topic ASA - HTTP POST LOGGING in Network Security

ASA - HTTP POST LOGGING

David Tsulaia — Tue, 26 Mar 2019 00:50:18 GMT

Hello dear all,

I need to log HTTP post request to webserver standing behind asa firewall, BUT I need to log variables that are inside the post request. I am able to match method post and request body that contains the request and the variables itself but the log file only shows the message about the match not the request body itself.

regex matchall "."

class-map type regex match-any Logregex

match regex matchall

class-map type inspect http match-all Loginspect

match request body regex class Logregex

policy-map type inspect http HTTP_POST_GET

parameters

match request method post

log

match request method get

log

class Loginspect

log

This config produces fllowing syslog messages:

for post

%ASA-5-415009: HTTP - matched request method post in policy-map HTTP_POST_GET, method matched from

same for get and body

Any advise would be very welcome, including just a link to a material to read.

Thanks in advance.

ASA - HTTP POST LOGGING

Julio Carvajal — Tue, 05 Mar 2013 01:50:35 GMT

Hello David,

Unfortunetely the log keyword used there will only tell you that a match has been done, it will no go any further by specifing the variables used in the HTTP POST.

As far as I know there is no such command to accomplish that on the ASA, You could try with an AIP-SSM in conjuction with the ASA and besides genering an alert also generating a packet-capture so you could analize each of the POST TCP HTTP to your server

Regards,

Julio Carvajal

Remember to rate all of the helpful posts

ASA - HTTP POST LOGGING

David Tsulaia — Wed, 06 Mar 2013 09:13:43 GMT

Unfortunately packet capture is not the option, because it requires more resuources than available on the receiving end and the POST caputure/analysis is not one-time thing. Plus we have no AIP-SSM at our disposal =)))

Thanks for the reply.

ASA - HTTP POST LOGGING

Julio Carvajal — Wed, 06 Mar 2013 16:32:21 GMT

Hello David,

Yes, then I do not see a way to do this

Hey man my pleasure to help,

Regards,