 %ASA-6-302014: Teardown TCP connection 488168692 for DMZ-Inside:10.22.8.53\/61694 to Inside-Trunk:10.22.8.174\/40004 duration 0:00:00 bytes 5660 TCP FINs","ip_dst_addr":"10.22.8.174","ip_src_port":61694,"ip_dst_port":40004,"ciscotag":"ASA-6-302014","syslog_facility":"local1","action":"teardown","ip_src_addr":"10.22.8.53","syslog_severity":"info","timestamp":1451983956000,"source.type":"asa"}
-{"syslog_host":"10.22.8.212","protocol":"tcp","original_string":"<174>Jan 5 14:52:36 10.22.8.212 %ASA-6-302013: Built inbound TCP connection 76245552 for outside:10.22.8.92\/51042 (10.22.8.92\/51042) to inside:10.22.8.193\/9100 (10.22.8.193\/9100) (user.name)","ip_dst_addr":"10.22.8.193","ip_src_port":51042,"ip_dst_port":9100,"ciscotag":"ASA-6-302013","syslog_facility":"local5","action":"built","ip_src_addr":"10.22.8.92","syslog_severity":"info","timestamp":1452005556000,"source.type":"asa"}
-{"syslog_host":"10.22.8.41","protocol":"udp","original_string":"<166>Jan 5 16:52:36 10.22.8.41 %ASA-6-302016: Teardown UDP connection 45474680 for Outside:10.22.8.49\/137(LOCAL\\user.name) to Inside:10.22.8.12\/137 duration 0:02:03 bytes 486 (user.name)","ip_dst_addr":"10.22.8.12","ip_src_port":137,"ip_dst_port":137,"ciscotag":"ASA-6-302016","syslog_facility":"local4","action":"teardown","ip_src_addr":"10.22.8.49","syslog_severity":"info","timestamp":1452012756000,"source.type":"asa"}
-{"syslog_host":"10.22.8.41","protocol":"udp","original_string":"<166>Jan 5 16:52:36 10.22.8.41 %ASA-6-302016: Teardown UDP connection 45474694 for Outside:10.22.8.49\/138(LOCAL\\user.name) to Inside:10.22.8.12\/138 duration 0:02:01 bytes 184 (user.name)","ip_dst_addr":"10.22.8.12","ip_src_port":138,"ip_dst_port":138,"ciscotag":"ASA-6-302016","syslog_facility":"local4","action":"teardown","ip_src_addr":"10.22.8.49","syslog_severity":"info","timestamp":1452012756000,"source.type":"asa"}
-{"syslog_host":"10.22.8.201","protocol":"tcp","original_string":"<142>Jan 5 08:52:36 10.22.8.201 %ASA-6-302014: Teardown TCP connection 488167720 for Outside_VPN:198.111.72.75\/1033 to DMZ-Inside:10.22.8.53\/443 duration 0:00:01 bytes 9634 TCP FINs","ip_dst_addr":"10.22.8.53","ip_src_port":1033,"ip_dst_port":443,"ciscotag":"ASA-6-302014","syslog_facility":"local1","action":"teardown","ip_src_addr":"198.111.72.75","syslog_severity":"info","timestamp":1451983956000,"source.type":"asa"}
-{"syslog_host":"10.22.8.201","protocol":"tcp","original_string":"<142>Jan 5 08:52:32 10.22.8.201 %ASA-6-302014: Teardown TCP connection 488165627 for Outside_VPN:170.111.72.22\/27463 to DMZ-Inside:10.22.8.53\/443 duration 0:00:01 bytes 9756 TCP FINs","ip_dst_addr":"10.22.8.53","ip_src_port":27463,"ip_dst_port":443,"ciscotag":"ASA-6-302014","syslog_facility":"local1","action":"teardown","ip_src_addr":"170.111.72.22","syslog_severity":"info","timestamp":1451983952000,"source.type":"asa"}
-{"syslog_host":"10.22.8.216","protocol":"udp","original_string":"<166>Jan 5 08:52:32 10.22.8.216 %ASA-6-302016: Teardown UDP connection 212805854 for outside:10.22.8.62\/54704(LOCAL\\user.name) to inside:10.22.8.85\/53 duration 0:00:00 bytes 114 (user.name)","ip_dst_addr":"10.22.8.85","ip_src_port":54704,"ip_dst_port":53,"ciscotag":"ASA-6-302016","syslog_facility":"local4","action":"teardown","ip_src_addr":"10.22.8.62","syslog_severity":"info","timestamp":1451983952000,"source.type":"asa"}
-{"syslog_host":"10.22.8.12","protocol":"icmp","original_string":"<166>Jan 5 09:52:32 10.22.8.12 %ASA-6-302020: Built inbound ICMP connection for faddr 207.111.72.122\/0 gaddr 206.111.72.24\/512 laddr 10.22.8.57\/512","ip_dst_addr":"207.111.72.122","ciscotag":"ASA-6-302020","syslog_facility":"local4","action":"built","ip_src_addr":"10.22.8.57","syslog_severity":"info","timestamp":1451987552000,"source.type":"asa"}
-{"syslog_host":"10.22.8.12","protocol":"tcp","original_string":"<166>Jan 5 09:52:32 10.22.8.12 %ASA-6-302013: Built outbound TCP connection 17605397 for outside:69.111.72.0\/80 (69.111.72.0\/80) to inside:10.22.8.102\/55659 (206.111.72.41\/40627)","ip_dst_addr":"10.22.8.102","ip_src_port":80,"ip_dst_port":55659,"ciscotag":"ASA-6-302013","syslog_facility":"local4","action":"built","ip_src_addr":"69.111.72.0","syslog_severity":"info","timestamp":1451987552000,"source.type":"asa"}
-{"syslog_host":"10.22.8.212","protocol":"udp","original_string":"<174>Jan 5 14:52:32 10.22.8.212 %ASA-6-302015: Built inbound UDP connection 76245230 for outside:10.22.8.96\/123 (10.22.8.96\/123) to inside:10.22.8.12\/123 (10.22.8.12\/123) (user.name)","ip_dst_addr":"10.22.8.12","ip_src_port":123,"ip_dst_port":123,"ciscotag":"ASA-6-302015","syslog_facility":"local5","action":"built","ip_src_addr":"10.22.8.96","syslog_severity":"info","timestamp":1452005552000,"source.type":"asa"}
-{"syslog_host":"10.22.8.201","protocol":"tcp","original_string":"<142>Jan 5 08:52:32 10.22.8.201 %ASA-6-302014: Teardown TCP connection 488031413 for Outside_VPN:184.111.72.216\/50341 to DMZ-Inside:10.22.8.57\/443 duration 0:05:01 bytes 13543 TCP Reset-O","ip_dst_addr":"10.22.8.57","ip_src_port":50341,"ip_dst_port":443,"ciscotag":"ASA-6-302014","syslog_facility":"local1","action":"teardown","ip_src_addr":"184.111.72.216","syslog_severity":"info","timestamp":1451983952000,"source.type":"asa"}
-{"syslog_host":"10.22.8.41","protocol":"icmp","original_string":"<166>Jan 5 16:52:32 10.22.8.41 %ASA-6-302020: Built inbound ICMP connection for faddr 10.22.8.95\/1(LOCAL\\user.name) gaddr 10.22.8.12\/0 laddr 10.22.8.12\/0 (user.name)","ip_dst_addr":"10.22.8.95","ciscotag":"ASA-6-302020","syslog_facility":"local4","action":"built","ip_src_addr":"10.22.8.12","syslog_severity":"info","timestamp":1452012752000,"source.type":"asa"}
-{"syslog_host":"10.22.8.201","original_string":"<142>Jan 5 08:52:32 10.22.8.201 %ASA-6-302014: Teardown TCP connection 488030393 for DMZ-Inside:[10.22.8.10\/57109 to Inside-Trunk:10.22.8.128\/443 duration 0:05:04 bytes 13541 TCP Reset-O","ciscotag":"ASA-6-302014","syslog_facility":"local1","syslog_severity":"info","timestamp":1451983952000,"source.type":"asa"}
-{"syslog_host":"10.22.8.12","protocol":"tcp","original_string":"<166>Jan 5 09:52:32 10.22.8.12 %ASA-6-305012: Teardown dynamic TCP translation from inside:10.22.8.149\/62156 to outside:206.111.72.41\/19576 duration 0:00:44","ip_src_port":62156,"ciscotag":"ASA-6-305012","syslog_facility":"local4","action":"teardown","ip_src_addr":"10.22.8.149","syslog_severity":"info","timestamp":1451987552000,"source.type":"asa"}
-{"syslog_host":"10.22.8.12","protocol":"tcp","original_string":"<166>Jan 5 09:52:32 10.22.8.12 %ASA-6-305012: Teardown dynamic TCP translation from inside:10.22.8.149\/62159 to outside:206.111.72.41\/39634 duration 0:00:44","ip_src_port":62159,"ciscotag":"ASA-6-305012","syslog_facility":"local4","action":"teardown","ip_src_addr":"10.22.8.149","syslog_severity":"info","timestamp":1451987552000,"source.type":"asa"}
-{"syslog_host":"10.22.8.201","protocol":"tcp","original_string":"<142>Jan 5 08:52:32 10.22.8.201 %ASA-6-302014: Teardown TCP connection 488031793 for Outside_VPN:198.111.72.146\/28026 to DMZ-Inside:10.22.8.53\/443 duration 0:05:00 bytes 119 TCP FINs","ip_dst_addr":"10.22.8.53","ip_src_port":28026,"ip_dst_port":443,"ciscotag":"ASA-6-302014","syslog_facility":"local1","action":"teardown","ip_src_addr":"198.111.72.146","syslog_severity":"info","timestamp":1451983952000,"source.type":"asa"}
-{"syslog_host":"10.22.8.201","protocol":"tcp","original_string":"<142>Jan 5 08:52:32 10.22.8.201 %ASA-6-302014: Teardown TCP connection 488030810 for DMZ-Inside:10.22.8.10\/56930 to Inside-Trunk:10.22.8.128\/443 duration 0:05:03 bytes 13543 TCP Reset-O","ip_dst_addr":"10.22.8.128","ip_src_port":56930,"ip_dst_port":443,"ciscotag":"ASA-6-302014","syslog_facility":"local1","action":"teardown","ip_src_addr":"10.22.8.10","syslog_severity":"info","timestamp":1451983952000,"source.type":"asa"}
-{"syslog_host":"10.22.8.201","protocol":"tcp","original_string":"<142>Jan 5 08:52:32 10.22.8.201 %ASA-6-106015: Deny TCP (no connection) from 186.111.72.11\/80 to 204.111.72.199\/61438 flags SYN ACK on interface Outside_VPN","ip_dst_addr":"204.111.72.199","ip_src_port":80,"ip_dst_port":61438,"ciscotag":"ASA-6-106015","syslog_facility":"local1","action":"deny","ip_src_addr":"186.111.72.11","syslog_severity":"info","timestamp":1451983952000,"source.type":"asa"}
-{"syslog_host":"10.22.8.216","protocol":"tcp","original_string":"<166>Jan 5 08:52:32 10.22.8.216 %ASA-6-302013: Built inbound TCP connection 212805863 for outside:10.22.8.144\/61999 (10.22.8.144\/61999)(LOCAL\\user.name) to inside:10.22.8.163\/80 (10.22.8.163\/80) (user.name)","ip_dst_addr":"10.22.8.163","ip_src_port":61999,"ip_dst_port":80,"ciscotag":"ASA-6-302013","syslog_facility":"local4","action":"built","ip_src_addr":"10.22.8.144","syslog_severity":"info","timestamp":1451983952000,"source.type":"asa"}
-{"syslog_host":"10.22.8.216","original_string":"<167>Jan 5 08:52:32 10.22.8.216 %ASA-7-609002: Teardown local-host inside:10.22.8.205 duration 0:00:00","ciscotag":"ASA-7-609002","syslog_facility":"local4","syslog_severity":"debug","timestamp":1451983952000,"source.type":"asa"}
-{"protocol":"udp","original_string":"<166>Aug 06 2016 20:39:42: %ASA-6-110002: Failed to locate egress interface for UDP from Inside:10.25.14.52\/56544 to 172.18.106.2\/161","ip_dst_addr":"172.18.106.2","ip_src_port":56544,"ip_dst_port":161,"ciscotag":"ASA-6-110002","syslog_facility":"local4","ip_src_addr":"10.25.14.52","syslog_severity":"info","timestamp":1470515982000,"source.type":"asa"}
-{"original_string":"<165>Aug 11 2016 15:42:07: %ASA-5-111010: User 'admin', running 'N\/A' from IP 10.25.112.191, executed 'service-object object TCP44720-44722'","ciscotag":"ASA-5-111010","syslog_facility":"local4","syslog_severity":"notice","timestamp":1470930127000,"source.type":"asa"}
-{"original_string":"<165>Aug 06 2016 18:05:27: %ASA-5-713202: IP = 192.168.140.20, Duplicate first packet detected. Ignoring packet.","ciscotag":"ASA-5-713202","syslog_facility":"local4","syslog_severity":"notice","timestamp":1470506727000,"source.type":"asa"}
-{"original_string":"<165>Aug 07 2016 22:38:41: %ASA-5-713904: IP = 206.16.173.28, Received encrypted packet with no matching SA, dropping","ciscotag":"ASA-5-713904","syslog_facility":"local4","syslog_severity":"notice","timestamp":1470609521000,"source.type":"asa"}
-{"original_string":"<165>Aug 16 2016 08:20:21: %ASA-5-713050: Group = 192.168.136.20, IP = 192.168.136.20, Connection terminated for peer 192.168.136.20. Reason: IPSec SA Idle Timeout Remote Proxy 192.168.136.22, Local Proxy 172.18.106.36","ciscotag":"ASA-5-713050","syslog_facility":"local4","syslog_severity":"notice","timestamp":1471335621000,"source.type":"asa"}
-{"original_string":"<164>Aug 16 2016 13:01:43: %ASA-4-313004: Denied ICMP type=0, from laddr 172.20.30.1 on interface Outside to 10.25.24.122: no matching session","ciscotag":"ASA-4-313004","syslog_facility":"local4","syslog_severity":"warn","timestamp":1471352503000,"source.type":"asa"}
-{"original_string":"<166>Aug 16 2016 08:54:22: %ASA-6-113009: AAA retrieved default group policy (DefaultPolicyCA) for user = 192.168.136.20","ciscotag":"ASA-6-113009","syslog_facility":"local4","syslog_severity":"info","timestamp":1471337662000,"source.type":"asa"}
-{"original_string":"<163>Aug 05 2016 20:21:04: %ASA-3-106010: Deny inbound protocol 47 src Outside:14.169.120.66 dst Outside:172.18.105.105","ciscotag":"ASA-3-106010","syslog_facility":"local4","syslog_severity":"err","timestamp":1470428464000,"source.type":"asa"}
-{"original_string":"<164>Aug 06 2016 17:43:49: %ASA-4-113019: Group = 192.168.140.20, Username = 192.168.140.20, IP = 192.168.140.20, Session disconnected. Session Type: LAN-to-LAN, Duration: 12d 9h:11m:22s, Bytes xmt: 523781833, Bytes rcv: 16336203, Reason: Lost Service","ciscotag":"ASA-4-113019","syslog_facility":"local4","syslog_severity":"warn","timestamp":1470505429000,"source.type":"asa"}
-{"original_string":"<165>Aug 05 2016 22:13:07: %ASA-5-500003: Bad TCP hdr length (hdrlen=4, pktlen=74) from 159.203.208.134\/0 to 172.18.105.12\/0, flags: INVALID, on interface Outside","ciscotag":"ASA-5-500003","syslog_facility":"local4","syslog_severity":"notice","timestamp":1470435187000,"source.type":"asa"}
-{"original_string":"<165>Aug 06 2016 17:43:49: %ASA-5-713259: Group = 192.168.140.20, IP = 192.168.140.20, Session is being torn down. Reason: Lost Service","ciscotag":"ASA-5-713259","syslog_facility":"local4","syslog_severity":"notice","timestamp":1470505429000,"source.type":"asa"}
-{"protocol":"icmp","original_string":"<163>Aug 05 2016 19:13:26: %ASA-3-313001: Denied ICMP type=3, code=3 from 198.27.69.147 on interface Outside","ciscotag":"ASA-3-313001","syslog_facility":"local4","action":"denied","ip_src_addr":"198.27.69.147","syslog_severity":"err","timestamp":1470424406000,"source.type":"asa"}
-{"protocol":"icmp","original_string":"<164>Aug 05 2016 19:13:26: %ASA-4-313005: No matching connection for ICMP error message: icmp src Outside:198.27.69.147 dst identity:172.18.106.2 (type 3, code 3) on Outside interface. Original IP payload: udp src 172.18.106.2\/9993 dst 198.27.69.147\/26410.","ciscotag":"ASA-4-313005","syslog_facility":"local4","syslog_severity":"warn","timestamp":1470424406000,"source.type":"asa"}
-{"original_string":"<163>Aug 11 2016 11:43:25: %ASA-3-713902: Group = 10.12.208.226, IP = 10.12.208.226, Removing peer from correlator table failed, no match!","ciscotag":"ASA-3-713902","syslog_facility":"local4","syslog_severity":"err","timestamp":1470915805000,"source.type":"asa"}
-{"original_string":"<164>Aug 11 2016 11:43:02: %ASA-4-752010: IKEv2 Doesn't have a proposal specified","ciscotag":"ASA-4-752010","syslog_facility":"local4","syslog_severity":"warn","timestamp":1470915782000,"source.type":"asa"}
-{"original_string":"<165>Aug 11 2016 11:43:02: %ASA-5-752004: Tunnel Manager dispatching a KEY_ACQUIRE message to IKEv1. Map Tag = demap. Map Sequence Number = 1.","ciscotag":"ASA-5-752004","syslog_facility":"local4","syslog_severity":"notice","timestamp":1470915782000,"source.type":"asa"}
-{"original_string":"<163>Aug 11 2016 12:15:25: %ASA-3-752015: Tunnel Manager has failed to establish an L2L SA. All configured IKE versions failed to establish the tunnel. Map Tag= demap. Map Sequence Number = 1.","ciscotag":"ASA-3-752015","syslog_facility":"local4","syslog_severity":"err","timestamp":1470917725000,"source.type":"asa"}
-{"original_string":"<164>Aug 11 2016 12:11:16: %ASA-4-752012: IKEv1 was unsuccessful at setting up a tunnel. Map Tag = demap. Map Sequence Number = 1.","ciscotag":"ASA-4-752012","syslog_facility":"local4","syslog_severity":"warn","timestamp":1470917476000,"source.type":"asa"}
-{"original_string":"<164>Aug 06 2016 00:02:25: %ASA-4-713903: IKE Receiver: Runt ISAKMP packet discarded on Port 500 from 172.30.106.180:57380","ciscotag":"ASA-4-713903","syslog_facility":"local4","syslog_severity":"warn","timestamp":1470441745000,"source.type":"asa"}
-{"original_string":"<163>Aug 11 2016 11:43:25: %ASA-3-713227: IP = 10.12.208.226, Rejecting new IPSec SA negotiation for peer 10.12.208.226. A negotiation was already in progress for local Proxy 10.25.0.0\/255.255.0.0, remote Proxy 172.20.30.0\/255.255.255.0","ciscotag":"ASA-3-713227","syslog_facility":"local4","syslog_severity":"err","timestamp":1470915805000,"source.type":"asa"}
-{"original_string":"<166>Aug 20 2016 23:06:27: %ASA-6-713905: INFO: IKE Transform #8 next payload is 3 (should be 0).","ciscotag":"ASA-6-713905","syslog_facility":"local4","syslog_severity":"info","timestamp":1471734387000,"source.type":"asa"}
-{"original_string":"<166>Aug 11 2016 11:43:02: %ASA-6-713219: IP = 10.12.208.226, Queuing KEY-ACQUIRE messages to be processed when P1 SA is complete.","ciscotag":"ASA-6-713219","syslog_facility":"local4","syslog_severity":"info","timestamp":1470915782000,"source.type":"asa"}
-{"original_string":"<166>Aug 11 2016 11:43:19: %ASA-6-713220: Group = 10.12.208.226, IP = 10.12.208.226, De-queuing KEY-ACQUIRE messages that were left pending.","ciscotag":"ASA-6-713220","syslog_facility":"local4","syslog_severity":"info","timestamp":1470915799000,"source.type":"asa"}
-{"protocol":"tcp","original_string":"<162>Aug 05 2016 01:02:25: %ASA-2-106001: Inbound TCP connection denied from 10.47.32.45\/60641 to 10.254.8.193\/5060 flags SYN on interface Inside","ip_dst_addr":"10.254.8.193","ip_src_port":60641,"ip_dst_port":5060,"ciscotag":"ASA-2-106001","syslog_facility":"local4","action":"denied","ip_src_addr":"10.47.32.45","syslog_severity":"crit","timestamp":1470358945000,"source.type":"asa"}
-{"protocol":"icmp","original_string":"<163>Aug 05 2016 01:02:25: %ASA-3-106014: Deny inbound icmp src Inside:10.230.4.87 dst Inside:10.22.75.251 (type 8, code 0)","ip_dst_addr":"10.22.75.251","ciscotag":"ASA-3-106014","syslog_facility":"local4","action":"deny","ip_src_addr":"10.230.4.87","syslog_severity":"err","timestamp":1470358945000,"source.type":"asa"}
-{"protocol":"udp","original_string":"<164>Aug 05 2016 01:02:25: %ASA-4-106023: Deny udp src Inside:10.230.4.88\/42350 dst Outside:192.168.2.53\/53 by access-group \"Inside_access_in\" [0x962df600, 0x0]","ip_dst_addr":"192.168.2.53","ip_src_port":42350,"ip_dst_port":53,"ciscotag":"ASA-4-106023","syslog_facility":"local4","action":"deny","ip_src_addr":"10.230.4.88","syslog_severity":"warn","timestamp":1470358945000,"source.type":"asa"}
-{"protocol":"tcp","original_string":"<164>Aug 05 2016 01:02:25: %ASA-4-106023: Deny tcp src Inside:10.30.6.47\/4562 dst Outside:192.168.133.204\/443 by access-group \"Inside_access_in\" [0x962df600, 0x0]","ip_dst_addr":"192.168.133.204","ip_src_port":4562,"ip_dst_port":443,"ciscotag":"ASA-4-106023","syslog_facility":"local4","action":"deny","ip_src_addr":"10.30.6.47","syslog_severity":"warn","timestamp":1470358945000,"source.type":"asa"}
-{"protocol":"tcp","original_string":"<164>Aug 05 2016 01:02:25: %ASA-4-106023: Deny tcp src Inside:10.30.6.47\/4563 dst Outside:192.168.133.204\/443 by access-group \"Inside_access_in\" [0x962df600, 0x0]","ip_dst_addr":"192.168.133.204","ip_src_port":4563,"ip_dst_port":443,"ciscotag":"ASA-4-106023","syslog_facility":"local4","action":"deny","ip_src_addr":"10.30.6.47","syslog_severity":"warn","timestamp":1470358945000,"source.type":"asa"}
+{"syslog_host":"10.22.8.216","original_string":"<167>Jan 5 08:52:35 10.22.8.216 %ASA-7-609001: Built local-host inside:10.22.8.205","ciscotag":"ASA-7-609001","syslog_facility":"local4","syslog_severity":"debug","timestamp":1451983955000,"source.type":"asa","guid":"this-is-random-uuid-will-be-36-chars"}
+{"syslog_host":"10.22.8.216","protocol":"icmp","original_string":"<166>Jan 5 08:52:35 10.22.8.216 %ASA-6-302021: Teardown ICMP connection for faddr 10.22.8.74\/0(LOCAL\\user.name) gaddr 10.22.8.205\/0 laddr 10.22.8.205\/0","ip_dst_addr":"10.22.8.74","ciscotag":"ASA-6-302021","syslog_facility":"local4","action":"teardown","ip_src_addr":"10.22.8.205","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa","guid":"this-is-random-uuid-will-be-36-chars"}
+{"syslog_host":"10.22.8.216","original_string":"<167>Jan 5 08:52:35 10.22.8.216 %ASA-7-609002: Teardown local-host inside:10.22.8.205 duration 0:00:00","ciscotag":"ASA-7-609002","syslog_facility":"local4","syslog_severity":"debug","timestamp":1451983955000,"source.type":"asa","guid":"this-is-random-uuid-will-be-36-chars"}
+{"syslog_host":"10.22.8.201","protocol":"tcp","original_string":"<142>Jan 5 08:52:35 10.22.8.201 %ASA-6-302014: Teardown TCP connection 488167725 for Outside_VPN:147.111.72.16\/26436 to DMZ-Inside:10.22.8.53\/443 duration 0:00:00 bytes 9687 TCP FINs","ip_dst_addr":"10.22.8.53","ip_src_port":26436,"ip_dst_port":443,"ciscotag":"ASA-6-302014","syslog_facility":"local1","action":"teardown","ip_src_addr":"147.111.72.16","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa","guid":"this-is-random-uuid-will-be-36-chars"}
+{"syslog_host":"10.22.8.216","protocol":"tcp","original_string":"<166>Jan 5 08:52:35 10.22.8.216 %ASA-6-302014: Teardown TCP connection 212805593 for outside:10.22.8.223\/59614(LOCAL\\user.name) to inside:10.22.8.78\/8102 duration 0:00:07 bytes 3433 TCP FINs (user.name)","ip_dst_addr":"10.22.8.78","ip_src_port":59614,"ip_dst_port":8102,"ciscotag":"ASA-6-302014","syslog_facility":"local4","action":"teardown","ip_src_addr":"10.22.8.223","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa","guid":"this-is-random-uuid-will-be-36-chars"}
+{"syslog_host":"10.22.8.212","protocol":"tcp","original_string":"<174>Jan 5 14:52:35 10.22.8.212 %ASA-6-302013: Built inbound TCP connection 76245503 for outside:10.22.8.233\/54209 (10.22.8.233\/54209) to inside:198.111.72.238\/443 (198.111.72.238\/443) (user.name)","ip_dst_addr":"198.111.72.238","ip_src_port":54209,"ip_dst_port":443,"ciscotag":"ASA-6-302013","syslog_facility":"local5","action":"built","ip_src_addr":"10.22.8.233","syslog_severity":"info","timestamp":1452005555000,"source.type":"asa","guid":"this-is-random-uuid-will-be-36-chars"}
+{"syslog_host":"10.22.8.216","protocol":"tcp","original_string":"<166>Jan 5 08:52:35 10.22.8.216 %ASA-6-302013: Built inbound TCP connection 212806031 for outside:10.22.8.17\/58633 (10.22.8.17\/58633)(LOCAL\\user.name) to inside:10.22.8.12\/389 (10.22.8.12\/389) (user.name)","ip_dst_addr":"10.22.8.12","ip_src_port":58633,"ip_dst_port":389,"ciscotag":"ASA-6-302013","syslog_facility":"local4","action":"built","ip_src_addr":"10.22.8.17","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa","guid":"this-is-random-uuid-will-be-36-chars"}
+{"syslog_host":"10.22.8.201","protocol":"tcp","original_string":"<142>Jan 5 08:52:35 10.22.8.201 %ASA-6-302014: Teardown TCP connection 488168292 for DMZ-Inside:10.22.8.51\/51231 to Inside-Trunk:10.22.8.174\/40004 duration 0:00:00 bytes 2103 TCP FINs","ip_dst_addr":"10.22.8.174","ip_src_port":51231,"ip_dst_port":40004,"ciscotag":"ASA-6-302014","syslog_facility":"local1","action":"teardown","ip_src_addr":"10.22.8.51","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa","guid":"this-is-random-uuid-will-be-36-chars"}
+{"syslog_host":"10.22.8.201","protocol":"tcp","original_string":"<142>Jan 5 08:52:35 10.22.8.201 %ASA-6-106015: Deny TCP (no connection) from 186.111.72.11\/80 to 204.111.72.226\/45019 flags SYN ACK on interface Outside_VPN","ip_dst_addr":"204.111.72.226","ip_src_port":80,"ip_dst_port":45019,"ciscotag":"ASA-6-106015","syslog_facility":"local1","action":"deny","ip_src_addr":"186.111.72.11","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa","guid":"this-is-random-uuid-will-be-36-chars"}
+{"syslog_host":"10.22.8.12","protocol":"tcp","original_string":"<166>Jan 5 09:52:35 10.22.8.12 %ASA-6-302014: Teardown TCP connection 17604987 for outside:209.111.72.151\/443 to inside:10.22.8.188\/64306 duration 0:00:31 bytes 10128 TCP FINs","ip_dst_addr":"10.22.8.188","ip_src_port":443,"ip_dst_port":64306,"ciscotag":"ASA-6-302014","syslog_facility":"local4","action":"teardown","ip_src_addr":"209.111.72.151","syslog_severity":"info","timestamp":1451987555000,"source.type":"asa","guid":"this-is-random-uuid-will-be-36-chars"}
+{"syslog_host":"10.22.8.12","protocol":"tcp","original_string":"<166>Jan 5 09:52:35 10.22.8.12 %ASA-6-302014: Teardown TCP connection 17604999 for outside:209.111.72.151\/443 to inside:10.22.8.188\/64307 duration 0:00:30 bytes 6370 TCP FINs","ip_dst_addr":"10.22.8.188","ip_src_port":443,"ip_dst_port":64307,"ciscotag":"ASA-6-302014","syslog_facility":"local4","action":"teardown","ip_src_addr":"209.111.72.151","syslog_severity":"info","timestamp":1451987555000,"source.type":"asa","guid":"this-is-random-uuid-will-be-36-chars"}
+{"syslog_host":"10.22.8.201","protocol":"tcp","original_string":"<142>Jan 5 08:52:35 10.22.8.201 %ASA-6-302014: Teardown TCP connection 488167347 for Outside_VPN:198.111.72.24\/2134 to DMZ-Inside:10.22.8.53\/443 duration 0:00:01 bytes 9785 TCP FINs","ip_dst_addr":"10.22.8.53","ip_src_port":2134,"ip_dst_port":443,"ciscotag":"ASA-6-302014","syslog_facility":"local1","action":"teardown","ip_src_addr":"198.111.72.24","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa","guid":"this-is-random-uuid-will-be-36-chars"}
+{"syslog_host":"10.22.8.212","protocol":"udp","original_string":"<174>Jan 5 14:52:35 10.22.8.212 %ASA-6-302015: Built inbound UDP connection 76245506 for outside:10.22.8.110\/49886 (10.22.8.110\/49886) to inside:192.111.72.8\/8612 (192.111.72.8\/8612) (user.name)","ip_dst_addr":"192.111.72.8","ip_src_port":49886,"ip_dst_port":8612,"ciscotag":"ASA-6-302015","syslog_facility":"local5","action":"built","ip_src_addr":"10.22.8.110","syslog_severity":"info","timestamp":1452005555000,"source.type":"asa","guid":"this-is-random-uuid-will-be-36-chars"}
+{"syslog_host":"10.22.8.216","protocol":"tcp","original_string":"<166>Jan 5 08:52:35 10.22.8.216 %ASA-6-302014: Teardown TCP connection 212805993 for outside:10.22.8.89\/56917(LOCAL\\user.name) to inside:216.111.72.126\/443 duration 0:00:00 bytes 0 TCP FINs (user.name)","ip_dst_addr":"216.111.72.126","ip_src_port":56917,"ip_dst_port":443,"ciscotag":"ASA-6-302014","syslog_facility":"local4","action":"teardown","ip_src_addr":"10.22.8.89","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa","guid":"this-is-random-uuid-will-be-36-chars"}
+{"syslog_host":"10.22.8.216","protocol":"udp","original_string":"<167>Jan 5 08:52:35 10.22.8.216 %ASA-7-710005: UDP request discarded from 10.22.8.223\/49192 to outside:224.111.72.252\/5355","ip_dst_addr":"224.111.72.252","ip_src_port":49192,"ip_dst_port":5355,"ciscotag":"ASA-7-710005","syslog_facility":"local4","action":"discarded","ip_src_addr":"10.22.8.223","syslog_severity":"debug","timestamp":1451983955000,"source.type":"asa","guid":"this-is-random-uuid-will-be-36-chars"}
+{"syslog_host":"10.22.8.201","protocol":"tcp","original_string":"<142>Jan 5 08:52:35 10.22.8.201 %ASA-6-302014: Teardown TCP connection 488166143 for Outside_VPN:198.111.72.64\/80 to Inside-Trunk:10.22.8.39\/54883 duration 0:00:04 bytes 1148 TCP FINs","ip_dst_addr":"10.22.8.39","ip_src_port":80,"ip_dst_port":54883,"ciscotag":"ASA-6-302014","syslog_facility":"local1","action":"teardown","ip_src_addr":"198.111.72.64","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa","guid":"this-is-random-uuid-will-be-36-chars"}
+{"syslog_host":"10.22.8.216","protocol":"tcp","original_string":"<166>Jan 5 08:52:35 10.22.8.216 %ASA-6-106015: Deny TCP (no connection) from 10.22.8.84\/445 to 10.22.8.219\/60726 flags ACK on interface inside","ip_dst_addr":"10.22.8.219","ip_src_port":445,"ip_dst_port":60726,"ciscotag":"ASA-6-106015","syslog_facility":"local4","action":"deny","ip_src_addr":"10.22.8.84","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa","guid":"this-is-random-uuid-will-be-36-chars"}
+{"syslog_host":"10.22.8.201","protocol":"tcp","original_string":"<142>Jan 5 08:52:35 10.22.8.201 %ASA-6-302014: Teardown TCP connection 488168344 for DMZ-Inside:10.22.8.53\/61682 to Inside-Trunk:10.22.8.174\/40004 duration 0:00:00 bytes 5648 TCP FINs","ip_dst_addr":"10.22.8.174","ip_src_port":61682,"ip_dst_port":40004,"ciscotag":"ASA-6-302014","syslog_facility":"local1","action":"teardown","ip_src_addr":"10.22.8.53","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa","guid":"this-is-random-uuid-will-be-36-chars"}
+{"syslog_host":"10.22.8.201","protocol":"tcp","original_string":"<142>Jan 5 08:52:35 10.22.8.201 %ASA-6-302014: Teardown TCP connection 488168345 for DMZ-Inside:10.22.8.16\/31454 to Inside-Trunk:10.22.8.21\/443 duration 0:00:00 bytes 756 TCP FINs","ip_dst_addr":"10.22.8.21","ip_src_port":31454,"ip_dst_port":443,"ciscotag":"ASA-6-302014","syslog_facility":"local1","action":"teardown","ip_src_addr":"10.22.8.16","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa","guid":"this-is-random-uuid-will-be-36-chars"}
+{"syslog_host":"10.22.8.4","protocol":"icmp","original_string":"<182>Jan 5 20:22:35 10.22.8.4 %ASA-6-302020: Built inbound ICMP connection for faddr 10.22.8.12\/0 gaddr 10.22.8.45\/1 laddr 10.22.8.45\/1","ip_dst_addr":"10.22.8.12","ciscotag":"ASA-6-302020","syslog_facility":"local6","action":"built","ip_src_addr":"10.22.8.45","syslog_severity":"info","timestamp":1452025355000,"source.type":"asa","guid":"this-is-random-uuid-will-be-36-chars"}
+{"syslog_host":"10.22.8.201","protocol":"tcp","original_string":"<142>Jan 5 08:52:35 10.22.8.201 %ASA-6-106015: Deny TCP (no connection) from 50.111.72.230\/80 to 204.111.72.254\/53077 flags RST on interface Outside_VPN","ip_dst_addr":"204.111.72.254","ip_src_port":80,"ip_dst_port":53077,"ciscotag":"ASA-6-106015","syslog_facility":"local1","action":"deny","ip_src_addr":"50.111.72.230","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa","guid":"this-is-random-uuid-will-be-36-chars"}
+{"syslog_host":"10.22.8.12","protocol":"udp","original_string":"<166>Jan 5 09:52:35 10.22.8.12 %ASA-6-302016: Teardown UDP connection 17603649 for outside:206.111.72.2\/161 to inside:10.22.8.48\/63297 duration 0:02:01 bytes 209","ip_dst_addr":"10.22.8.48","ip_src_port":161,"ip_dst_port":63297,"ciscotag":"ASA-6-302016","syslog_facility":"local4","action":"teardown","ip_src_addr":"206.111.72.2","syslog_severity":"info","timestamp":1451987555000,"source.type":"asa","guid":"this-is-random-uuid-will-be-36-chars"}
+{"syslog_host":"10.22.8.12","protocol":"udp","original_string":"<166>Jan 5 09:52:35 10.22.8.12 %ASA-6-302016: Teardown UDP connection 17603650 for outside:207.111.72.122\/161 to inside:10.22.8.48\/63298 duration 0:02:01 bytes 209","ip_dst_addr":"10.22.8.48","ip_src_port":161,"ip_dst_port":63298,"ciscotag":"ASA-6-302016","syslog_facility":"local4","action":"teardown","ip_src_addr":"207.111.72.122","syslog_severity":"info","timestamp":1451987555000,"source.type":"asa","guid":"this-is-random-uuid-will-be-36-chars"}
+{"syslog_host":"10.22.8.12","protocol":"udp","original_string":"<166>Jan 5 09:52:35 10.22.8.12 %ASA-6-302016: Teardown UDP connection 17603652 for outside:206.111.72.2\/161 to inside:10.22.8.48\/63300 duration 0:02:01 bytes 115","ip_dst_addr":"10.22.8.48","ip_src_port":161,"ip_dst_port":63300,"ciscotag":"ASA-6-302016","syslog_facility":"local4","action":"teardown","ip_src_addr":"206.111.72.2","syslog_severity":"info","timestamp":1451987555000,"source.type":"asa","guid":"this-is-random-uuid-will-be-36-chars"}
+{"syslog_host":"10.22.8.12","protocol":"udp","original_string":"<166>Jan 5 09:52:35 10.22.8.12 %ASA-6-302016: Teardown UDP connection 17603657 for outside:206.111.72.2\/161 to inside:10.22.8.48\/63306 duration 0:02:01 bytes 115","ip_dst_addr":"10.22.8.48","ip_src_port":161,"ip_dst_port":63306,"ciscotag":"ASA-6-302016","syslog_facility":"local4","action":"teardown","ip_src_addr":"206.111.72.2","syslog_severity":"info","timestamp":1451987555000,"source.type":"asa","guid":"this-is-random-uuid-will-be-36-chars"}
+{"syslog_host":"10.22.8.201","protocol":"tcp","original_string":"<142>Jan 5 08:52:35 10.22.8.201 %ASA-6-302014: Teardown TCP connection 488168436 for DMZ-Inside:10.22.8.51\/51235 to Inside-Trunk:10.22.8.174\/40004 duration 0:00:00 bytes 2497 TCP FINs","ip_dst_addr":"10.22.8.174","ip_src_port":51235,"ip_dst_port":40004,"ciscotag":"ASA-6-302014","syslog_facility":"local1","action":"teardown","ip_src_addr":"10.22.8.51","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa","guid":"this-is-random-uuid-will-be-36-chars"}
+{"syslog_host":"10.22.8.201","protocol":"tcp","original_string":"<142>Jan 5 08:52:35 10.22.8.201 %ASA-6-302014: Teardown TCP connection 488167656 for Outside_VPN:69.111.72.70\/21560 to DMZ-Inside:10.22.8.53\/443 duration 0:00:01 bytes 11410 TCP FINs","ip_dst_addr":"10.22.8.53","ip_src_port":21560,"ip_dst_port":443,"ciscotag":"ASA-6-302014","syslog_facility":"local1","action":"teardown","ip_src_addr":"69.111.72.70","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa","guid":"this-is-random-uuid-will-be-36-chars"}
+{"syslog_host":"10.22.8.216","protocol":"udp","original_string":"<166>Jan 5 08:52:35 10.22.8.216 %ASA-6-302015: Built inbound UDP connection 212806050 for outside:10.22.8.62\/53965 (10.22.8.62\/53965)(LOCAL\\user.name) to inside:10.22.8.85\/53 (10.22.8.85\/53) (user.name)","ip_dst_addr":"10.22.8.85","ip_src_port":53965,"ip_dst_port":53,"ciscotag":"ASA-6-302015","syslog_facility":"local4","action":"built","ip_src_addr":"10.22.8.62","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa","guid":"this-is-random-uuid-will-be-36-chars"}
+{"syslog_host":"10.22.8.216","protocol":"tcp","original_string":"<166>Jan 5 08:52:35 10.22.8.216 %ASA-6-302013: Built inbound TCP connection 212806052 for outside:10.22.8.62\/56500 (10.22.8.62\/56500)(LOCAL\\user.name) to inside:198.111.72.83\/443 (198.111.72.83\/443) (user.name)","ip_dst_addr":"198.111.72.83","ip_src_port":56500,"ip_dst_port":443,"ciscotag":"ASA-6-302013","syslog_facility":"local4","action":"built","ip_src_addr":"10.22.8.62","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa","guid":"this-is-random-uuid-will-be-36-chars"}
+{"syslog_host":"10.22.8.216","protocol":"tcp","original_string":"<166>Jan 5 08:52:35 10.22.8.216 %ASA-6-302013: Built inbound TCP connection 212806054 for outside:10.22.8.62\/56502 (10.22.8.62\/56502)(LOCAL\\user.name) to inside:50.111.72.252\/443 (50.111.72.252\/443) (user.name)","ip_dst_addr":"50.111.72.252","ip_src_port":56502,"ip_dst_port":443,"ciscotag":"ASA-6-302013","syslog_facility":"local4","action":"built","ip_src_addr":"10.22.8.62","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa","guid":"this-is-random-uuid-will-be-36-chars"}
+{"syslog_host":"10.22.8.12","protocol":"tcp","original_string":"<166>Jan 5 09:52:35 10.22.8.12 %ASA-6-305011: Built dynamic TCP translation from inside:10.22.8.188\/64340 to outside:206.111.72.41\/2013","ip_src_port":64340,"ciscotag":"ASA-6-305011","syslog_facility":"local4","action":"built","ip_src_addr":"10.22.8.188","syslog_severity":"info","timestamp":1451987555000,"source.type":"asa","guid":"this-is-random-uuid-will-be-36-chars"}
+{"syslog_host":"10.22.8.33","protocol":"udp","original_string":"<166>Jan 5 15:52:35 10.22.8.33 %ASA-6-305012: Teardown dynamic UDP translation from inside:192.111.72.2\/62251 to outside:79.111.72.174\/21311 duration 0:02:30","ip_src_port":62251,"ciscotag":"ASA-6-305012","syslog_facility":"local4","action":"teardown","ip_src_addr":"192.111.72.2","syslog_severity":"info","timestamp":1452009155000,"source.type":"asa","guid":"this-is-random-uuid-will-be-36-chars"}
+{"syslog_host":"10.22.8.216","protocol":"udp","original_string":"<166>Jan 5 08:52:35 10.22.8.216 %ASA-6-302015: Built inbound UDP connection 212806058 for outside:10.22.8.221\/56631 (10.22.8.221\/56631)(LOCAL\\user.name) to inside:10.22.8.26\/389 (10.22.8.26\/389) (user.name)","ip_dst_addr":"10.22.8.26","ip_src_port":56631,"ip_dst_port":389,"ciscotag":"ASA-6-302015","syslog_facility":"local4","action":"built","ip_src_addr":"10.22.8.221","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa","guid":"this-is-random-uuid-will-be-36-chars"}
+{"syslog_host":"10.22.8.201","protocol":"tcp","original_string":"<142>Jan 5 08:52:35 10.22.8.201 %ASA-6-302014: Teardown TCP connection 488168189 for Outside_VPN:209.111.72.10\/56619 to DMZ-Inside:10.22.8.53\/443 duration 0:00:00 bytes 2477 TCP FINs","ip_dst_addr":"10.22.8.53","ip_src_port":56619,"ip_dst_port":443,"ciscotag":"ASA-6-302014","syslog_facility":"local1","action":"teardown","ip_src_addr":"209.111.72.10","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa","guid":"this-is-random-uuid-will-be-36-chars"}
+{"syslog_host":"10.22.8.201","protocol":"tcp","original_string":"<142>Jan 5 08:52:35 10.22.8.201 %ASA-6-106015: Deny TCP (no connection) from 10.22.8.112\/52235 to 198.111.72.227\/80 flags ACK on interface Inside-Trunk","ip_dst_addr":"198.111.72.227","ip_src_port":52235,"ip_dst_port":80,"ciscotag":"ASA-6-106015","syslog_facility":"local1","action":"deny","ip_src_addr":"10.22.8.112","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa","guid":"this-is-random-uuid-will-be-36-chars"}
+{"syslog_host":"10.22.8.201","protocol":"tcp","original_string":"<142>Jan 5 08:52:35 10.22.8.201 %ASA-6-302014: Teardown TCP connection 488167192 for Outside_VPN:115.111.72.7\/49196 to DMZ-Inside:10.22.8.57\/443 duration 0:00:02 bytes 20588 TCP Reset-O","ip_dst_addr":"10.22.8.57","ip_src_port":49196,"ip_dst_port":443,"ciscotag":"ASA-6-302014","syslog_facility":"local1","action":"teardown","ip_src_addr":"115.111.72.7","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa","guid":"this-is-random-uuid-will-be-36-chars"}
+{"syslog_host":"10.22.8.216","protocol":"udp","original_string":"<166>Jan 5 08:52:35 10.22.8.216 %ASA-6-302016: Teardown UDP connection 212806055 for outside:10.22.8.62\/55383(LOCAL\\user.name) to inside:10.22.8.85\/53 duration 0:00:00 bytes 349 (user.name)","ip_dst_addr":"10.22.8.85","ip_src_port":55383,"ip_dst_port":53,"ciscotag":"ASA-6-302016","syslog_facility":"local4","action":"teardown","ip_src_addr":"10.22.8.62","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa","guid":"this-is-random-uuid-will-be-36-chars"}
+{"syslog_host":"10.22.8.201","protocol":"tcp","original_string":"<142>Jan 5 08:52:35 10.22.8.201 %ASA-6-302014: Teardown TCP connection 488168380 for Outside_VPN:74.111.72.12\/443 to Inside-Trunk:10.22.8.39\/54894 duration 0:00:00 bytes 5701 TCP FINs","ip_dst_addr":"10.22.8.39","ip_src_port":443,"ip_dst_port":54894,"ciscotag":"ASA-6-302014","syslog_facility":"local1","action":"teardown","ip_src_addr":"74.111.72.12","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa","guid":"this-is-random-uuid-will-be-36-chars"}
+{"syslog_host":"10.22.8.212","protocol":"tcp","original_string":"<174>Jan 5 14:52:35 10.22.8.212 %ASA-6-302013: Built inbound TCP connection 76245522 for outside:10.22.8.147\/56343 (10.22.8.147\/56343) to inside:209.111.72.151\/443 (209.111.72.151\/443) (user.name)","ip_dst_addr":"209.111.72.151","ip_src_port":56343,"ip_dst_port":443,"ciscotag":"ASA-6-302013","syslog_facility":"local5","action":"built","ip_src_addr":"10.22.8.147","syslog_severity":"info","timestamp":1452005555000,"source.type":"asa","guid":"this-is-random-uuid-will-be-36-chars"}
+{"syslog_host":"10.22.8.201","protocol":"tcp","original_string":"<142>Jan 5 08:52:35 10.22.8.201 %ASA-6-302014: Teardown TCP connection 488168443 for Outside_VPN:23.111.72.27\/80 to Inside-Trunk:10.22.8.81\/64713 duration 0:00:00 bytes 2426 TCP FINs","ip_dst_addr":"10.22.8.81","ip_src_port":80,"ip_dst_port":64713,"ciscotag":"ASA-6-302014","syslog_facility":"local1","action":"teardown","ip_src_addr":"23.111.72.27","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa","guid":"this-is-random-uuid-will-be-36-chars"}
+{"syslog_host":"10.22.8.201","protocol":"tcp","original_string":"<142>Jan 5 08:52:35 10.22.8.201 %ASA-6-302014: Teardown TCP connection 488111566 for Outside_VPN:131.111.72.49\/443 to Inside-Trunk:10.22.8.127\/56558 duration 0:01:57 bytes 3614 TCP Reset-O","ip_dst_addr":"10.22.8.127","ip_src_port":443,"ip_dst_port":56558,"ciscotag":"ASA-6-302014","syslog_facility":"local1","action":"teardown","ip_src_addr":"131.111.72.49","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa","guid":"this-is-random-uuid-will-be-36-chars"}
+{"syslog_host":"10.22.8.216","protocol":"tcp","original_string":"<166>Jan 5 08:52:35 10.22.8.216 %ASA-6-302013: Built inbound TCP connection 212806061 for outside:10.22.8.17\/58635 (10.22.8.17\/58635)(LOCAL\\user.name) to inside:10.22.8.12\/389 (10.22.8.12\/389) (user.name)","ip_dst_addr":"10.22.8.12","ip_src_port":58635,"ip_dst_port":389,"ciscotag":"ASA-6-302013","syslog_facility":"local4","action":"built","ip_src_addr":"10.22.8.17","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa","guid":"this-is-random-uuid-will-be-36-chars"}
+{"syslog_host":"10.22.8.216","protocol":"tcp","original_string":"<166>Jan 5 08:52:35 10.22.8.216 %ASA-6-302014: Teardown TCP connection 212806010 for outside:10.22.8.33\/60223(LOCAL\\user.name) to inside:10.22.8.86\/389 duration 0:00:00 bytes 416 TCP Reset-I (user.name)","ip_dst_addr":"10.22.8.86","ip_src_port":60223,"ip_dst_port":389,"ciscotag":"ASA-6-302014","syslog_facility":"local4","action":"teardown","ip_src_addr":"10.22.8.33","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa","guid":"this-is-random-uuid-will-be-36-chars"}
+{"syslog_host":"10.22.8.216","protocol":"udp","original_string":"<166>Jan 5 08:52:35 10.22.8.216 %ASA-6-302015: Built inbound UDP connection 212806062 for outside:10.22.8.221\/56632 (10.22.8.221\/56632)(LOCAL\\user.name) to inside:10.22.8.73\/389 (10.22.8.73\/389) (user.name)","ip_dst_addr":"10.22.8.73","ip_src_port":56632,"ip_dst_port":389,"ciscotag":"ASA-6-302015","syslog_facility":"local4","action":"built","ip_src_addr":"10.22.8.221","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa","guid":"this-is-random-uuid-will-be-36-chars"}
+{"syslog_host":"10.22.8.216","original_string":"<167>Jan 5 08:52:35 10.22.8.216 %ASA-7-609002: Teardown local-host inside:10.22.8.205 duration 0:00:00","ciscotag":"ASA-7-609002","syslog_facility":"local4","syslog_severity":"debug","timestamp":1451983955000,"source.type":"asa","guid":"this-is-random-uuid-will-be-36-chars"}
+{"syslog_host":"10.22.8.201","protocol":"tcp","original_string":"<142>Jan 5 08:52:35 10.22.8.201 %ASA-6-302014: Teardown TCP connection 488168231 for Outside_VPN:204.111.72.243\/3011 to Inside-Trunk:10.22.8.208\/60037 duration 0:00:00 bytes 19415 TCP FINs","ip_dst_addr":"10.22.8.208","ip_src_port":3011,"ip_dst_port":60037,"ciscotag":"ASA-6-302014","syslog_facility":"local1","action":"teardown","ip_src_addr":"204.111.72.243","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa","guid":"this-is-random-uuid-will-be-36-chars"}
+{"syslog_host":"10.22.8.41","protocol":"tcp","original_string":"<166>Jan 5 16:52:35 10.22.8.41 %ASA-6-302013: Built inbound TCP connection 45476108 for Outside:10.22.8.97\/53484 (10.22.8.97\/53484)(LOCAL\\user.name) to Inside:141.111.72.70\/7576 (141.111.72.70\/7576) (user.name)","ip_dst_addr":"141.111.72.70","ip_src_port":53484,"ip_dst_port":7576,"ciscotag":"ASA-6-302013","syslog_facility":"local4","action":"built","ip_src_addr":"10.22.8.97","syslog_severity":"info","timestamp":1452012755000,"source.type":"asa","guid":"this-is-random-uuid-will-be-36-chars"}
+{"syslog_host":"10.22.8.212","protocol":"tcp","original_string":"<174>Jan 5 14:52:35 10.22.8.212 %ASA-6-302013: Built inbound TCP connection 76245527 for outside:10.22.8.97\/65195 (10.22.8.97\/65195) to inside:17.111.72.212\/5223 (17.111.72.212\/5223) (user.name)","ip_dst_addr":"17.111.72.212","ip_src_port":65195,"ip_dst_port":5223,"ciscotag":"ASA-6-302013","syslog_facility":"local5","action":"built","ip_src_addr":"10.22.8.97","syslog_severity":"info","timestamp":1452005555000,"source.type":"asa","guid":"this-is-random-uuid-will-be-36-chars"}
+{"syslog_host":"10.22.8.216","protocol":"tcp","original_string":"<166>Jan 5 08:52:35 10.22.8.216 %ASA-6-302014: Teardown TCP connection 212806018 for outside:10.22.8.17\/58632(LOCAL\\user.name) to inside:10.22.8.12\/389 duration 0:00:00 bytes 0 TCP FINs (user.name)","ip_dst_addr":"10.22.8.12","ip_src_port":58632,"ip_dst_port":389,"ciscotag":"ASA-6-302014","syslog_facility":"local4","action":"teardown","ip_src_addr":"10.22.8.17","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa","guid":"this-is-random-uuid-will-be-36-chars"}
+{"syslog_host":"10.22.8.201","protocol":"tcp","original_string":"<142>Jan 5 08:52:35 10.22.8.201 %ASA-6-302014: Teardown TCP connection 488168562 for DMZ-Inside:10.22.8.51\/51236 to Inside-Trunk:10.22.8.174\/40004 duration 0:00:00 bytes 2273 TCP FINs","ip_dst_addr":"10.22.8.174","ip_src_port":51236,"ip_dst_port":40004,"ciscotag":"ASA-6-302014","syslog_facility":"local1","action":"teardown","ip_src_addr":"10.22.8.51","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa","guid":"this-is-random-uuid-will-be-36-chars"}
+{"syslog_host":"10.22.8.216","protocol":"udp","original_string":"<166>Jan 5 08:52:35 10.22.8.216 %ASA-6-302015: Built inbound UDP connection 212806065 for outside:10.22.8.62\/59829 (10.22.8.62\/59829)(LOCAL\\user.name) to inside:10.22.8.85\/53 (10.22.8.85\/53) (user.name)","ip_dst_addr":"10.22.8.85","ip_src_port":59829,"ip_dst_port":53,"ciscotag":"ASA-6-302015","syslog_facility":"local4","action":"built","ip_src_addr":"10.22.8.62","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa","guid":"this-is-random-uuid-will-be-36-chars"}
+{"syslog_host":"10.22.8.216","protocol":"tcp","original_string":"<166>Jan 5 08:52:35 10.22.8.216 %ASA-6-302013: Built inbound TCP connection 212806067 for outside:10.22.8.143\/62675 (10.22.8.143\/62675)(LOCAL\\user.name) to inside:141.111.72.12\/389 (141.111.72.12\/389) (user.name)","ip_dst_addr":"141.111.72.12","ip_src_port":62675,"ip_dst_port":389,"ciscotag":"ASA-6-302013","syslog_facility":"local4","action":"built","ip_src_addr":"10.22.8.143","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa","guid":"this-is-random-uuid-will-be-36-chars"}
+{"syslog_host":"10.22.8.216","protocol":"udp","original_string":"<167>Jan 5 08:52:35 10.22.8.216 %ASA-7-710005: UDP request discarded from 10.22.8.223\/61122 to outside:224.111.72.252\/5355","ip_dst_addr":"224.111.72.252","ip_src_port":61122,"ip_dst_port":5355,"ciscotag":"ASA-7-710005","syslog_facility":"local4","action":"discarded","ip_src_addr":"10.22.8.223","syslog_severity":"debug","timestamp":1451983955000,"source.type":"asa","guid":"this-is-random-uuid-will-be-36-chars"}
+{"syslog_host":"10.22.8.216","protocol":"icmp","original_string":"<166>Jan 5 08:52:35 10.22.8.216 %ASA-6-302020: Built inbound ICMP connection for faddr 10.22.8.143\/0(LOCAL\\user.name) gaddr 141.111.72.12\/0 laddr 141.111.72.12\/0 (user.name)","ip_dst_addr":"10.22.8.143","ciscotag":"ASA-6-302020","syslog_facility":"local4","action":"built","ip_src_addr":"141.111.72.12","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa","guid":"this-is-random-uuid-will-be-36-chars"}
+{"syslog_host":"10.22.8.201","protocol":"tcp","original_string":"<142>Jan 5 08:52:35 10.22.8.201 %ASA-6-302014: Teardown TCP connection 488168547 for Outside_VPN:107.111.72.102\/80 to Inside-Trunk:10.22.8.54\/61676 duration 0:00:00 bytes 1030 TCP FINs","ip_dst_addr":"10.22.8.54","ip_src_port":80,"ip_dst_port":61676,"ciscotag":"ASA-6-302014","syslog_facility":"local1","action":"teardown","ip_src_addr":"107.111.72.102","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa","guid":"this-is-random-uuid-will-be-36-chars"}
+{"syslog_host":"10.22.8.216","protocol":"udp","original_string":"<166>Jan 5 08:52:35 10.22.8.216 %ASA-6-302015: Built inbound UDP connection 212806078 for outside:10.22.8.221\/56633 (10.22.8.221\/56633)(LOCAL\\user.name) to inside:10.22.8.20\/389 (10.22.8.20\/389) (user.name)","ip_dst_addr":"10.22.8.20","ip_src_port":56633,"ip_dst_port":389,"ciscotag":"ASA-6-302015","syslog_facility":"local4","action":"built","ip_src_addr":"10.22.8.221","syslog_severity":"info","timestamp":1451983955000,"source.type":"asa","guid":"this-is-random-uuid-will-be-36-chars"}
+{"syslog_host":"10.22.8.12","protocol":"tcp","original_string":"<166>Jan 5 09:52:35 10.22.8.12 %ASA-6-305011: Built dynamic TCP translation from inside:10.22.8.83\/59915 to outside:206.111.72.41\/22776","ip_src_port":59915,"ciscotag":"ASA-6-305011","syslog_facility":"local4","action":"built","ip_src_addr":"10.22.8.83","syslog_severity":"info","timestamp":1451987555000,"source.type":"asa","guid":"this-is-random-uuid-will-be-36-chars"}
+{"syslog_host":"10.22.8.201","protocol":"tcp","original_string":"<142>Jan 5 08:52:36 10.22.8.201 %ASA-6-302014: Teardown TCP connection 488168044 for Outside_VPN:50.111.72.39\/80 to Inside-Trunk:10.22.8.75\/60877 duration 0:00:01 bytes 13304 TCP FINs","ip_dst_addr":"10.22.8.75","ip_src_port":80,"ip_dst_port":60877,"ciscotag":"ASA-6-302014","syslog_facility":"local1","action":"teardown","ip_src_addr":"50.111.72.39","syslog_severity":"info","timestamp":1451983956000,"source.type":"asa","guid":"this-is-random-uuid-will-be-36-chars"}
+{"syslog_host":"10.22.8.201","protocol":"tcp","original_string":"<142>Jan 5 08:52:36 10.22.8.201 %ASA-6-302014: Teardown TCP connection 488118326 for Outside_VPN:23.111.72.27\/80 to Inside-Trunk:10.22.8.229\/57901 duration 0:01:45 bytes 1942 TCP FINs","ip_dst_addr":"10.22.8.229","ip_src_port":80,"ip_dst_port":57901,"ciscotag":"ASA-6-302014","syslog_facility":"local1","action":"teardown","ip_src_addr":"23.111.72.27","syslog_severity":"info","timestamp":1451983956000,"source.type":"asa","guid":"this-is-random-uuid-will-be-36-chars"}
+{"syslog_host":"10.22.8.201","protocol":"tcp","original_string":"<142>Jan 5 08:52:36 10.22.8.201 %ASA-6-302014: Teardown TCP connection 488160565 for Outside_VPN:72.111.72.29\/80 to Inside-Trunk:10.22.8.42\/57520 duration 0:00:15 bytes 1025 TCP FINs","ip_dst_addr":"10.22.8.42","ip_src_port":80,"ip_dst_port":57520,"ciscotag":"ASA-6-302014","syslog_facility":"local1","action":"teardown","ip_src_addr":"72.111.72.29","syslog_severity":"info","timestamp":1451983956000,"source.type":"asa","guid":"this-is-random-uuid-will-be-36-chars"}
+{"syslog_host":"10.22.8.201","protocol":"tcp","original_string":"<142>Jan 5 08:52:36 10.22.8.201 %ASA-6-302014: Teardown TCP connection 488096423 for Outside_VPN:72.111.72.43\/80 to Inside-Trunk:10.22.8.127\/59096 duration 0:02:27 bytes 99347 TCP Reset-O","ip_dst_addr":"10.22.8.127","ip_src_port":80,"ip_dst_port":59096,"ciscotag":"ASA-6-302014","syslog_facility":"local1","action":"teardown","ip_src_addr":"72.111.72.43","syslog_severity":"info","timestamp":1451983956000,"source.type":"asa","guid":"this-is-random-uuid-will-be-36-chars"}
+{"syslog_host":"10.22.8.201","protocol":"tcp","original_string":"<142>Jan 5 08:52:36 10.22.8.201 %ASA-6-302014: Teardown TCP connection 488095522 for Outside_VPN:72.111.72.43\/80 to Inside-Trunk:10.22.8.127\/59087 duration 0:02:29 bytes 154785 TCP Reset-O","ip_dst_addr":"10.22.8.127","ip_src_port":80,"ip_dst_port":59087,"ciscotag":"ASA-6-302014","syslog_facility":"local1","action":"teardown","ip_src_addr":"72.111.72.43","syslog_severity":"info","timestamp":1451983956000,"source.type":"asa","guid":"this-is-random-uuid-will-be-36-chars"}
+{"syslog_host":"10.22.8.201","protocol":"tcp","original_string":"<142>Jan 5 08:52:36 10.22.8.201 %ASA-6-302014: Teardown TCP connection 488106557 for Outside_VPN:72.111.72.43\/80 to Inside-Trunk:10.22.8.127\/5913
<TRUNCATED>
[3/3] incubator-metron git commit: METRON-765: Add GUID to messages
(iraghumitra via cestella) closes apache/incubator-metron#483
Posted by ce...@apache.org.
METRON-765: Add GUID to messages (iraghumitra via cestella) closes apache/incubator-metron#483
Project: http://git-wip-us.apache.org/repos/asf/incubator-metron/repo
Commit: http://git-wip-us.apache.org/repos/asf/incubator-metron/commit/27b0d6e3
Tree: http://git-wip-us.apache.org/repos/asf/incubator-metron/tree/27b0d6e3
Diff: http://git-wip-us.apache.org/repos/asf/incubator-metron/diff/27b0d6e3
Branch: refs/heads/master
Commit: 27b0d6e31de94317b085766349a892395f0d3309
Parents: 340e923
Author: iraghumitra <ra...@gmail.com>
Authored: Mon Mar 27 09:38:31 2017 -0400
Committer: cstella <ce...@gmail.com>
Committed: Mon Mar 27 09:38:31 2017 -0400
----------------------------------------------------------------------
.../org/apache/metron/common/Constants.java | 1 +
.../enrichment/bolt/EnrichmentSplitterBolt.java | 6 +-
.../bolt/EnrichmentSplitterBoltTest.java | 4 +
.../src/main/sample/data/asa/parsed/asa_parsed | 256 +++++++++----------
.../sample/data/bro/parsed/BroExampleParsed | 20 +-
.../data/jsonMap/parsed/jsonMapExampleParsed | 4 +-
.../main/sample/data/snort/parsed/SnortParsed | 6 +-
.../sample/data/squid/parsed/SquidExampleParsed | 4 +-
.../data/websphere/parsed/WebsphereParsed | 10 +-
.../sample/data/yaf/parsed/YafExampleParsed | 20 +-
.../apache/metron/parsers/bolt/ParserBolt.java | 4 +
.../metron/parsers/bolt/ParserBoltTest.java | 13 +-
...pleHbaseEnrichmentWriterIntegrationTest.java | 2 +-
.../metron/test/utils/ValidationUtils.java | 2 +-
14 files changed, 182 insertions(+), 170 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/incubator-metron/blob/27b0d6e3/metron-platform/metron-common/src/main/java/org/apache/metron/common/Constants.java
----------------------------------------------------------------------
diff --git a/metron-platform/metron-common/src/main/java/org/apache/metron/common/Constants.java b/metron-platform/metron-common/src/main/java/org/apache/metron/common/Constants.java
index 29be31e..1dc73da 100644
--- a/metron-platform/metron-common/src/main/java/org/apache/metron/common/Constants.java
+++ b/metron-platform/metron-common/src/main/java/org/apache/metron/common/Constants.java
@@ -31,6 +31,7 @@ public class Constants {
public static final String ERROR_STREAM = "error";
public static final String SIMPLE_HBASE_ENRICHMENT = "hbaseEnrichment";
public static final String SIMPLE_HBASE_THREAT_INTEL = "hbaseThreatIntel";
+ public static final String GUID = "guid";
public static enum Fields {
SRC_ADDR("ip_src_addr")
http://git-wip-us.apache.org/repos/asf/incubator-metron/blob/27b0d6e3/metron-platform/metron-enrichment/src/main/java/org/apache/metron/enrichment/bolt/EnrichmentSplitterBolt.java
----------------------------------------------------------------------
diff --git a/metron-platform/metron-enrichment/src/main/java/org/apache/metron/enrichment/bolt/EnrichmentSplitterBolt.java b/metron-platform/metron-enrichment/src/main/java/org/apache/metron/enrichment/bolt/EnrichmentSplitterBolt.java
index 1ec4252..f9cad80 100644
--- a/metron-platform/metron-enrichment/src/main/java/org/apache/metron/enrichment/bolt/EnrichmentSplitterBolt.java
+++ b/metron-platform/metron-enrichment/src/main/java/org/apache/metron/enrichment/bolt/EnrichmentSplitterBolt.java
@@ -61,9 +61,10 @@ public class EnrichmentSplitterBolt extends SplitBolt<JSONObject> {
}
@Override
public String getKey(Tuple tuple, JSONObject message) {
- String key = null;
+ String key = null, guid = null;
try {
key = tuple.getStringByField("key");
+ guid = (String)message.get(Constants.GUID);
}
catch(Throwable t) {
//swallowing this just in case.
@@ -71,6 +72,9 @@ public class EnrichmentSplitterBolt extends SplitBolt<JSONObject> {
if(key != null) {
return key;
}
+ else if(guid != null) {
+ return guid;
+ }
else {
return UUID.randomUUID().toString();
}
http://git-wip-us.apache.org/repos/asf/incubator-metron/blob/27b0d6e3/metron-platform/metron-enrichment/src/test/java/org/apache/metron/enrichment/bolt/EnrichmentSplitterBoltTest.java
----------------------------------------------------------------------
diff --git a/metron-platform/metron-enrichment/src/test/java/org/apache/metron/enrichment/bolt/EnrichmentSplitterBoltTest.java b/metron-platform/metron-enrichment/src/test/java/org/apache/metron/enrichment/bolt/EnrichmentSplitterBoltTest.java
index f3a1f2f..c79eb10 100644
--- a/metron-platform/metron-enrichment/src/test/java/org/apache/metron/enrichment/bolt/EnrichmentSplitterBoltTest.java
+++ b/metron-platform/metron-enrichment/src/test/java/org/apache/metron/enrichment/bolt/EnrichmentSplitterBoltTest.java
@@ -68,6 +68,10 @@ public class EnrichmentSplitterBoltTest extends BaseEnrichmentBoltTest {
when(tuple.getStringByField("key")).thenReturn(someKey);
key = enrichmentSplitterBolt.getKey(tuple, sampleMessage);
Assert.assertEquals(someKey, key);
+ String guid = "sample-guid";
+ when(sampleMessage.get("guid")).thenReturn(guid);
+ key = enrichmentSplitterBolt.getKey(tuple, sampleMessage);
+ Assert.assertEquals(guid, key);
when(tuple.getBinary(0)).thenReturn(sampleMessageString.getBytes());
JSONObject generatedMessage = enrichmentSplitterBolt.generateMessage(tuple);
removeTimingFields(generatedMessage);