Custom Parser for Cisco CSC Module

The Cisco CSC Module is a popular product. Figures 11-35 through 11-50 show a summary of 13 of the logs produced by this module, as well as the log parser templates needed to report on these logs.

The CSC Module has its own management user interface and its own IP address, even though it is physically inserted into an ASA security appliance. Enable logging, through syslog, with it much as you would with any other application.

The following figures are not a complete list, but they cover a large number of the possible log messages you are likely to see from the Cisco CSC Module with version 6.1 software.

Figure 11-35 Log Templates for Cisco CSC 6.1

Figure 11-35 Log Templates for Cisco CSC 6.1

Figure 11-36 Cisco CSC Patterns for E-Mail NRS Block—Temporary

Figure 11-37 Cisco CSC Patterns for E-Mail NRS Block—Permanent

Figure 11-38 Cisco CSC Patterns for URL Filtering

Figure 11-39 Cisco CSC Patterns for HTTP Virus

Figure 11-40 Cisco CSC Patterns for HTTP PhishTrap

Figure 11-41 Cisco CSC Patterns for HTTP Blocking—User-Defined

Figure 11-42 Cisco CSC Patterns for E-Mail Virus Deleted

Figure 11-43 Cisco CSC Patterns for SMTP Session Disconnect

Figure 11-44 Cisco CSC Patterns for HTTP Session Disconnect

Figure 11-45 Cisco CSC Patterns for HTTP Grayware Blocked

Figure 11-46 Cisco CSC Patterns for ActiveUpdate

Figure 11-47 Cisco CSC Patterns for SMTP Anti-Spam (Delete)

Figure 11-48 Cisco CSC Patterns for SMTP Anti-Spam (Deliver)

Figure 11-49 My Reports Graph for Cisco CSC Module

CSC Module E-mail and Web Filtering, last ld-Oh_

I Legend|

Chart resolution: 30Mln

Asg/Min

Wed BPH Thu4flM Thull/Vfl Thu 7PM

Color Total Value Count

Related Posts

• Understanding NAC Framework Communications
• Determining Your Events per Second
• Security Device Event Exchange SDEE
• Degraded RAID Array - Security Monitoring
• Ingress Firewall Rules - Security Monitoring
• False Positives - Security Monitoring
• Entrepreneurship Guides
• Free Hosting for Your Website
• Project Management Templates
• Study Material For Cisco Students
• Search Engine Traffic Guide

720	E-mail NRS Block - Permanent^ 0,1.243,2520
rssa 389	E-mail NRS Block - Temporary [?] □ ,1.242.2450
176	Trend Micro Anti-Spam (Deliver)^ □ . 1.245.00
58	Unknown Device Event Type0 0,0.0.20
^M 4	Trend Micro ActiveUpdate0 0.1.244.1510
This straightforward view selects the Top N values for display by calculating the summed total of each value in the time range, and picking those with the largest total.

Figure 11-50 Full Report

Figure 11-50 Full Report

Continue reading here: Software Upgrades

Was this article helpful?

0 0