[#17491][cisco-ftd]: Parse user authentication rejection reasons by Niceplace · Pull Request #18828 · elastic/integrations

Niceplace · 2026-05-05T16:25:29Z

Proposed commit message

Add grok processor support in cisco FTD integration to accept four variants of user authentication rejection reasons: Invalid Password, Password is expiring, Password malformed, Password has expired. The support for "Invalid Password" is scoped to address issue #17491 whereas the other three rejection reasons are a backport of #8015

Checklist

I have reviewed tips for building integrations and this pull request is aligned with them.
I have verified that all data streams collect metrics or logs.
I have added an entry to my package's changelog.yml file.
I have verified that Kibana version constraints are current according to guidelines.
I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

From the root of the repo

Go to packages/cisco_ftd
Run elastic-package stack up -d
Run elastic-package test pipeline
All tests should pass

Sample logs used for pipeline tests are in /packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-ftd-fix-message-113005-user-auth-rejected.log

Related issues

Fixes: #17491 and as recommended in #17491 (comment), implements the same support for authentication reason rejections as #8015

…d rejection reasons in cisco FTD

github-actions · 2026-05-05T16:28:34Z

Elastic Docs Style Checker (Vale)

Summary: 1 suggestion found

💡 Suggestions (1): Optional style improvements. Apply when helpful.

File	Line	Rule	Message
packages/cisco_ftd/changelog.yml	1	Elastic.Versions	Use 'later versions' instead of 'newer versions' when referring to versions.

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

Niceplace · 2026-05-06T17:26:23Z

 # Folder created by the Sonar Scanner
 .scannerwork/
+
+# Zed editor settings


Context: By default, Zed auto-formats YAML with opinionated rules based on prettier, which introduced a bunch of indentation/whitespace/double quote formatting.

Since I did not want to entirely disable YAML formatting in my whole workspace, I added a project-specific zed configuration for that, hence the need to create a .zed/ folder here, which we don't want included in the code.

@elastic/ecosystem - Would you mind taking a look at this change?

@Niceplace would it be an option for you to use ~/.gitignore_global?

Git supports global ignores using this file, so one doesn't need to add all the files of all the tools they use to all the projects.

I love it ! Thank you

Niceplace · 2026-05-06T17:31:03Z

 <182>2025-03-06T16:54:27Z seattle : %FTD-6-302304: Teardown TCP state-bypass connection 123456789 from carpal-tunnel1:10.123.1.23/38110 to EL_BOW2:10.0.10.123/6379 duration  0:02:02 bytes 54 Connection timeout
 <190>2025-12-08T07:15:25Z: %FTD-6-113005: AAA user authorization Rejected : reason = AAA failure : server = 81.2.69.195 : user = user1@example.com : user IP = 10.7.5.8
 <118>2026-03-24T13:48:05Z: %FTD-6-430002: EventPriority: Low, DeviceUUID: 48a00000-8e53-11ec-9a0c-d396ffaa0000, InstanceID: 23, FirstPacketSecond: 2026-03-24T13:48:05Z, ConnectionID: 56300, AccessControlRuleAction: Allow, SrcIP: 10.123.123.123, DstIP: 10.123.123.124, SrcPort: 1234, DstPort: 5678, Protocol: udp, IngressInterface: inside, EgressInterface: outside, IngressZone: input-zone, EgressZone: output-zone, SourceSecurityGroup: 2005, SourceSecurityGroupTag: 2005, DestinationSecurityGroup: 9, DestinationSecurityGroupTag: 9, SourceSecurityGroupType: Session Directory, DestinationSecurityGroupType: SXP, IngressVRF: Global, EgressVRF: Global, Endpoint Profile: Cisco-Device:Cisco-Collaboration-Device:Cisco-Room-Device, ACPolicy: ProductionPolicy, AccessControlRuleName: Intrusion-Rule, Prefilter Policy: Default Prefilter Policy, Client: DNS, ApplicationProtocol: DNS, InitiatorPackets: 1, ResponderPackets: 0, InitiatorBytes: 102, ResponderBytes: 0, NAPPolicy: Balanced Security and Connectivity, DNSQuery: elastic.co, DNSRecordType: a host address, DNSResponseType: No Error, ReferencedHost: elastic.co, ClientAppDetector: AppID
+<166>May 01 2026 09:24:32Z  %FTD-6-113005: AAA user authentication Rejected : reason = Invalid password : server = 192.0.2.20 : user = engineer@elastic.co : user IP = 198.51.100.30


I initially added these log lines in a separate file dedicated to the bugfix, but after initial review with @vinit-chauhan (thanks for the help Vinit :D !) it was decided to move them into an existing log file that contained log entries of a similar category.

Also as a recommendation from the initial review, IP addresses used in tests are valid according to ingest pipeline geoip recommendations.

infra-vault-gh-plugin-prod · 2026-05-06T20:01:29Z

Pinging @elastic/integration-experience (Team:Integration-Experience)

Niceplace · 2026-05-07T17:21:04Z

I've been able to locally reproduce the failure for the aws.config test, I'm trying to understand if the failure is consistent and related to my changes or not. I also have a failure with the netbox integration that seems to be consistent in the CI so I have to investigate this one as well. I also want to confirm if these failures are happening on main

Example aws.config failure: https://buildkite.com/elastic/integrations/builds/42437/canvas?sid=019dfe60-06c0-4b86-a3f2-b404855cfa40&tab=output
Example netbox test failure: https://buildkite.com/elastic/integrations/builds/42437/canvas?sid=019dfe60-07a3-4c83-9da1-2429a8c64eca&tab=output

….com:elastic/integrations into fix/17491-cisco-ftd-incorrect-reason-parsing

github-actions · 2026-05-27T15:44:08Z

TL;DR

Buildkite failed in Check integrations cisco_ftd because the package README check is out of sync: the PR adds cisco.ftd.rejection_reason to packages/cisco_ftd/docs/README.md, but the generated README no longer contains that field after the ingest pipeline change.

Remediation

Regenerate docs for the package (cd packages/cisco_ftd && elastic-package build) and commit the resulting README changes, or manually remove the added cisco.ftd.rejection_reason row from packages/cisco_ftd/docs/README.md.
Re-run the package check (.buildkite/scripts/test_one_package.sh packages/cisco_ftd origin/main 4db92f7abc60001635e80d8ea25bb851f048bc5f) to confirm README lint passes.

Investigation details

Root Cause

This is a configuration/docs sync failure, not a parser runtime/test assertion failure.

The PR updates the grok capture to event.reason in packages/cisco_ftd/data_stream/log/elasticsearch/ingest_pipeline/default.yml (hunk @@ -431,9 +431,9 @@), and expands accepted reason values. In the same PR, packages/cisco_ftd/docs/README.md adds:

| cisco.ftd.rejection_reason | Reason for AAA user authentication rejection | keyword |

During CI, elastic-package lint rebuilds README content and reports that this row should be removed.

Evidence

Build: https://buildkite.com/elastic/integrations/builds/43623
Job/step: Check integrations cisco_ftd
Key log excerpt (/tmp/gh-aw/buildkite-logs/integrations-check-integrations-cisco_ftd.txt):

README.md is outdated. Rebuild the package with 'elastic-package build'
@@ -165,3 +165,2 @@
 | cisco.ftd.privilege.old | When a users privilege is changed this is the old value | keyword |
-| cisco.ftd.rejection_reason | Reason for AAA user authentication rejection | keyword |
 | cisco.ftd.rule_name | Name of the Access Control List rule that matched this event. | keyword |
Error: checking package failed: checking readme files are up-to-date failed: files do not match

Verification

Not run in this workflow (read-only detective run); diagnosis is from Buildkite logs + PR diff correlation.

Follow-up

If cisco.ftd.rejection_reason is still intended as a package field, add/restore a backing field definition and pipeline mapping for it; otherwise keep event.reason and let generated docs omit the custom field row.

What is this? | From workflow: PR Buildkite Detective

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

vinit-chauhan · 2026-05-27T16:40:33Z

 | cisco.ftd.missed_updates_count | The number of Stateful Failover updates missed. | long |
 | cisco.ftd.privilege.new | When a users privilege is changed this is the new value | keyword |
 | cisco.ftd.privilege.old | When a users privilege is changed this is the old value | keyword |
+| cisco.ftd.rejection_reason | Reason for AAA user authentication rejection | keyword |


Could you regenerate the README? I think this is stale.

vinit-chauhan

LGTM

elasticmachine · 2026-05-29T15:53:19Z

💚 Build Succeeded

Buildkite Build
Commit: d3135b5

History

💚 Build #43700 succeeded 6d21f02
💔 Build #43689 failed f56db08
💔 Build #43623 failed 4db92f7
💚 Build #43539 succeeded a42fa24
💚 Build #43475 succeeded 3253e52
💚 Build #43458 succeeded eb731e9

…ns (elastic#18828) * fix: Add support in grok processors for four more variants of password rejection reasons in cisco FTD * Generate changelog entry and bump version * Ignore per-project zed editor settings * Revert whitespace & quote changes introduced by editor auto-formatting * Re-add grok processor fix for authentication reason field * Move logs to a file containing existing logs similary in category * Ensure rejection reason is parsed and mapped to the ECS field * Revert local changes for editor, will use global ignore instead * Update generated JSON without formatting * Use ECS field event.reason instead of custom vendor field * Rebuild package to remove custom field we no longer use * Added Undefined as a supported reason, taking example from cisco ASA

elastic-vault-github-plugin-prod · 2026-06-01T16:05:29Z

Package cisco_ftd - 3.13.5 containing this change is available at https://epr.elastic.co/package/cisco_ftd/3.13.5/

fix: Add support in grok processors for four more variants of passwor…

8e40193

…d rejection reasons in cisco FTD

Niceplace added the bugfix Pull request that fixes a bug issue label May 5, 2026

Niceplace and others added 2 commits May 5, 2026 12:29

Generate changelog entry and bump version

c6f42cc

Merge branch 'main' into fix/17491-cisco-ftd-incorrect-reason-parsing

38d61e2

This comment has been minimized.

Sign in to view

andrewkroh added documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. Integration:cisco_ftd Cisco FTD labels May 5, 2026

Merge branch 'main' into fix/17491-cisco-ftd-incorrect-reason-parsing

86786fa

This comment was marked as spam.

Sign in to view

Niceplace added 2 commits May 6, 2026 11:54

Ignore per-project zed editor settings

12a7e05

Revert whitespace & quote changes introduced by editor auto-formatting

be32a6f

This comment has been minimized.

Sign in to view

Niceplace added 2 commits May 6, 2026 12:40

Re-add grok processor fix for authentication reason field

ace6252

Move logs to a file containing existing logs similary in category

4a5f9e3

Niceplace commented May 6, 2026

View reviewed changes

Niceplace marked this pull request as ready for review May 6, 2026 17:31

Niceplace requested review from a team as code owners May 6, 2026 17:31

Merge branch 'main' into fix/17491-cisco-ftd-incorrect-reason-parsing

1678b87

This comment has been minimized.

Sign in to view

andrewkroh added the Team:Integration-Experience Security Integrations Integration Experience [elastic/integration-experience] label May 6, 2026

Niceplace requested review from taylor-swanson and vinit-chauhan May 6, 2026 21:13

Niceplace added 2 commits May 7, 2026 09:39

Merge branch 'main' into fix/17491-cisco-ftd-incorrect-reason-parsing

0904e0e

Merge branch 'main' into fix/17491-cisco-ftd-incorrect-reason-parsing

11c960e

Niceplace mentioned this pull request May 7, 2026

Handle self-signed certs expiration in package tests #18881

Closed

4 of 5 tasks

Merge branch 'main' into fix/17491-cisco-ftd-incorrect-reason-parsing

79c377c

This comment has been minimized.

Sign in to view

Niceplace added 2 commits May 25, 2026 12:49

Ensure rejection reason is parsed and mapped to the ECS field

453f6e8

Revert local changes for editor, will use global ignore instead

eb731e9

Niceplace requested a review from vinit-chauhan May 25, 2026 16:54

Update generated JSON without formatting

3253e52

Merge branch 'main' into fix/17491-cisco-ftd-incorrect-reason-parsing

a42fa24

vinit-chauhan reviewed May 26, 2026

View reviewed changes

Comment thread packages/cisco_ftd/data_stream/log/elasticsearch/ingest_pipeline/default.yml Resolved

Niceplace and others added 3 commits May 27, 2026 11:00

Merge branch 'main' into fix/17491-cisco-ftd-incorrect-reason-parsing

3830e4b

Use ECS field event.reason instead of custom vendor field

03ff937

Merge branch 'fix/17491-cisco-ftd-incorrect-reason-parsing' of github…

4db92f7

….com:elastic/integrations into fix/17491-cisco-ftd-incorrect-reason-parsing

Niceplace requested review from vinit-chauhan and removed request for taylor-swanson May 27, 2026 15:24

vinit-chauhan reviewed May 27, 2026

View reviewed changes

Niceplace and others added 2 commits May 28, 2026 09:53

Merge branch 'main' into fix/17491-cisco-ftd-incorrect-reason-parsing

f56db08

Rebuild package to remove custom field we no longer use

6d21f02

andrewkroh removed the documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. label May 28, 2026

vinit-chauhan approved these changes May 28, 2026

View reviewed changes

Added Undefined as a supported reason, taking example from cisco ASA

d3135b5

Niceplace merged commit 9f627ac into main Jun 1, 2026
10 checks passed

Niceplace deleted the fix/17491-cisco-ftd-incorrect-reason-parsing branch June 1, 2026 15:46

github-actions Bot mentioned this pull request Jun 1, 2026

[CI] Add /sync-changelog comment trigger to retry failed changelog sync PRs #19321

Closed

6 tasks

Conversation

Niceplace commented May 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed commit message

Checklist

How to test this PR locally

Related issues

Uh oh!

github-actions Bot commented May 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Elastic Docs Style Checker (Vale)

Uh oh!

This comment has been minimized.

This comment was marked as spam.

This comment has been minimized.

Niceplace May 6, 2026

Choose a reason for hiding this comment

Uh oh!

vinit-chauhan May 21, 2026

Choose a reason for hiding this comment

Uh oh!

jsoriano May 22, 2026

Choose a reason for hiding this comment

Uh oh!

Niceplace May 25, 2026

Choose a reason for hiding this comment

Uh oh!

Niceplace May 6, 2026

Choose a reason for hiding this comment

Uh oh!

This comment has been minimized.

infra-vault-gh-plugin-prod Bot commented May 6, 2026

Uh oh!

Niceplace commented May 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment has been minimized.

Uh oh!

github-actions Bot commented May 27, 2026

TL;DR

Remediation

Root Cause

Evidence

Verification

Follow-up

Uh oh!

vinit-chauhan May 27, 2026

Choose a reason for hiding this comment

Uh oh!

vinit-chauhan left a comment

Choose a reason for hiding this comment

Uh oh!

elasticmachine commented May 29, 2026

💚 Build Succeeded

History

Uh oh!

Uh oh!

elastic-vault-github-plugin-prod Bot commented Jun 1, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Niceplace commented May 5, 2026 •

edited

Loading

github-actions Bot commented May 5, 2026 •

edited

Loading

Niceplace commented May 7, 2026 •

edited

Loading