Juniper SRX Firewall Extractions for Splunk
Overview
Note that these are written expressly for the log format that I was able to observe from our firewalls in testing. It's POSSIBLE that it may not conform exactly to your format, but as far as I'm aware, it should.
Also note that this adds an explicit sourcetype of "junos" and also maps the extractions to an auto-sourcetype we were seeing being created called "juniper_syslog". This package also adds a Splunk tag of "fw" which will be used along with an updated Juniper Netscreen Extractions add-on version, so that both can be searched with just "tag=fw". You may want to alias junos to something else if that happens to already be in use.
Release Notes
Version 1.7
- Released to a fix a few bugs that we were noticing with date and hostname parsing internally when sometimes there would be a single extra field immediately following the initial timestamp in syslog entries. The first three transforms have been adjusted, and should work universally... however, if you want to go back to the old versions from 1.6, they are still in there under "default/transforms.conf". Comment out the new REGEX and FORMAT entries and uncomment the old ones then restart Splunk to restore the prior behavior.
Version 1.6
Updated to allow the extractions to properly work with variances in spacing that we were observing (which were causing none of the extractions to work). Sorry for the oversight.
Version 1.5
Added extractions for the SRX CLOSE/CREATE/DENY messages that were cited by mbassettjr in the comments. Thanks for that... unfortunately we only recently implemented functionality to show messages in those formats, so was unable to have that output to test against originally.
All 3 new ones SHOULD be working fine, but I noticed that we have an extra field in our DENY output logs vs mbassettjr's version in the comments. If your results seem off for those messages, take a look at his version below. The other two (CLOSE and CREATE) were implemented directly and work fine for us without modification.
Also, there's now field-aliases in place for "policy_name" to "policy_id", "inbound_interface" to "src_zone" and "outbound_interface" to "dest_zone".