Cisco ASA TCP teardown

Source and collection

Device logging subsystem / configured remote syslog or vendor export.

Record firmware version, enabled log categories, forwarding template, time zone and reliable transport settings.

Native example and provenance

upstream test fixture. Published example; no independent capture provenance claimed.

Original publisher / pinned upstream fixture — line 3

One complete record selected; values unchanged.

Pinned source commit: 9ae756f00f82786ac3496ce99c2dd288c5a5c031

Download the exact sample · Offline research kit

SHA-256: 1d1a3b10594c237e5b84465a81460fe18625b89354706968263f2b1237eadb5f

Oct 10 2018 12:34:56 localhost CiscoASA[999]: %ASA-6-302014: Teardown TCP connection 11749 for outside:192.168.211.242/80 to inside:172.31.98.44/1758 duration 0:01:07 bytes 38110 TCP Reset-I

Structure and field interpretation

Envelope

Priority, timestamp and hostname depend on the transport format.

Message payload

Use the exact vendor message type and version, not a generic whitespace split.

Investigation uses

• Review duration, bytes and teardown reason with the matching build message.
• Compare device event time and collector time; monitor drops and preserve the original message.

Validation boundaries

Missing creation or teardown records can reflect collection loss or long-lived sessions.

This text sample passed byte-integrity and record-framing checks. Its field interpretation follows the cited format; a vendor-specific semantic parser has not been certified.

For a simulation, first parse this fixture offline, then create a separately labelled synthetic variant and test it against the intended collector in an isolated lab. Never replay public example identities or destinations into production.

Related sources

• Windows Security 5156 — Filtering Platform connection permitted
• Linux SSH authentication — auth.log / secure
• Linux sudo audit messages
• VMware vCenter audit and event syslog
• Palo Alto PAN-OS traffic
• Palo Alto PAN-OS threat

Ecosystem connections

• Telemetry Library — ATT&CK data components
• Detection Rules — candidate detection content
• Threat hunting — from intelligence to validated defense
• Practical security learning paths
• AdversaryGraph — evidence-led investigation

References

Sample provenance is linked above. Field availability and product behavior must be checked against the deployed version.