Hostname Field Extraction

This page contains the Hostname Field Extraction methods for a number of Log Sources, listed by log source.

The Armor Log Relay allows customers to forward security logs to Armor from a multitude of available Armor supported log sources. Many of these Log Relay log sources may be forwarding events from multiple event sources and it is important to be able to uniquely identify the originating event source. This facilitates easy searching with Kibana, tagging in Armor's Management Portal (AMP), and enhances the security outcomes provided by Armor.

Armor extracts a hostname from each log event as the unique identifier of the event's source. In Kibana, that hostname is mapped to the logsource.hostname field and in the Armor Tags API, it is combined in the resourceId for each tag ID using the convention log-relay-core-instance-id::hostname. Each log source has a specific way of formatting their logs and below is a description of the methodology Armor uses to extract the hostname value from each device type.

Check Point

Armor extracts the hostname by evaluating the following possible field matches, in order:

Extraction method 1:

The extraction is done by a key-value pair match on the origin field.

Sample Log

Hostname is the origin field, so in this sample, the hostname would be 127.0.0.1.

Base Case Extraction Method:

The expected extraction fields are not in the log, so the fallback option is unknown-check-point-<originating-host>.

Sample Log

If the log originated from 127.0.0.1, then the hostname would be unknown-check-point-127.0.0.1.

Cisco ASA

Armor extracts the hostname by evaluating the following possible field matches, in order:

Extraction Method 1:

The extraction is performed by a grok match on the log as follows: match => {"message" => "<%{NUMBER}>%{CISCOTIMESTAMP} %{WORD:syslog_hostname}"}.

Sample Log

The hostname is the syslog hostname from the log, so the hostname here would be cisco-asa-device.

Extraction Method 2:

The extraction is performed by a grok match on the log as follows: match => {"message" => "<%{NUMBER}>%{DATA:syslog_hostname} %%{CISCOTAG}:"}.

Sample Log

The hostname is the Cisco header hostname field from the log, so the hostname here would be cisco-asa-device.

Base Case Extraction Method:

The expected fields are not in the log, so the fallback option is unknown-cisco-asa-<originating-host>.

Sample Log

If the log originated from the host 127.0.0.1, then the hostname would be unknown-cisco-asa-127.0.0.1.

Cisco ISR

Armor extracts the hostname by evaluating the following possible field matches, in order:

Extraction Method 1:

The extraction is performed by a grok match on the log as follows: match => {"message" => "<%{NUMBER}>%{CISCOTIMESTAMP} %{WORD:syslog_hostname}"}.

Sample Log

The hostname is the syslog hostname from the log, so the hostname here would be cisco-isr-device.

Extraction Method 2:

The extraction is performed by a grok match on the log as follows: match => {"message" => "<%{NUMBER}>%{DATA:syslog_hostname} %%{CISCOTAG}:"}.

Sample Log

The hostname is the Cisco header hostname field from the log, so the hostname here would be cisco-isr-device.

Base Case Extraction Method:

The expected fields are not in the log, so the fallback option is unknown-cisco-isr-<originating-host>.

Sample Log

If the log originated from the host 127.0.0.1, then the hostname would be unknown-cisco-isr-127.0.0.1.

Fortinet Fortigate

Armor extracts the hostname by evaluating the following possible field matches, in order:

Extraction Method 1:

The extraction is done by a key-value pair match on the devname field.

Sample Log

Hostname is the devname field, so in this sample, the hostname would be FORT-SAMPLE.

Extraction Method 2:

The extraction is done by a key-value pair match on the devid field.

Sample Log

Hostname is the devid field, so in this sample, the hostname would be ABC1DE2345678901.

Base case extraction method:

The expected fields are not in the log, so the fallback option is unknown-fortigate-security-gateway-<originating host>.

Sample Log

If the log originated from the host 127.0.0.1, then the hostname would be unknown-fortigate-security-gateway-127.0.0.1.

Juniper SRX

Armor extracts the hostname by evaluating the following possible field matches, in order:

Extraction Method 1:

The extraction is performed by a grok match on the log as follows: match => {"message" => "%{SYSLOGTIMESTAMP} %{HOSTNAME:syslog_hostname} %{DATA:syslog_program}(?:[%{POSINT:syslog_pid}])?:"}.

Sample Log

The hostname is the syslog hostname from the log, so the hostname here would be router1.

Base case extraction method:

The expected fields are not in the log, so the fallback option is unknown-juniper-srx-<originating host>.

Sample Log

If the log originated from the host 127.0.0.1, then the hostname would be unknown-juniper-srx-127.0.0.1.

Palo Alto PanOS

Armor extracts the hostname by evaluating the following possible field matches, in order:

Extraction Method 1:

The extraction is done by a key-value pair match on the DeviceName field.

Sample Log

In this sample log, DeviceName=PANOS-01, so hostname for this log event would be PANOS-01.

Extraction method 2:

The extraction is done by a key-value pair match on the SerialNumber field.

Sample Log

In this sample log, `SerialNumber=123456789123`, so hostname for this log event would be 123456789123.

Extraction Method 3:

The extraction is performed by a grok match on the log as follows: match => {"message" => "%{SYSLOGTIMESTAMP} %{SYSLOGHOST:hostname}"}.

Sample Log

In this sample log, palodevice is the syslog hostname, so hostname for this log event would be palodevice.

Base Case Extraction Method:

The expected extraction fields are not in the log, so the fallback option is unknown-palo-alto-firewall-<originating-host>.

Sample Log

If the log originated from 192.168.1.3, then the hostname would be unknown-palo-alto-firewall-192.168.1.3.

Sonicwall

Armor extracts the hostname by evaluating the following possible field matches, in order:

Extraction method 1:

The extraction is done by a key-value pair match on the sn field.

Sample Log

The event's hostname is extracted from the sn field in the log event. In this sample log, sn=1234567891A1, so hostname for this log event would be 1234567891A1.

Extraction method 2:

The extraction is done by a key-value pair match on the fw field.

Sample Log

The event's hostname is extracted from the fw field in the log event. In this sample log, fw=4.4.4.4, so hostname for this log event would be 4.4.4.4.

Base Case Extraction Method:

The expected extraction fields are not in the log, so the fallback option is unknown-sonicwall-<originating-host>.

Sample Log

The expected extraction fields are not in the log, so the fallback option is unknown-sonicwall-<originating-host>. If the log originated from 4.4.4.4, then the hostname would be 4.4.4.4.

AWS WAF

Armor extracts the hostname by evaluating the following possible field matches, in order:

Extraction Method 1:

The extraction is performed by a grok match on the log as follows: match => {"webaclId" => ".+webacl/(?<hostname>[^/]+)"}.

Sample Log

The event's hostname is extracted and manipulated from the webaclId field with the following regular expression pattern: .+webacl\/([^\/]+). In this sample log, hostname would be sample-web-acl.

Base Case Extraction Method:

The expected fields are not in the log, so the fallback option is unknown-aws-waf-<originating-host>.

Sample Log

The expected extraction fields are not in the log, so the fallback option is unknown-aws-waf-<originating-host>. If the log originated from 8.8.8.8, then the hostname would be 8.8.8.8.

Imperva Incapsula

The hostname for Imperva Incapsula log events is determined by the name of the S3 bucket defined as the environment variable bucket_name in the /opt/armor/log-relay/conf.d/<pipeline_name>.<friendly_id>.env file on the Log Relay server.

If bucket_name was example-bucket-name, the hostname would be example-bucket-name. Be sure that only one Imperva Incapsula device feeds into one S3 bucket, or multiple devices will report under the same hostname.