Cisco ASA address translation

Source and collection

Device logging subsystem / configured remote syslog or vendor export.

Record firmware version, enabled log categories, forwarding template, time zone and reliable transport settings.

Native example and provenance

upstream test fixture. Published example; no independent capture provenance claimed.

Original publisher / pinned upstream fixture — line 1

One complete record selected; values unchanged.

Pinned source commit: 9ae756f00f82786ac3496ce99c2dd288c5a5c031

Download the exact sample · Offline research kit

SHA-256: d87ff3f02e2d489b47511ace8c68327431e8d17b6c1a3cb588c2739c95b2d7f7

Oct 10 2018 12:34:56 localhost CiscoASA[999]: %ASA-6-305011: Built dynamic TCP translation from inside:172.31.98.44/1772 to outside:192.168.98.44/8256

Structure and field interpretation

Envelope

Priority, timestamp and hostname depend on the transport format.

Message payload

Use the exact vendor message type and version, not a generic whitespace split.

Investigation uses

• Recover address context when correlating internal hosts and perimeter observations.
• Compare device event time and collector time; monitor drops and preserve the original message.

Validation boundaries

A NAT translation alone does not identify a user or application.

This text sample passed byte-integrity and record-framing checks. Its field interpretation follows the cited format; a vendor-specific semantic parser has not been certified.

For a simulation, first parse this fixture offline, then create a separately labelled synthetic variant and test it against the intended collector in an isolated lab. Never replay public example identities or destinations into production.

Related sources

• Windows Security 5156 — Filtering Platform connection permitted
• Linux SSH authentication — auth.log / secure
• Linux sudo audit messages
• VMware vCenter audit and event syslog
• Palo Alto PAN-OS traffic
• Palo Alto PAN-OS threat

Ecosystem connections

• Telemetry Library — ATT&CK data components
• Detection Rules — candidate detection content
• Threat hunting — from intelligence to validated defense
• Practical security learning paths
• AdversaryGraph — evidence-led investigation

References

Sample provenance is linked above. Field availability and product behavior must be checked against the deployed version.