octopussy 1.0.6-0ubuntu2 / etc / octopussy / conf / services / Cisco_ASA.xml

<?xml version='1.0' encoding='UTF-8'?>
<octopussy_service description="Cisco Asa Service"
                   icon="companies/logo_cisco"
                   name="Cisco_ASA"
                   nb_messages="171"
                   version="201206200001"
                   website="">
  <message loglevel="Information"
           msg_id="Cisco_ASA:teardown_connection_OLD"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; : &lt;@REGEXP(&quot;\%FWSM.+&quot;):msg_id@&gt;: Teardown &lt;@WORD:protocol@&gt; connection &lt;@NUMBER:connection_id@&gt; for &lt;@STRING:src@&gt;:&lt;@IP_ADDR:src_addr@&gt;/&lt;@NUMBER:src_port@&gt; to &lt;@STRING:dst@&gt;:&lt;@IP_ADDR:dst_addr@&gt;/&lt;@NUMBER:dst_port@&gt; duration &lt;@TIME:duration@&gt; bytes &lt;@NUMBER:bytes@&gt;"
           rank="006"
           table="Cisco_ASA"
           taxonomy="Traffic" />
  <message loglevel="Information"
           msg_id="Cisco_ASA:built_outbound_connection"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; : &lt;@REGEXP(&quot;\%FWSM.+&quot;):msg_id@&gt;: Built outbound &lt;@WORD:protocol@&gt; connection &lt;@NUMBER:connection_id@&gt; for &lt;@STRING:src@&gt;:&lt;@IP_ADDR:src_addr@&gt;/&lt;@NUMBER:src_port@&gt; (&lt;@IP_ADDR:src_addr_2@&gt;/&lt;@NUMBER:src_port_2@&gt;) to &lt;@STRING:dst@&gt;:&lt;@IP_ADDR:dst_addr@&gt;/&lt;@NUMBER:dst_port@&gt; (&lt;@IP_ADDR:dst_addr_2@&gt;/&lt;@NUMBER:dst_port_2@&gt;)"
           rank="004"
           table="Cisco_ASA"
           taxonomy="Traffic" />
  <message loglevel="Information"
           msg_id="Cisco_ASA:built_outbound_connection_faddr_gaddr_laddr"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; : &lt;@REGEXP(&quot;\%FWSM.+&quot;):msg_id@&gt;: Built outbound &lt;@WORD:protocol@&gt; connection for faddr &lt;@IP_ADDR:faddr@&gt;/&lt;@NUMBER:faddr_port@&gt; gaddr &lt;@IP_ADDR:gaddr@&gt;/&lt;@NUMBER:gaddr_port@&gt; laddr &lt;@IP_ADDR:laddr@&gt;/&lt;@NUMBER:laddr_port@&gt;"
           rank="005"
           table="Cisco_ASA"
           taxonomy="Traffic" />
  <message loglevel="Information"
           msg_id="Cisco_ASA:teardown_connection_faddr_gaddr_laddr"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; : &lt;@REGEXP(&quot;\%FWSM.+&quot;):msg_id@&gt;: Teardown &lt;@WORD:protocol@&gt; connection for faddr &lt;@IP_ADDR:faddr@&gt;/&lt;@NUMBER:faddr_port@&gt; gaddr &lt;@IP_ADDR:gaddr@&gt;/&lt;@NUMBER:gaddr_port@&gt; laddr &lt;@IP_ADDR:laddr@&gt;/&lt;@NUMBER:laddr_port@&gt;"
           rank="007"
           table="Cisco_ASA"
           taxonomy="Traffic" />
  <message loglevel="Information"
           msg_id="Cisco_ASA:built_inbound_connection"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; : &lt;@REGEXP(&quot;\%FWSM.+&quot;):msg_id@&gt;: Built inbound &lt;@WORD:protocol@&gt; connection &lt;@NUMBER:connection_id@&gt; for &lt;@STRING:src@&gt;:&lt;@IP_ADDR:src_addr@&gt;/&lt;@NUMBER:src_port@&gt; (&lt;@IP_ADDR:src_addr_2@&gt;/&lt;@NUMBER:src_port_2@&gt;) to &lt;@STRING:dst@&gt;:&lt;@IP_ADDR:dst_addr@&gt;/&lt;@NUMBER:dst_port@&gt; (&lt;@IP_ADDR:dst_addr_2@&gt;/&lt;@NUMBER:dst_port_2@&gt;)"
           rank="002"
           table="Cisco_ASA"
           taxonomy="Traffic" />
  <message loglevel="Information"
           msg_id="Cisco_ASA:deny_connection"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; : &lt;@REGEXP(&quot;\%FWSM.+&quot;):msg_id@&gt;: Deny &lt;@WORD:protocol@&gt; (no connection) from &lt;@IP_ADDR:src_addr@&gt;/&lt;@NUMBER:src_port@&gt; to &lt;@IP_ADDR:dst_addr@&gt;/&lt;@NUMBER:dst_port@&gt; flags &lt;@STRING:flags@&gt; on interface &lt;@STRING:interface@&gt;"
           rank="008"
           table="Cisco_ASA"
           taxonomy="Traffic.Denied" />
  <message loglevel="Information"
           msg_id="Cisco_ASA:built_static_translation_short"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; : &lt;@REGEXP(&quot;\%FWSM.+&quot;):msg_id@&gt;: Built static translation from &lt;@STRING:src@&gt;:&lt;@IP_ADDR:src_addr@&gt; to &lt;@STRING:dst@&gt;:&lt;@IP_ADDR:dst_addr@&gt;"
           rank="013"
           table="Cisco_ASA"
           taxonomy="Traffic" />
  <message loglevel="Information"
           msg_id="Cisco_ASA:deny_by_accessgroup_long"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; : &lt;@REGEXP(&quot;\%FWSM.+&quot;):msg_id@&gt;: Deny &lt;@WORD:protocol@&gt; src &lt;@STRING:src@&gt;:&lt;@IP_ADDR:src_addr@&gt;/&lt;@NUMBER:src_port@&gt; dst &lt;@STRING:dst@&gt;:&lt;@IP_ADDR:dst_addr@&gt;/&lt;@NUMBER:dst_port@&gt; by access-group &quot;&lt;@STRING:acl@&gt;&quot; [&lt;@STRING:acl_id@&gt;]"
           rank="009"
           table="Cisco_ASA"
           taxonomy="Traffic.Denied" />
  <message loglevel="Information"
           msg_id="Cisco_ASA:accesslist_denied_first_hit"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; : &lt;@REGEXP(&quot;\%FWSM.+&quot;):msg_id@&gt;: access-list &lt;@STRING:acl@&gt; denied &lt;@WORD:protocol@&gt; &lt;@STRING:src@&gt;/&lt;@IP_ADDR:src_addr@&gt;(&lt;@NUMBER:src_port@&gt;) -&gt; &lt;@STRING:dst@&gt;/&lt;@IP_ADDR:dst_addr@&gt;(&lt;@NUMBER:dst_port@&gt;) &lt;@REGEXP(&quot;hit-cnt \d+ \(first hit\)&quot;):msg@&gt; [&lt;@STRING:acl_id@&gt;]"
           rank="001"
           table="Cisco_ASA"
           taxonomy="Traffic.Denied" />
  <message loglevel="Information"
           msg_id="Cisco_ASA:built_inbound_connection_faddr_gaddr_laddr"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; : &lt;@REGEXP(&quot;\%FWSM.+&quot;):msg_id@&gt;: Built inbound &lt;@WORD:protocol@&gt; connection for faddr &lt;@IP_ADDR:faddr@&gt;/&lt;@NUMBER:faddr_port@&gt; gaddr &lt;@IP_ADDR:gaddr@&gt;/&lt;@NUMBER:gaddr_port@&gt; laddr &lt;@IP_ADDR:laddr@&gt;/&lt;@NUMBER:laddr_port@&gt;"
           rank="003"
           table="Cisco_ASA"
           taxonomy="Traffic" />
  <message loglevel="Information"
           msg_id="Cisco_ASA:teardown_static_translation_long"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; : &lt;@REGEXP(&quot;\%FWSM.+&quot;):msg_id@&gt;: Teardown static &lt;@WORD:protocol@&gt; translation from &lt;@STRING:src@&gt;:&lt;@IP_ADDR:src_addr@&gt;/&lt;@NUMBER:src_port@&gt; to &lt;@STRING:dst@&gt;:&lt;@IP_ADDR:dst_addr@&gt;/&lt;@NUMBER:dst_port@&gt; duration &lt;@TIME:duration@&gt;"
           rank="010"
           table="Cisco_ASA"
           taxonomy="Traffic" />
  <message loglevel="Information"
           msg_id="Cisco_ASA:teardown_static_translation_short"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; : &lt;@REGEXP(&quot;\%FWSM.+&quot;):msg_id@&gt;: Teardown static translation from &lt;@STRING:src@&gt;:&lt;@IP_ADDR:src_addr@&gt; to &lt;@STRING:dst@&gt;:&lt;@IP_ADDR:dst_addr@&gt; duration &lt;@TIME:duration@&gt;"
           rank="011"
           table="Cisco_ASA"
           taxonomy="Traffic" />
  <message loglevel="Information"
           msg_id="Cisco_ASA:built_static_translation_long"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; : &lt;@REGEXP(&quot;\%FWSM.+&quot;):msg_id@&gt;: Built static &lt;@WORD:protocol@&gt; translation from &lt;@STRING:src@&gt;:&lt;@IP_ADDR:src_addr@&gt;/&lt;@NUMBER:src_port@&gt; to &lt;@STRING:dst@&gt;:&lt;@IP_ADDR:dst_addr@&gt;/&lt;@NUMBER:dst_port@&gt;"
           rank="012"
           table="Cisco_ASA"
           taxonomy="Traffic" />
  <message loglevel="Information"
           msg_id="Cisco_ASA:teardown_dynamic_translation_short"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; : &lt;@REGEXP(&quot;\%FWSM.+&quot;):msg_id@&gt;: Teardown dynamic translation from &lt;@STRING:src@&gt;:&lt;@IP_ADDR:src_addr@&gt; to &lt;@STRING:dst@&gt;:&lt;@IP_ADDR:dst_addr@&gt; duration &lt;@TIME:duration@&gt;"
           rank="015"
           table="Cisco_ASA"
           taxonomy="Traffic" />
  <message loglevel="Information"
           msg_id="Cisco_ASA:built_dynamic_translation_short"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; : &lt;@REGEXP(&quot;\%FWSM.+&quot;):msg_id@&gt;: Built dynamic translation from &lt;@STRING:src@&gt;:&lt;@IP_ADDR:src_addr@&gt; to &lt;@STRING:dst@&gt;:&lt;@IP_ADDR:dst_addr@&gt;"
           rank="014"
           table="Cisco_ASA"
           taxonomy="Traffic" />
  <message loglevel="Information"
           msg_id="Cisco_ASA:deny_inbound_no_xlate"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; : &lt;@REGEXP(&quot;\%FWSM.+&quot;):msg_id@&gt;: Deny inbound (No xlate) &lt;@WORD:protocol@&gt; src &lt;@STRING:src@&gt;:&lt;@IP_ADDR:src_addr@&gt;/&lt;@NUMBER:src_port@&gt; dst &lt;@STRING:dst@&gt;:&lt;@IP_ADDR:dst_addr@&gt;/&lt;@NUMBER:dst_port@&gt;"
           rank="016"
           table="Cisco_ASA"
           taxonomy="Traffic.Denied" />
  <message loglevel="Information"
           msg_id="Cisco_ASA:retrieved_file"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; : &lt;@REGEXP(&quot;\%FWSM.+&quot;):msg_id@&gt; &lt;@IP_ADDR:src_addr@&gt; Retrieved &lt;@IP_ADDR:dst_addr@&gt;:&lt;@STRING:msg@&gt;"
           rank="017"
           table="Cisco_ASA"
           taxonomy="Traffic" />
  <message loglevel="Information"
           msg_id="Cisco_ASA:deny_connection_marked_for_deletion"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; : &lt;@REGEXP(&quot;\%FWSM.+&quot;):msg_id@&gt;: Deny &lt;@WORD:protocol@&gt; (Connection marked for Deletion) from &lt;@IP_ADDR:src_addr@&gt;/&lt;@NUMBER:src_port@&gt; to &lt;@IP_ADDR:dst_addr@&gt;/&lt;@NUMBER:dst_port@&gt; flags &lt;@STRING:flags@&gt; on interface &lt;@STRING:interface@&gt;"
           rank="018"
           table="Cisco_ASA"
           taxonomy="Traffic.Denied" />
  <message loglevel="Information"
           msg_id="Cisco_ASA:access_denied_by_acl"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; : &lt;@REGEXP(&quot;\%FWSM.+&quot;):msg_id@&gt;: &lt;@WORD:protocol@&gt; access denied by &lt;@STRING:acl@&gt; from &lt;@IP_ADDR:src_addr@&gt;/&lt;@NUMBER:src_port@&gt; to &lt;@STRING:dst@&gt;:&lt;@IP_ADDR:dst_addr@&gt;/&lt;@NUMBER:dst_port@&gt;"
           rank="019"
           table="Cisco_ASA"
           taxonomy="Traffic.Denied" />
  <message loglevel="Information"
           msg_id="Cisco_ASA:deny_inbound_due_to_dns_response"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; : &lt;@REGEXP(&quot;\%FWSM.+&quot;):msg_id@&gt;: Deny inbound &lt;@WORD:protocol@&gt; from &lt;@IP_ADDR:src_addr@&gt;/&lt;@NUMBER:src_port@&gt; to &lt;@IP_ADDR:dst_addr@&gt;/&lt;@NUMBER:dst_port@&gt; due to DNS Response"
           rank="020"
           table="Cisco_ASA"
           taxonomy="Traffic.Denied" />
  <message loglevel="Information"
           msg_id="Cisco_ASA:deny_by_accessgroup_short"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; : &lt;@REGEXP(&quot;\%FWSM.+&quot;):msg_id@&gt;: Deny &lt;@WORD:protocol@&gt; src &lt;@STRING:src@&gt;:&lt;@IP_ADDR:src_addr@&gt; dst &lt;@STRING:dst@&gt;&lt;@IP_ADDR:dst_addr@&gt; (&lt;@STRING:status@&gt;) by access-group &quot;&lt;@STRING:acl@&gt; [&lt;@STRING:acl_id@&gt;]"
           rank="021"
           table="Cisco_ASA"
           taxonomy="Traffic.Denied" />
  <message loglevel="Information"
           msg_id="Cisco_ASA:teardown_connection_with_protocol_flags"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; : &lt;@REGEXP(&quot;\%FWSM.+&quot;):msg_id@&gt;: Teardown &lt;@WORD:protocol@&gt; connection &lt;@NUMBER:connection_id@&gt; for &lt;@STRING:src@&gt;:&lt;@IP_ADDR:src_addr@&gt;/&lt;@NUMBER:src_port@&gt; to &lt;@STRING:dst@&gt;:&lt;@IP_ADDR:dst_addr@&gt;/&lt;@NUMBER:dst_port@&gt; duration &lt;@TIME:duration@&gt; bytes &lt;@NUMBER:bytes@&gt; &lt;@WORD:NULL@&gt; &lt;@STRING:flags@&gt;"
           rank="022"
           table="Cisco_ASA"
           taxonomy="Traffic" />
  <message loglevel="Information"
           msg_id="Cisco_ASA:connection_usage"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; : &lt;@REGEXP(&quot;\%FWSM.+&quot;):msg_id@&gt;: &lt;@REGEXP(&quot;\d+ in use, \d+ most used&quot;):msg@&gt;"
           rank="023"
           table="Cisco_ASA"
           taxonomy="Traffic" />
  <message loglevel="Information"
           msg_id="Cisco_ASA:deny_inbound"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; : &lt;@REGEXP(&quot;\%FWSM.+&quot;):msg_id@&gt;: Deny inbound &lt;@WORD:protocol@&gt; src &lt;@STRING:src@&gt;:&lt;@IP_ADDR:src_addr@&gt;/&lt;@NUMBER:src_port@&gt; dst &lt;@STRING:dst@&gt;:&lt;@IP_ADDR:dst_addr@&gt;/&lt;@NUMBER:dst_port@&gt;"
           rank="024"
           table="Cisco_ASA"
           taxonomy="Traffic.Denied" />
  <message loglevel="Information"
           msg_id="Cisco_ASA:dropped_dns_reply_packet_length_exceeds_configured_limit"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; : &lt;@REGEXP(&quot;\%FWSM.+&quot;):msg_id@&gt;: Dropped &lt;@WORD:protocol@&gt; DNS reply from &lt;@STRING:src@&gt;:&lt;@IP_ADDR:src_addr@&gt;/&lt;@NUMBER:src_port@&gt; to &lt;@STRING:dst@&gt;:&lt;@IP_ADDR:dst_addr@&gt;/&lt;@NUMBER:dst_port@&gt;; &lt;@REGEXP(&quot;packet length \d+ bytes exceeds configured limit of \d+ bytes&quot;):msg@&gt;"
           rank="025"
           table="Cisco_ASA"
           taxonomy="Traffic" />
  <message loglevel="Information"
           msg_id="Cisco_ASA:stored_file"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; : &lt;@REGEXP(&quot;\%FWSM.+&quot;):msg_id@&gt; &lt;@IP_ADDR:src_addr@&gt; Stored &lt;@IP_ADDR:dst_addr@&gt;:&lt;@STRING:msg@&gt;"
           rank="026"
           table="Cisco_ASA"
           taxonomy="Traffic" />
  <message loglevel="Information"
           msg_id="Cisco_ASA:deny_inbound_no_xlate_with_status"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; : &lt;@REGEXP(&quot;\%FWSM.+&quot;):msg_id@&gt;: Deny inbound (No xlate) &lt;@WORD:protocol@&gt; src &lt;@STRING:src@&gt;:&lt;@IP_ADDR:src_addr@&gt; dst &lt;@STRING:dst@&gt;:&lt;@IP_ADDR:dst_addr@&gt; (&lt;@STRING:status@&gt;)"
           rank="027"
           table="Cisco_ASA"
           taxonomy="Traffic.Denied" />
  <message loglevel="Information"
           msg_id="Cisco_ASA:deny_inbound_with_status"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; : &lt;@REGEXP(&quot;\%FWSM.+&quot;):msg_id@&gt;: Deny inbound &lt;@WORD:protocol@&gt; src &lt;@STRING:src@&gt;:&lt;@IP_ADDR:src_addr@&gt; dst &lt;@STRING:dst@&gt;:&lt;@IP_ADDR:dst_addr@&gt; (&lt;@STRING:status@&gt;)"
           rank="028"
           table="Cisco_ASA"
           taxonomy="Traffic.Denied" />
  <message loglevel="Information"
           msg_id="Cisco_ASA:denied_laddr_no_matching_session"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; : &lt;@REGEXP(&quot;\%FWSM.+&quot;):msg_id@&gt;: Denied &lt;@WORD:protocol@&gt; type=&lt;@WORD:type@&gt;, from laddr &lt;@IP_ADDR:laddr@&gt; on interface &lt;@STRING:interface@&gt; to &lt;@IP_ADDR:dst_addr@&gt;: no matching session"
           rank="029"
           table="Cisco_ASA"
           taxonomy="Traffic.Denied" />
  <message loglevel="Information"
           msg_id="Cisco_ASA:regular_translation_creation_failed"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; : &lt;@REGEXP(&quot;\%FWSM.+&quot;):msg_id@&gt;: regular translation creation failed for protocol &lt;@WORD:protocol@&gt; src &lt;@STRING:src@&gt;:&lt;@IP_ADDR:src_addr@&gt; dst &lt;@STRING:dst@&gt;:&lt;@IP_ADDR:dst_addr@&gt;"
           rank="030"
           table="Cisco_ASA"
           taxonomy="Traffic" />
  <message loglevel="Notice"
           msg_id="Cisco_ASA:writing_configuration"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; : &lt;@REGEXP(&quot;\%FWSM.+&quot;):msg_id@&gt;: Begin configuration: &lt;@STRING:src@&gt; writing to &lt;@STRING:dst@&gt;"
           rank="031"
           table="Cisco_ASA"
           taxonomy="Config.Changes" />
  <message loglevel="Notice"
           msg_id="Cisco_ASA:writing_configuration_ok"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; : &lt;@REGEXP(&quot;\%FWSM.+&quot;):msg_id@&gt;: &lt;@STRING:src@&gt; end configuration: OK"
           rank="032"
           table="Cisco_ASA"
           taxonomy="Config.Changes" />
  <message loglevel="Notice"
           msg_id="Cisco_ASA:user_executed_command"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; : &lt;@REGEXP(&quot;\%FWSM.+&quot;):msg_id@&gt;: User &lt;@STRING:user@&gt; executed the &lt;@STRING:msg@&gt; command."
           rank="033"
           table="Cisco_ASA"
           taxonomy="Config.Changes" />
  <message loglevel="Information"
           msg_id="Cisco_ASA:accesslist_denied_interval"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; : &lt;@REGEXP(&quot;\%FWSM.+&quot;):msg_id@&gt;: access-list &lt;@STRING:acl@&gt; denied &lt;@WORD:protocol@&gt; &lt;@STRING:src@&gt;/&lt;@IP_ADDR:src_addr@&gt;(&lt;@NUMBER:src_port@&gt;) -&gt; &lt;@STRING:dst@&gt;/&lt;@IP_ADDR:dst_addr@&gt;(&lt;@NUMBER:dst_port@&gt;) &lt;@REGEXP(&quot;hit-cnt \d+ \(\d+-second interval\)&quot;):msg@&gt; [&lt;@STRING:acl_id@&gt;]"
           rank="034"
           table="Cisco_ASA"
           taxonomy="Traffic.Denied" />
  <message loglevel="Information"
           msg_id="Cisco_ASA:dropped_dns_request_label_length_exceeds_remaining_packet_length_limit"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; : &lt;@REGEXP(&quot;\%FWSM.+&quot;):msg_id@&gt;: Dropped &lt;@WORD:protocol@&gt; DNS request from &lt;@STRING:src@&gt;:&lt;@IP_ADDR:src_addr@&gt;/&lt;@NUMBER:src_port@&gt; to &lt;@STRING:dst@&gt;:&lt;@IP_ADDR:dst_addr@&gt;/&lt;@NUMBER:dst_port@&gt;; &lt;@REGEXP(&quot;label length \d+ bytes exceeds remaining packet length limit of \d+ bytes&quot;):msg@&gt;"
           rank="035"
           table="Cisco_ASA"
           taxonomy="Traffic" />
  <message loglevel="Information"
           msg_id="Cisco_ASA:dropped_dns_request_label_length_exceeds_protocol_limit"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; : &lt;@REGEXP(&quot;\%FWSM.+&quot;):msg_id@&gt;: Dropped &lt;@WORD:protocol@&gt; DNS request from &lt;@STRING:src@&gt;:&lt;@IP_ADDR:src_addr@&gt;/&lt;@NUMBER:src_port@&gt; to &lt;@STRING:dst@&gt;:&lt;@IP_ADDR:dst_addr@&gt;/&lt;@NUMBER:dst_port@&gt;; &lt;@REGEXP(&quot;label length \d+ bytes exceeds protocol limit of \d+ bytes&quot;):msg@&gt;"
           rank="036"
           table="Cisco_ASA"
           taxonomy="Traffic" />
  <message loglevel="Information"
           msg_id="Cisco_ASA:no_translation_group_found_status"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; : &lt;@REGEXP(&quot;\%FWSM.+&quot;):msg_id@&gt;: No translation group found for &lt;@WORD:protocol@&gt; src &lt;@STRING:src@&gt;:&lt;@IP_ADDR:src_addr@&gt; dst &lt;@STRING:dst@&gt;:&lt;@IP_ADDR:dst_addr@&gt; (&lt;@STRING:status@&gt;)"
           rank="037"
           table="Cisco_ASA"
           taxonomy="Traffic" />
  <message loglevel="Warning"
           msg_id="Cisco_ASA:too_many_connections_on_xlate"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; : &lt;@REGEXP(&quot;\%FWSM.+&quot;):msg_id@&gt; Too many &lt;@WORD:protocol@&gt; connections on xlate &lt;@IP_ADDR:gaddr@&gt;! &lt;@STRING:msg@&gt;"
           rank="038"
           table="Cisco_ASA"
           taxonomy="Traffic" />
  <message loglevel="Notice"
           msg_id="Cisco_ASA:reading_configuration"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; : &lt;@REGEXP(&quot;\%FWSM.+&quot;):msg_id@&gt;: Begin configuration: &lt;@STRING:dst@&gt; reading from &lt;@STRING:src@&gt;"
           rank="039"
           table="Cisco_ASA"
           taxonomy="Config" />
  <message loglevel="Information"
           msg_id="Cisco_ASA:user_logged_out"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; : &lt;@REGEXP(&quot;\%FWSM.+&quot;):msg_id@&gt;: &lt;@REGEXP(&quot;User logged out: Uname:&quot;):msg@&gt; &lt;@STRING:user@&gt;"
           rank="040"
           table="Cisco_ASA"
           taxonomy="System" />
  <message loglevel="Information"
           msg_id="Cisco_ASA:Dropped_DNS_reply_label_length_exceeds_protocol_limit"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; : &lt;@REGEXP(&quot;\%FWSM.+&quot;):msg_id@&gt;: Dropped &lt;@WORD:protocol@&gt; DNS reply from &lt;@STRING:src@&gt;:&lt;@IP_ADDR:src_addr@&gt;/&lt;@NUMBER:src_port@&gt; to &lt;@STRING:dst@&gt;:&lt;@IP_ADDR:dst_addr@&gt;/&lt;@NUMBER:dst_port@&gt;; &lt;@REGEXP(&quot;label length \d+ bytes exceeds protocol limit of \d+ bytes&quot;):msg@&gt;"
           rank="041"
           table="Cisco_ASA"
           taxonomy="Traffic" />
  <message loglevel="Information"
           msg_id="Cisco_ASA:no_route"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; : &lt;@REGEXP(&quot;\%FWSM.+&quot;):msg_id@&gt;: &lt;@REGEXP(&quot;No route to .+ from .+&quot;):msg@&gt;"
           rank="042"
           table="Cisco_ASA"
           taxonomy="Traffic" />
  <message loglevel="Information"
           msg_id="Cisco_ASA:no_translation_group_found"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; : &lt;@REGEXP(&quot;\%FWSM.+&quot;):msg_id@&gt;: No translation group found for &lt;@WORD:protocol@&gt; src &lt;@STRING:src@&gt;:&lt;@IP_ADDR:src_addr@&gt;/&lt;@NUMBER:src_port@&gt; dst &lt;@STRING:dst@&gt;:&lt;@IP_ADDR:dst_addr@&gt;/&lt;@NUMBER:dst_port@&gt;"
           rank="043"
           table="Cisco_ASA"
           taxonomy="Traffic" />
  <message loglevel="Information"
           msg_id="Cisco_ASA:invalid_transport_field"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; : &lt;@REGEXP(&quot;\%FWSM.+&quot;):msg_id@&gt;: Invalid transport field for protocol=&lt;@WORD:protocol@&gt; from &lt;@IP_ADDR:src_addr@&gt;/&lt;@NUMBER:src_port@&gt; to &lt;@IP_ADDR:dst_addr@&gt;/&lt;@NUMBER:dst_port@&gt;"
           rank="044"
           table="Cisco_ASA"
           taxonomy="Traffic" />
  <message loglevel="Information"
           msg_id="Cisco_ASA:received_request_collision"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; : &lt;@REGEXP(&quot;\%FWSM.+&quot;):msg_id@&gt;: Received &lt;@WORD:protocol@&gt; request collision from &lt;@IP_ADDR:src_addr@&gt;/&lt;@STRING:src@&gt; on interface &lt;@STRING:interface@&gt;"
           rank="045"
           table="Cisco_ASA"
           taxonomy="Traffic" />
  <message loglevel="Information"
           msg_id="Cisco_ASA:testing_on_interface"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; : &lt;@REGEXP(&quot;\%FWSM.+&quot;):msg_id@&gt;: &lt;@REGEXP(&quot;.+ Testing on interface&quot;):msg@&gt; &lt;@STRING:interface@&gt; &lt;@STRING:status@&gt;"
           rank="046"
           table="Cisco_ASA"
           taxonomy="System" />
  <message loglevel="Information"
           msg_id="Cisco_ASA:testing_interface"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; : &lt;@REGEXP(&quot;\%FWSM.+&quot;):msg_id@&gt;: &lt;@REGEXP(&quot;.+ Testing Interface&quot;):msg@&gt; &lt;@STRING:interface@&gt;"
           rank="047"
           table="Cisco_ASA"
           taxonomy="System" />
  <message loglevel="Information"
           msg_id="Cisco_ASA:lost_failover_communications_with_mate"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; : &lt;@REGEXP(&quot;\%FWSM.+&quot;):msg_id@&gt;: &lt;@REGEXP(&quot;.+ Lost Failover communications with mate on interface&quot;):msg@&gt; &lt;@STRING:interface@&gt;"
           rank="048"
           table="Cisco_ASA"
           taxonomy="System" />
  <message loglevel="Information"
           msg_id="Cisco_ASA:monitoring_on_interface"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; : &lt;@REGEXP(&quot;\%FWSM.+&quot;):msg_id@&gt;: &lt;@REGEXP(&quot;.+ Monitoring on interface&quot;):msg@&gt; &lt;@STRING:interface@&gt; &lt;@STRING:status@&gt;"
           rank="049"
           table="Cisco_ASA"
           taxonomy="System" />
  <message loglevel="Information"
           msg_id="Cisco_ASA:Deny_by_access_group_short_2"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; : &lt;@REGEXP(&quot;\%FWSM.+&quot;):msg_id@&gt;: Deny protocol &lt;@WORD:protocol@&gt; src &lt;@STRING:src@&gt;:&lt;@IP_ADDR:src_addr@&gt; dst &lt;@STRING:dst@&gt;:&lt;@IP_ADDR:dst_addr@&gt; by access-group &quot;&lt;@STRING:acl@&gt;&quot; [&lt;@STRING:acl_id@&gt;]"
           rank="050"
           table="Cisco_ASA"
           taxonomy="Traffic.Denied" />
  <message loglevel="Information"
           msg_id="Cisco_ASA:teardown_dynamic_translation"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: &lt;@REGEXP(&quot;Teardown dynamic \S+ translation from&quot;):msg@&gt; &lt;@WORD:src@&gt;:&lt;@WORD:src_addr@&gt;/&lt;@NUMBER:src_port@&gt; to &lt;@WORD:dst@&gt;:&lt;@WORD:dst_addr@&gt;/&lt;@NUMBER:dst_port@&gt; duration &lt;@TIME:duration@&gt;"
           rank="051"
           table="Cisco_ASA"
           taxonomy="Application" />
  <message loglevel="Information"
           msg_id="Cisco_ASA:teardown_connection"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: &lt;@REGEXP(&quot;Teardown \S+ connection \d+ for&quot;):msg@&gt; &lt;@WORD:src@&gt;:&lt;@WORD:src_addr@&gt;/&lt;@NUMBER:src_port@&gt; to &lt;@WORD:dst@&gt;:&lt;@WORD:dst_addr@&gt;/&lt;@NUMBER:dst_port@&gt; duration &lt;@TIME:duration@&gt; bytes &lt;@NUMBER:bytes@&gt;&lt;@STRING:NULL@&gt;"
           rank="052"
           table="Cisco_ASA"
           taxonomy="Application" />
  <message loglevel="Information"
           msg_id="Cisco_ASA:built_dynamic_translation"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: &lt;@REGEXP(&quot;Built dynamic \S+ translation from&quot;):msg@&gt; &lt;@WORD:src@&gt;:&lt;@WORD:src_addr@&gt;/&lt;@NUMBER:src_port@&gt; to &lt;@WORD:dst@&gt;:&lt;@WORD:dst_addr@&gt;/&lt;@NUMBER:dst_port@&gt;"
           rank="053"
           table="Cisco_ASA"
           taxonomy="Application" />
  <message loglevel="Information"
           msg_id="Cisco_ASA:built_connection"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: &lt;@REGEXP(&quot;Built \w+bound \S+ connection \d+ f\w+&quot;):msg@&gt; &lt;@WORD:src@&gt;:&lt;@WORD:src_addr@&gt;/&lt;@NUMBER:src_port@&gt; (&lt;@WORD:src_addr_2@&gt;/&lt;@NUMBER:src_port_2@&gt;) to &lt;@WORD:dst@&gt;:&lt;@WORD:dst_addr@&gt;/&lt;@NUMBER:dst_port@&gt; (&lt;@WORD:dst_addr_2@&gt;/&lt;@NUMBER:dst_port_2@&gt;&lt;@STRING:NULL@&gt;"
           rank="054"
           table="Cisco_ASA"
           taxonomy="Application" />
  <message loglevel="Notice"
           msg_id="Cisco_ASA:deny_by_accessgroup"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: &lt;@REGEXP(&quot;Deny \w+ src&quot;):msg@&gt; &lt;@WORD:src@&gt;:&lt;@WORD:src_addr@&gt; dst &lt;@WORD:dst@&gt;:&lt;@WORD:dst_addr@&gt; &lt;@STRING:NULL@&gt; by access-group &quot;&lt;@STRING:acl@&gt;&quot; &lt;@STRING:NULL@&gt;"
           rank="055"
           table="Cisco_ASA"
           taxonomy="Access.Failure" />
  <message loglevel="Information"
           msg_id="Cisco_ASA:built_icmp_connection"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: &lt;@REGEXP(&quot;Built \w+bound ICMP connection for&quot;):msg@&gt; faddr &lt;@WORD:faddr@&gt;/&lt;@NUMBER:faddr_port@&gt; gaddr &lt;@WORD:gaddr@&gt;/&lt;@NUMBER:gaddr_port@&gt; laddr &lt;@WORD:laddr@&gt;/&lt;@NUMBER:laddr_port@&gt;"
           rank="056"
           table="Cisco_ASA"
           taxonomy="Network" />
  <message loglevel="Information"
           msg_id="Cisco_ASA:teardown_icmp_connection"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: &lt;@REGEXP(&quot;Teardown ICMP connection for&quot;):msg@&gt; faddr &lt;@WORD:faddr@&gt;/&lt;@NUMBER:faddr_port@&gt; gaddr &lt;@WORD:gaddr@&gt;/&lt;@NUMBER:gaddr_port@&gt; laddr &lt;@WORD:laddr@&gt;/&lt;@NUMBER:laddr_port@&gt;"
           rank="057"
           table="Cisco_ASA"
           taxonomy="Network" />
  <message loglevel="Notice"
           msg_id="Cisco_ASA:request_discarded"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: &lt;@REGEXP(&quot;\w+ request discarded from&quot;):msg@&gt; &lt;@WORD:src_addr@&gt;/&lt;@NUMBER:src_port@&gt; to &lt;@WORD:dst@&gt;:&lt;@WORD:dst_addr@&gt;/&lt;@NUMBER:dst_port@&gt;"
           rank="058"
           table="Cisco_ASA"
           taxonomy="Access.Failure" />
  <message loglevel="Warning"
           msg_id="Cisco_ASA:asymmetric_nat_rules_matched"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: &lt;@REGEXP(&quot;Asymmetric NAT rules matched for forward and reverse flows; Connection for .+ denied due to NAT reverse path failure&quot;):msg@&gt;"
           rank="059"
           table="Cisco_ASA"
           taxonomy="Config.Errors" />
  <message loglevel="Notice"
           msg_id="Cisco_ASA:deny_tcp_from"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: &lt;@REGEXP(&quot;Deny TCP \(no connection\) from&quot;):msg@&gt; &lt;@WORD:src_addr@&gt;/&lt;@NUMBER:src_port@&gt; to &lt;@WORD:dst_addr@&gt;/&lt;@NUMBER:dst_port@&gt; flags &lt;@STRING:flags@&gt; on interface &lt;@STRING:interface@&gt;"
           rank="060"
           table="Cisco_ASA"
           taxonomy="Access.Failure" />
  <message loglevel="Notice"
           msg_id="Cisco_ASA:failed_to_locate_interface"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: &lt;@REGEXP(&quot;Failed to locate \w+ interface for .+&quot;):msg@&gt;"
           rank="061"
           table="Cisco_ASA"
           taxonomy="Network.Errors" />
  <message loglevel="Emergency"
           msg_id="Cisco_ASA:001"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt; (&lt;@STRING:msg@&gt;) Lost Failover communications with mate on interface &lt;@STRING:interface@&gt;"
           rank="062"
           table="Cisco_ASA"
           taxonomy="System.Errors" />
  <message loglevel="Emergency"
           msg_id="Cisco_ASA:002"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt; (&lt;@STRING:msg@&gt;) Testing Interface &lt;@STRING:interface@&gt;"
           rank="063"
           table="Cisco_ASA"
           taxonomy="Hardware.Network" />
  <message loglevel="Emergency"
           msg_id="Cisco_ASA:003"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: (&lt;@STRING:msg@&gt;) Testing on interface &lt;@STRING:interface@&gt; &lt;@STRING:msg@&gt;"
           rank="064"
           table="Cisco_ASA"
           taxonomy="Hardware.Network" />
  <message loglevel="Emergency"
           msg_id="Cisco_ASA:004"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: (&lt;@STRING:interface@&gt;) Beginning configuration replication: &lt;@STRING:msg@&gt;"
           rank="065"
           table="Cisco_ASA"
           taxonomy="Config.Changes" />
  <message loglevel="Emergency"
           msg_id="Cisco_ASA:005"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: (&lt;@STRING:interface@&gt;) No response from other firewall (reason code = &lt;@STRING:msg@&gt;)."
           rank="066"
           table="Cisco_ASA"
           taxonomy="Network" />
  <message loglevel="Warning"
           msg_id="Cisco_ASA:006"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: &lt;@STRING:status@&gt; &lt;@WORD:protocol@&gt; src &lt;@STRING:interface@&gt;:&lt;@WORD:src_addr@&gt;/&lt;@NUMBER:src_port@&gt; dst &lt;@STRING:interface@&gt;:&lt;@WORD:dst_addr@&gt;/&lt;@NUMBER:dst_port@&gt; by access-group &quot;&lt;@STRING:interface@&gt;&quot; [&lt;@STRING:msg@&gt;]"
           rank="067"
           table="Cisco_ASA"
           taxonomy="Traffic.Denied" />
  <message loglevel="Emergency"
           msg_id="Cisco_ASA:007"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: (&lt;@STRING:interface@&gt;) End Configuration Replication (&lt;@STRING:msg@&gt;)"
           rank="068"
           table="Cisco_ASA"
           taxonomy="Config" />
  <message loglevel="Alert"
           msg_id="Cisco_ASA:008"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: Deny &lt;@WORD:protocol@&gt; reverse path check from &lt;@WORD:src_addr@&gt; to &lt;@WORD:dst_addr@&gt; on interface &lt;@STRING:interface@&gt;"
           rank="069"
           table="Cisco_ASA"
           taxonomy="Traffic.Denied" />
  <message loglevel="Warning"
           msg_id="Cisco_ASA:009"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: access-list &lt;@STRING:acl@&gt; denied &lt;@WORD:protocol@&gt; for user &lt;@STRING:user@&gt; &lt;@STRING:interface@&gt;/&lt;@WORD:src_addr@&gt;(&lt;@NUMBER:src_port@&gt;) -&gt; &lt;@STRING:interface@&gt;/&lt;@WORD:dst_addr@&gt;(&lt;@NUMBER:dst_port@&gt;) hit-cnt &lt;@NUMBER:bytes@&gt; first hit &lt;@STRING:msg@&gt;"
           rank="070"
           table="Cisco_ASA"
           taxonomy="Traffic.Denied" />
  <message loglevel="Emergency"
           msg_id="Cisco_ASA:010"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: (&lt;@STRING:interface@&gt;) Mate version &lt;@STRING:msg@&gt; is not identical with ours &lt;@STRING:msg@&gt;."
           rank="071"
           table="Cisco_ASA"
           taxonomy="System.Errors" />
  <message loglevel="Warning"
           msg_id="Cisco_ASA:011"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: [    Port-&lt;@NUMBER:src_port@&gt;-&lt;@NUMBER:src_port@&gt;] drop rate-&lt;@STRING:msg@&gt; exceeded. Current burst rate is &lt;@STRING:msg@&gt; per second, max configured rate is &lt;@STRING:msg@&gt;; Current average rate is &lt;@STRING:msg@&gt; per second, max configured rate is &lt;@STRING:msg@&gt;; Cumulative total count is &lt;@STRING:msg@&gt;"
           rank="072"
           table="Cisco_ASA"
           taxonomy="Traffic" />
  <message loglevel="Emergency"
           msg_id="Cisco_ASA:012"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: (&lt;@STRING:status@&gt;) Link status '&lt;@STRING:msg@&gt;' on interface &lt;@STRING:interface@&gt;"
           rank="073"
           table="Cisco_ASA"
           taxonomy="Hardware.Network" />
  <message loglevel="Warning"
           msg_id="Cisco_ASA:013"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: Line protocol on Interface &lt;@STRING:interface@&gt;, changed state to &lt;@STRING:status@&gt;"
           rank="074"
           table="Cisco_ASA"
           taxonomy="Network" />
  <message loglevel="Warning"
           msg_id="Cisco_ASA:014"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: Group = &lt;@STRING:msg@&gt;, Username = &lt;@WORD:user@&gt;, IP = &lt;@WORD:src_addr@&gt;, Session &lt;@STRING:status@&gt;. Session Type: &lt;@WORD:protocol@&gt;, Duration: &lt;@STRING:msg@&gt;, Bytes xmt: &lt;@NUMBER:bytes@&gt;, Bytes rcv: &lt;@NUMBER:bytes@&gt;, Reason: &lt;@STRING:msg@&gt;"
           rank="075"
           table="Cisco_ASA"
           taxonomy="Network" />
  <message loglevel="Critical"
           msg_id="Cisco_ASA:015"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: No translation group found for &lt;@WORD:protocol@&gt; src &lt;@STRING:interface@&gt;:&lt;@WORD:src_addr@&gt;/&lt;@NUMBER:src_port@&gt; dst &lt;@STRING:interface@&gt;:&lt;@WORD:dst_addr@&gt;/&lt;@NUMBER:dst_port@&gt;"
           rank="076"
           table="Cisco_ASA"
           taxonomy="Network" />
  <message loglevel="Warning"
           msg_id="Cisco_ASA:016"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: [   &lt;@WORD:src_addr@&gt;] drop rate-&lt;@STRING:msg@&gt; exceeded. Current burst rate is &lt;@STRING:msg@&gt; per second, max configured rate is &lt;@STRING:msg@&gt;; Current average rate is &lt;@STRING:msg@&gt; per second, max configured rate is &lt;@STRING:msg@&gt;; Cumulative total count is &lt;@STRING:msg@&gt;"
           rank="077"
           table="Cisco_ASA"
           taxonomy="Network" />
  <message loglevel="Warning"
           msg_id="Cisco_ASA:017"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: [ &lt;@STRING:msg@&gt;] drop rate-&lt;@STRING:msg@&gt; exceeded. Current burst rate is &lt;@STRING:msg@&gt; per second, max configured rate is &lt;@STRING:msg@&gt;; Current average rate is &lt;@STRING:msg@&gt; per second, max configured rate is &lt;@STRING:msg@&gt;; Cumulative total count is &lt;@STRING:msg@&gt;"
           rank="078"
           table="Cisco_ASA"
           taxonomy="Network" />
  <message loglevel="Warning"
           msg_id="Cisco_ASA:018"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: IKE reserved &lt;@WORD:protocol@&gt; &lt;@WORD:protocol@&gt; port &lt;@NUMBER:src_port@&gt; on interface &lt;@STRING:interface@&gt; successfully"
           rank="079"
           table="Cisco_ASA"
           taxonomy="Traffic" />
  <message loglevel="Warning"
           msg_id="Cisco_ASA:019"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; 10.251.8.8 %ASA-4-737033: IPAA: Unable to assign AAA provided IP address (&lt;@WORD:src_addr@&gt;) to Client. This IP address has already been assigned by AAA"
           rank="080"
           table="Cisco_ASA"
           taxonomy="Traffic" />
  <message loglevel="Warning"
           msg_id="Cisco_ASA:020"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: &lt;@WORD:protocol@&gt; flow from &lt;@STRING:interface@&gt;:&lt;@WORD:src_addr@&gt;/&lt;@NUMBER:src_port@&gt; to &lt;@STRING:interface@&gt;:&lt;@WORD:dst_addr@&gt;/&lt;@NUMBER:dst_port@&gt; terminated by inspection engine, reason - inspector reset unconditionally."
           rank="081"
           table="Cisco_ASA"
           taxonomy="Traffic" />
  <message loglevel="Warning"
           msg_id="Cisco_ASA:021"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: Dropped &lt;@WORD:protocol@&gt; &lt;@WORD:protocol@&gt; reply from &lt;@STRING:interface@&gt;:&lt;@WORD:src_addr@&gt;/&lt;@NUMBER:src_port@&gt; to &lt;@STRING:interface@&gt;:&lt;@WORD:dst_addr@&gt;/&lt;@NUMBER:dst_port@&gt;; packet length &lt;@NUMBER:bytes@&gt; bytes exceeds configured limit of &lt;@NUMBER:bytes@&gt; bytes"
           rank="082"
           table="Cisco_ASA"
           taxonomy="Traffic.Denied" />
  <message loglevel="Warning"
           msg_id="Cisco_ASA:022"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: Duplicate &lt;@WORD:protocol@&gt; &lt;@WORD:protocol@&gt; from &lt;@STRING:interface@&gt;:&lt;@WORD:src_addr@&gt;/&lt;@NUMBER:src_port@&gt; to &lt;@STRING:interface@&gt;:&lt;@WORD:dst_addr@&gt;/&lt;@NUMBER:dst_port@&gt; with different initial sequence number"
           rank="083"
           table="Cisco_ASA"
           taxonomy="Traffic" />
  <message loglevel="Critical"
           msg_id="Cisco_ASA:023"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: URL Server &lt;@WORD:src_addr@&gt; not responding"
           rank="084"
           table="Cisco_ASA"
           taxonomy="Network.Errors" />
  <message loglevel="Critical"
           msg_id="Cisco_ASA:024"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: &lt;@WORD:protocol@&gt; access denied by ACL from &lt;@WORD:src_addr@&gt;/&lt;@NUMBER:src_port@&gt; to &lt;@WORD:src_addr@&gt;/&lt;@NUMBER:src_port@&gt;"
           rank="085"
           table="Cisco_ASA"
           taxonomy="Traffic.Denied" />
  <message loglevel="Warning"
           msg_id="Cisco_ASA:025"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: IPS requested to reset &lt;@WORD:protocol@&gt; connection from &lt;@STRING:interface@&gt;:&lt;@WORD:src_addr@&gt;/&lt;@NUMBER:src_port@&gt; to &lt;@STRING:interface@&gt;:&lt;@WORD:dst_addr@&gt;/&lt;@NUMBER:dst_port@&gt;"
           rank="086"
           table="Cisco_ASA"
           taxonomy="Traffic.Denied" />
  <message loglevel="Warning"
           msg_id="Cisco_ASA:026"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: &lt;@WORD:protocol@&gt; flow from &lt;@STRING:interface@&gt;:&lt;@WORD:src_addr@&gt;/&lt;@NUMBER:src_port@&gt; to &lt;@STRING:interface@&gt;:&lt;@WORD:dst_addr@&gt;/&lt;@NUMBER:dst_port@&gt; terminated by inspection engine,&lt;@STRING:msg@&gt;"
           rank="087"
           table="Cisco_ASA"
           taxonomy="Traffic.Denied" />
  <message loglevel="Warning"
           msg_id="Cisco_ASA:027"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: Group &lt;@STRING:user@&gt; User &lt;@STRING:user@&gt; IP &lt;@WORD:src_addr@&gt; Address &lt;@WORD:dst_addr@&gt; assigned to session"
           rank="088"
           table="Cisco_ASA"
           taxonomy="Auth" />
  <message loglevel="Warning"
           msg_id="Cisco_ASA:028"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: No matching connection for &lt;@WORD:protocol@&gt; error message: &lt;@WORD:protocol@&gt; src &lt;@STRING:interface@&gt;:&lt;@WORD:src_addr@&gt; dst &lt;@STRING:interface@&gt;:&lt;@WORD:dst_addr@&gt; (&lt;@STRING:msg@&gt;) on &lt;@STRING:interface@&gt; interface.  Original IP payload: &lt;@WORD:protocol@&gt; src &lt;@WORD:src_addr@&gt;/&lt;@NUMBER:src_port@&gt; dst &lt;@WORD:dst_addr@&gt;/&lt;@NUMBER:dst_port@&gt;"
           rank="089"
           table="Cisco_ASA"
           taxonomy="Traffic" />
  <message loglevel="Warning"
           msg_id="Cisco_ASA:029"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: TunnelGroup &lt;@STRING:user@&gt; GroupPolicy &lt;@STRING:user@&gt; User&lt;@STRING:user@&gt; IP &lt;@WORD:src_addr@&gt; No &lt;@WORD:protocol@&gt; address available for &lt;@WORD:protocol@&gt; connection"
           rank="090"
           table="Cisco_ASA"
           taxonomy="Network.Errors" />
  <message loglevel="Warning"
           msg_id="Cisco_ASA:030"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: Invalid transport field for protocol=&lt;@WORD:protocol@&gt;, from &lt;@WORD:src_addr@&gt;/&lt;@NUMBER:src_port@&gt; to &lt;@WORD:dst_addr@&gt;/&lt;@NUMBER:dst_port@&gt;"
           rank="091"
           table="Cisco_ASA"
           taxonomy="Network.Errors" />
  <message loglevel="Warning"
           msg_id="Cisco_ASA:031"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: Tunnel group search using certificate maps failed for peer certificate:&lt;@WORD:user@&gt;"
           rank="092"
           table="Cisco_ASA"
           taxonomy="Auth.Failure" />
  <message loglevel="Warning"
           msg_id="Cisco_ASA:032"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; 1&lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: IPS requested to drop &lt;@WORD:protocol@&gt; packet from &lt;@STRING:interface@&gt;:&lt;@WORD:src_addr@&gt;/&lt;@NUMBER:src_port@&gt; to &lt;@STRING:interface@&gt;:&lt;@WORD:dst_addr@&gt;/&lt;@NUMBER:dst_port@&gt;"
           rank="093"
           table="Cisco_ASA"
           taxonomy="Traffic.Denied" />
  <message loglevel="Critical"
           msg_id="Cisco_ASA:033"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: Failed to insert CRL for trustpoint &lt;@STRING:msg@&gt;. Reason:&lt;@STRING:msg@&gt;"
           rank="094"
           table="Cisco_ASA"
           taxonomy="Auth" />
  <message loglevel="Critical"
           msg_id="Cisco_ASA:034"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: Denied &lt;@WORD:protocol@&gt; &lt;@STRING:msg@&gt; from &lt;@WORD:src_addr@&gt; on interface &lt;@STRING:interface@&gt;"
           rank="095"
           table="Cisco_ASA"
           taxonomy="Traffic" />
  <message loglevel="Warning"
           msg_id="Cisco_ASA:035"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: Task ran for &lt;@STRING:msg@&gt;, &lt;@STRING:msg@&gt;"
           rank="096"
           table="Cisco_ASA"
           taxonomy="Application" />
  <message loglevel="Warning"
           msg_id="Cisco_ASA:036"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: Deny protocol &lt;@WORD:protocol@&gt; src &lt;@STRING:interface@&gt;:&lt;@WORD:src_addr@&gt; dst &lt;@STRING:interface@&gt;:&lt;@WORD:dst_addr@&gt; by access-group &lt;@STRING:msg@&gt;"
           rank="097"
           table="Cisco_ASA"
           taxonomy="Traffic.Denied" />
  <message loglevel="Warning"
           msg_id="Cisco_ASA:037"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: Tunnel group search using certificate maps failed for peer certificate: serial number: &lt;@WORD:user@&gt;, subject name: &lt;@WORD:user@&gt;, issuer_name: &lt;@WORD:user@&gt;"
           rank="098"
           table="Cisco_ASA"
           taxonomy="Auth.Failure" />
  <message loglevel="Alert"
           msg_id="Cisco_ASA:038"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: Deny IP spoof from (&lt;@WORD:src_addr@&gt;) to &lt;@WORD:dst_addr@&gt; on interface &lt;@STRING:interface@&gt;"
           rank="099"
           table="Cisco_ASA"
           taxonomy="Attack" />
  <message loglevel="Critical"
           msg_id="Cisco_ASA:039"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: Certificate validation failed. No suitable trustpoints found to validate certificate serial number: &lt;@STRING:user@&gt;, subject name: &lt;@STRING:user@&gt;, issuer name: &lt;@STRING:user@&gt;"
           rank="100"
           table="Cisco_ASA"
           taxonomy="Auth.Failure" />
  <message loglevel="Critical"
           msg_id="Cisco_ASA:040"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: Certificate chain failed validation. No suitable trustpoint was found to validate chain."
           rank="101"
           table="Cisco_ASA"
           taxonomy="Auth.Failure" />
  <message loglevel="Warning"
           msg_id="Cisco_ASA:041"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: No matching connection for &lt;@WORD:protocol@&gt; error message: &lt;@WORD:protocol@&gt; src &lt;@STRING:interface@&gt;:&lt;@WORD:src_addr@&gt; dst &lt;@STRING:interface@&gt;:&lt;@WORD:dst_addr@&gt; (&lt;@STRING:msg@&gt;) on &lt;@STRING:interface@&gt; interface.  Original IP payload: &lt;@STRING:msg@&gt;."
           rank="102"
           table="Cisco_ASA"
           taxonomy="Traffic" />
  <message loglevel="Critical"
           msg_id="Cisco_ASA:042"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: TunnelGroup &lt;@STRING:user@&gt; GroupPolicy &lt;@STRING:user@&gt; User &lt;@STRING:user@&gt; IP &lt;&lt;@WORD:src_addr@&gt;&gt; No address available for SVC connection"
           rank="103"
           table="Cisco_ASA"
           taxonomy="Auth" />
  <message loglevel="Warning"
           msg_id="Cisco_ASA:043"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: IP &lt;&lt;@WORD:src_addr@&gt;&gt; Error parsing SVC connect request."
           rank="104"
           table="Cisco_ASA"
           taxonomy="Network.Errors" />
  <message loglevel="Warning"
           msg_id="Cisco_ASA:044"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: IP &lt;&lt;@WORD:src_addr@&gt;&gt; Error authenticating SVC connect request."
           rank="105"
           table="Cisco_ASA"
           taxonomy="Network.Errors" />
  <message loglevel="Emergency"
           msg_id="Cisco_ASA:045"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: (&lt;@STRING:status@&gt;) Monitoring on interface &lt;@STRING:interface@&gt; waiting"
           rank="106"
           table="Cisco_ASA"
           taxonomy="Network.Errors" />
  <message loglevel="Emergency"
           msg_id="Cisco_ASA:046"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: (&lt;@STRING:status@&gt;) Monitoring on interface &lt;@STRING:interface@&gt; normal"
           rank="107"
           table="Cisco_ASA"
           taxonomy="Network" />
  <message loglevel="Critical"
           msg_id="Cisco_ASA:047"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: Group &lt;&lt;@STRING:user@&gt;&gt; User &lt;&lt;@STRING:user@&gt;&gt; IP &lt;&lt;@WORD:src_addr@&gt;&gt; Received large packet &lt;@NUMBER:bytes@&gt; (threshold &lt;@NUMBER:bytes@&gt;)."
           rank="108"
           table="Cisco_ASA"
           taxonomy="Traffic" />
  <message loglevel="Warning"
           msg_id="Cisco_ASA:048"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: Dropped &lt;@WORD:protocol@&gt; &lt;@WORD:protocol@&gt; request from &lt;@STRING:interface@&gt;:&lt;@WORD:src_addr@&gt;/&lt;@NUMBER:src_port@&gt; to &lt;@STRING:interface@&gt;:&lt;@WORD:dst_addr@&gt;/&lt;@NUMBER:dst_port@&gt;; label length &lt;@NUMBER:bytes@&gt; bytes exceeds protocol limit of &lt;@NUMBER:bytes@&gt; bytes"
           rank="109"
           table="Cisco_ASA"
           taxonomy="Traffic.Denied" />
  <message loglevel="Warning"
           msg_id="Cisco_ASA:049"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: Denied &lt;@WORD:protocol@&gt; type=&lt;@WORD:type@&gt;, from laddr &lt;@WORD:laddr@&gt; on interface &lt;@STRING:interface@&gt; to &lt;@WORD:dst_addr@&gt;: &lt;@STRING:msg@&gt;"
           rank="110"
           table="Cisco_ASA"
           taxonomy="Traffic.Denied" />
  <message loglevel="Warning"
           msg_id="Cisco_ASA:050"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: Tunnel group search using certificate maps failed for peer certificate: serial number: &lt;@STRING:user@&gt;, subject name:&lt;@STRING:user@&gt;, issuer_name:&lt;@STRING:user@&gt;."
           rank="111"
           table="Cisco_ASA"
           taxonomy="Auth.Failure" />
  <message loglevel="Critical"
           msg_id="Cisco_ASA:051"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: portmap translation creation failed for &lt;@WORD:protocol@&gt; src &lt;@STRING:interface@&gt;:&lt;@WORD:src_addr@&gt;/&lt;@NUMBER:src_port@&gt; dst &lt;@STRING:interface@&gt;:&lt;@WORD:dst_addr@&gt;/&lt;@NUMBER:dst_port@&gt;"
           rank="112"
           table="Cisco_ASA"
           taxonomy="Traffic.Denied" />
  <message loglevel="Warning"
           msg_id="Cisco_ASA:052"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: IPAA: Unable to get address from group-policy or tunnel-group local pools"
           rank="113"
           table="Cisco_ASA"
           taxonomy="Traffic" />
  <message loglevel="Warning"
           msg_id="Cisco_ASA:053"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: IPAA: Address assignment failed"
           rank="114"
           table="Cisco_ASA"
           taxonomy="Traffic" />
  <message loglevel="Warning"
           msg_id="Cisco_ASA:054"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: Dropped &lt;@WORD:protocol@&gt; &lt;@WORD:protocol@&gt; reply from &lt;@STRING:interface@&gt;:&lt;@WORD:src_addr@&gt;/&lt;@NUMBER:src_port@&gt; to &lt;@STRING:interface@&gt;:&lt;@WORD:dst_addr@&gt;/&lt;@NUMBER:dst_port@&gt;; label length &lt;@NUMBER:bytes@&gt; bytes exceeds remaining packet length limit of &lt;@NUMBER:bytes@&gt; bytes"
           rank="115"
           table="Cisco_ASA"
           taxonomy="Traffic.Denied" />
  <message loglevel="Warning"
           msg_id="Cisco_ASA:055"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: Dropped &lt;@WORD:protocol@&gt; &lt;@WORD:protocol@&gt; reply from &lt;@STRING:interface@&gt;:&lt;@WORD:src_addr@&gt;/&lt;@NUMBER:src_port@&gt; to &lt;@STRING:interface@&gt;:&lt;@WORD:dst_addr@&gt;/&lt;@NUMBER:dst_port@&gt;; label length &lt;@NUMBER:bytes@&gt; bytes exceeds protocol limit of &lt;@NUMBER:bytes@&gt; bytes"
           rank="116"
           table="Cisco_ASA"
           taxonomy="Traffic.Denied" />
  <message loglevel="Alert"
           msg_id="Cisco_ASA:056"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: Deny &lt;@WORD:protocol@&gt; teardrop fragment (size = &lt;@NUMBER:bytes@&gt;, offset = &lt;@NUMBER:bytes@&gt;) from &lt;@WORD:src_addr@&gt; to &lt;@WORD:dst_addr@&gt;"
           rank="117"
           table="Cisco_ASA"
           taxonomy="Traffic.Denied" />
  <message loglevel="Warning"
           msg_id="Cisco_ASA:057"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: CRYPTO: The ASA hardware accelerator encountered an error (&lt;@STRING:msg@&gt;) while executing the command&lt;@STRING:msg@&gt;."
           rank="118"
           table="Cisco_ASA"
           taxonomy="Hardware" />
  <message loglevel="Alert"
           msg_id="Cisco_ASA:058"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: AAA Marking RADIUS server &lt;@WORD:src_addr@&gt; in aaa-server group RADIUS as &lt;@STRING:status@&gt;"
           rank="119"
           table="Cisco_ASA"
           taxonomy="Application" />
  <message loglevel="Warning"
           msg_id="Cisco_ASA:059"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: Dropped &lt;@WORD:protocol@&gt; &lt;@WORD:protocol@&gt; request from &lt;@STRING:interface@&gt;:&lt;@WORD:src_addr@&gt;/&lt;@NUMBER:src_port@&gt; to &lt;@STRING:interface@&gt;:&lt;@WORD:dst_addr@&gt;/&lt;@NUMBER:dst_port@&gt;; label length &lt;@NUMBER:bytes@&gt; bytes exceeds remaining packet length limit of &lt;@NUMBER:bytes@&gt; bytes"
           rank="120"
           table="Cisco_ASA"
           taxonomy="Traffic.Denied" />
  <message loglevel="Emergency"
           msg_id="Cisco_ASA:060"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: (&lt;@STRING:status@&gt;) Switching to &lt;@STRING:status@&gt; - Other unit wants me &lt;@STRING:status@&gt;. &lt;@STRING:status@&gt; unit switch reason: &lt;@STRING:msg@&gt;."
           rank="121"
           table="Cisco_ASA"
           taxonomy="System" />
  <message loglevel="Warning"
           msg_id="Cisco_ASA:061"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: &lt;@WORD:protocol@&gt;: Error freeing address &lt;@WORD:src_addr@&gt;, &lt;@STRING:msg@&gt;"
           rank="122"
           table="Cisco_ASA"
           taxonomy="Network" />
  <message loglevel="Emergency"
           msg_id="Cisco_ASA:062"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: (&lt;@STRING:status@&gt;) Switching to &lt;@STRING:status@&gt; - &lt;@STRING:msg@&gt;."
           rank="123"
           table="Cisco_ASA"
           taxonomy="System" />
  <message loglevel="Critical"
           msg_id="Cisco_ASA:063"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: regular translation creation failed for protocol &lt;@WORD:protocol@&gt; src &lt;@STRING:interface@&gt;:&lt;@WORD:src_addr@&gt; dst &lt;@STRING:interface@&gt;:&lt;@WORD:dst_addr@&gt;"
           rank="124"
           table="Cisco_ASA"
           taxonomy="Traffic" />
  <message loglevel="Warning"
           msg_id="Cisco_ASA:064"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: Dropped &lt;@WORD:protocol@&gt; &lt;@WORD:protocol@&gt; reply from &lt;@STRING:interface@&gt;:&lt;@WORD:src_addr@&gt;/&lt;@NUMBER:src_port@&gt; to &lt;@STRING:interface@&gt;:&lt;@WORD:dst_addr@&gt;/&lt;@NUMBER:dst_port@&gt;; &lt;@STRING:msg@&gt; &lt;@NUMBER:bytes@&gt; bytes exceeds protocol limit of &lt;@NUMBER:bytes@&gt; bytes"
           rank="125"
           table="Cisco_ASA"
           taxonomy="Traffic.Denied" />
  <message loglevel="Warning"
           msg_id="Cisco_ASA:065"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: Dropped &lt;@WORD:protocol@&gt; &lt;@WORD:protocol@&gt; request from &lt;@STRING:interface@&gt;:&lt;@WORD:src_addr@&gt;/&lt;@NUMBER:src_port@&gt; to &lt;@STRING:interface@&gt;:&lt;@WORD:dst_addr@&gt;/&lt;@NUMBER:dst_port@&gt;; &lt;@STRING:msg@&gt; &lt;@NUMBER:bytes@&gt; bytes exceeds configured limit of &lt;@NUMBER:bytes@&gt; bytes"
           rank="126"
           table="Cisco_ASA"
           taxonomy="Traffic.Denied" />
  <message loglevel="Emergency"
           msg_id="Cisco_ASA:066"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: (&lt;@STRING:status@&gt;) Other firewall reporting failure."
           rank="127"
           table="Cisco_ASA"
           taxonomy="System.Errors" />
  <message loglevel="Warning"
           msg_id="Cisco_ASA:067"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: &lt;@WORD:protocol@&gt;: Unable to remove &lt;@WORD:src_addr@&gt; from standby: &lt;@STRING:msg@&gt;"
           rank="128"
           table="Cisco_ASA"
           taxonomy="Network.Errors" />
  <message loglevel="Critical"
           msg_id="Cisco_ASA:068"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: LU allocate xlate failed"
           rank="129"
           table="Cisco_ASA"
           taxonomy="Application" />
  <message loglevel="Emergency"
           msg_id="Cisco_ASA:069"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: (&lt;@STRING:status@&gt;) Switching to &lt;@STRING:status@&gt;."
           rank="130"
           table="Cisco_ASA"
           taxonomy="System.Errors" />
  <message loglevel="Emergency"
           msg_id="Cisco_ASA:070"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@STRING:status@&gt;: &lt;@STRING:msg@&gt; Module in slot &lt;@STRING:msg@&gt;, application up &lt;@STRING:msg@&gt;"
           rank="131"
           table="Cisco_ASA"
           taxonomy="Hardware.Network" />
  <message loglevel="Warning"
           msg_id="Cisco_ASA:071"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: &lt;@WORD:protocol@&gt; port command different address: &lt;@WORD:src_addr@&gt;(&lt;@WORD:src_addr@&gt;) to &lt;@WORD:dst_addr@&gt; on interface &lt;@STRING:interface@&gt;"
           rank="132"
           table="Cisco_ASA"
           taxonomy="Traffic.Denied" />
  <message loglevel="Critical"
           msg_id="Cisco_ASA:072"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: URL Server &lt;@WORD:src_addr@&gt; timed out URL &lt;@STRING:msg@&gt;"
           rank="133"
           table="Cisco_ASA"
           taxonomy="Traffic" />
  <message loglevel="Warning"
           msg_id="Cisco_ASA:073"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: Received ARP request collision from &lt;@WORD:src_addr@&gt;/&lt;@WORD:src_addr@&gt; on interface &lt;@STRING:interface@&gt; with existing ARP entry &lt;@WORD:dst_addr@&gt;/&lt;@WORD:dst_addr@&gt;"
           rank="134"
           table="Cisco_ASA"
           taxonomy="Network.Errors" />
  <message loglevel="Warning"
           msg_id="Cisco_ASA:074"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: Dropped &lt;@WORD:protocol@&gt; &lt;@WORD:protocol@&gt; reply from &lt;@STRING:interface@&gt;:&lt;@WORD:src_addr@&gt;/&lt;@NUMBER:src_port@&gt; to &lt;@STRING:interface@&gt;:&lt;@WORD:dst_addr@&gt;/&lt;@NUMBER:dst_port@&gt;; compression pointer length &lt;@NUMBER:bytes@&gt; bytes exceeds packet length limit of &lt;@NUMBER:bytes@&gt; bytes"
           rank="135"
           table="Cisco_ASA"
           taxonomy="Traffic.Denied" />
  <message loglevel="Notice"
           msg_id="Cisco_ASA:075"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: User &lt;@STRING:user@&gt; executed the '&lt;@STRING:msg@&gt;' command."
           rank="136"
           table="Cisco_ASA"
           taxonomy="Config.Changes" />
  <message loglevel="Notice"
           msg_id="Cisco_ASA:076"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: User &lt;@STRING:user@&gt;, running '&lt;@STRING:msg@&gt;' from IP &lt;@WORD:src_addr@&gt;, executed '&lt;@STRING:msg@&gt;'"
           rank="137"
           table="Cisco_ASA"
           taxonomy="Config.Changes" />
  <message loglevel="Notice"
           msg_id="Cisco_ASA:077"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: &lt;@WORD:src_addr@&gt; end configuration: &lt;@STRING:msg@&gt;"
           rank="138"
           table="Cisco_ASA"
           taxonomy="Config.Changes" />
  <message loglevel="Notice"
           msg_id="Cisco_ASA:078"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: Begin configuration: &lt;@WORD:src_addr@&gt; &lt;@STRING:msg@&gt;"
           rank="139"
           table="Cisco_ASA"
           taxonomy="Config.Changes" />
  <message loglevel="Notice"
           msg_id="Cisco_ASA:079"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: User logged out: Uname: &lt;@STRING:user@&gt;"
           rank="140"
           table="Cisco_ASA"
           taxonomy="Auth" />
  <message loglevel="Notice"
           msg_id="Cisco_ASA:080"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: User priv level changed: Uname: &lt;@STRING:user@&gt; &lt;@STRING:msg@&gt;"
           rank="141"
           table="Cisco_ASA"
           taxonomy="Config.Changes" />
  <message loglevel="Notice"
           msg_id="Cisco_ASA:081"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: Group = &lt;@STRING:group@&gt;, IP = &lt;@WORD:src_addr@&gt;, Session is being torn down. Reason: &lt;@STRING:msg@&gt;"
           rank="142"
           table="Cisco_ASA"
           taxonomy="Network" />
  <message loglevel="Notice"
           msg_id="Cisco_ASA:082"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: Group = &lt;@STRING:group@&gt;, IP = &lt;@WORD:src_addr@&gt;, Connection terminated for peer &lt;@STRING:group@&gt;.  Reason: &lt;@STRING:msg@&gt;  Remote Proxy &lt;@WORD:src_addr@&gt;, Local Proxy &lt;@WORD:src_addr@&gt;"
           rank="143"
           table="Cisco_ASA"
           taxonomy="Network" />
  <message loglevel="Notice"
           msg_id="Cisco_ASA:083"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: IP = &lt;@WORD:src_addr@&gt;,&lt;@REGEXP(&quot;.+Received encrypted packet with no matching SA, dropping&quot;):msg@&gt;"
           rank="144"
           table="Cisco_ASA"
           taxonomy="Traffic.Denied" />
  <message loglevel="Notice"
           msg_id="Cisco_ASA:084"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: Phase 1 failure:  Mismatched attribute types for class Group Description:  Rcv'd: &lt;@STRING:msg@&gt;  Cfg'd: &lt;@STRING:msg@&gt;"
           rank="145"
           table="Cisco_ASA"
           taxonomy="System.Errors" />
  <message loglevel="Notice"
           msg_id="Cisco_ASA:085"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; 10.12.13.10 %ASA-5-713119: Group = &lt;@STRING:group@&gt;, IP = &lt;@WORD:src_addr@&gt;, PHASE 1 COMPLETED"
           rank="146"
           table="Cisco_ASA"
           taxonomy="System" />
  <message loglevel="Notice"
           msg_id="Cisco_ASA:086"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: Group = &lt;@STRING:group@&gt;, IP = &lt;@WORD:src_addr@&gt;,&lt;@REGEXP(&quot;.+Security negotiation complete for&quot;):msg@&gt; &lt;@STRING:group@&gt; Group (&lt;@STRING:group@&gt;)  &lt;@STRING:msg@&gt;, Inbound SPI = &lt;@STRING:msg@&gt;, Outbound SPI = &lt;@STRING:msg@&gt;"
           rank="147"
           table="Cisco_ASA"
           taxonomy="System" />
  <message loglevel="Notice"
           msg_id="Cisco_ASA:087"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: Group = &lt;@STRING:group@&gt;, IP = &lt;@WORD:src_addr@&gt;, PHASE 2 COMPLETED (&lt;@STRING:msg@&gt;)"
           rank="148"
           table="Cisco_ASA"
           taxonomy="System" />
  <message loglevel="Notice"
           msg_id="Cisco_ASA:088"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: IP = &lt;@WORD:src_addr@&gt;, IKE Initiator: Rekeying Phase &lt;@STRING:msg@&gt;, Intf &lt;@STRING:interface@&gt;, IKE Peer &lt;@WORD:src_addr@&gt;  local Proxy Address &lt;@WORD:dst_addr@&gt;, remote Proxy Address &lt;@WORD:dst_addr@&gt;,  Crypto map (&lt;@STRING:msg@&gt;)"
           rank="149"
           table="Cisco_ASA"
           taxonomy="Network" />
  <message loglevel="Notice"
           msg_id="Cisco_ASA:089"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: Group = &lt;@STRING:group@&gt;, IP = &lt;@WORD:src_addr@&gt;, IKE Initiator: Rekeying Phase &lt;@STRING:msg@&gt;, Intf &lt;@STRING:interface@&gt;, IKE Peer &lt;@WORD:src_addr@&gt;  local Proxy Address &lt;@WORD:src_addr@&gt;, remote Proxy Address &lt;@WORD:src_addr@&gt;,  Crypto map (&lt;@STRING:msg@&gt;)"
           rank="150"
           table="Cisco_ASA"
           taxonomy="Network" />
  <message loglevel="Notice"
           msg_id="Cisco_ASA:090"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: Group = &lt;@STRING:group@&gt;, IP = &lt;@WORD:src_addr@&gt;,&lt;@REGEXP(&quot;.+Received encrypted Oakley Main Mode packet with invalid payloads&quot;):msg@&gt;, MessID = &lt;@STRING:msg@&gt;"
           rank="151"
           table="Cisco_ASA"
           taxonomy="Traffic" />
  <message loglevel="Warning"
           msg_id="Cisco_ASA:091"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: Group = &lt;@STRING:group@&gt;, IP = &lt;@WORD:src_addr@&gt;, ERROR,&lt;@REGEXP(&quot;.+had problems decrypting packet, probably due to mismatched pre-shared key.  Aborting&quot;):msg@&gt;"
           rank="152"
           table="Cisco_ASA"
           taxonomy="Traffic" />
  <message loglevel="Notice"
           msg_id="Cisco_ASA:092"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: Group = &lt;@STRING:group@&gt;, IP = &lt;@WORD:src_addr@&gt;,&lt;@REGEXP(&quot;.+Duplicate Phase 1 packet detected.  Retransmitting last packet.&quot;):msg@&gt;"
           rank="153"
           table="Cisco_ASA"
           taxonomy="Traffic" />
  <message loglevel="Notice"
           msg_id="Cisco_ASA:093"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: Group = &lt;@STRING:group@&gt;, IP = &lt;@WORD:src_addr@&gt;,&lt;@REGEXP(&quot;.+Received an un-encrypted PAYLOAD_MALFORMED notify message, dropping&quot;):msg@&gt;"
           rank="154"
           table="Cisco_ASA"
           taxonomy="Traffic" />
  <message loglevel="Warning"
           msg_id="Cisco_ASA:094"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: Group = &lt;@STRING:group@&gt;, IP = &lt;@WORD:src_addr@&gt;,&lt;@REGEXP(&quot;.+Error, peer has indicated that something is wrong with our message.  This could indicate a pre-shared key mismatch.&quot;):msg@&gt;"
           rank="155"
           table="Cisco_ASA"
           taxonomy="Traffic" />
  <message loglevel="Warning"
           msg_id="Cisco_ASA:095"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: Group = &lt;@STRING:group@&gt;, IP = &lt;@WORD:src_addr@&gt;,&lt;@REGEXP(&quot;.+Information Exchange processing failed&quot;):msg@&gt;"
           rank="156"
           table="Cisco_ASA"
           taxonomy="Traffic" />
  <message loglevel="Warning"
           msg_id="Cisco_ASA:096"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: IP = &lt;@WORD:src_addr@&gt;,&lt;@REGEXP(&quot;.+Header invalid, missing SA payload!&quot;):msg@&gt; (next payload = &lt;@STRING:msg@&gt;)"
           rank="157"
           table="Cisco_ASA"
           taxonomy="Traffic" />
  <message loglevel="Notice"
           msg_id="Cisco_ASA:097"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: Group = &lt;@STRING:group@&gt;, IP = &lt;@WORD:src_addr@&gt;,&lt;@REGEXP(&quot;.+Failure during phase 1 rekeying attempt due to collision&quot;):msg@&gt;"
           rank="158"
           table="Cisco_ASA"
           taxonomy="Network.Errors" />
  <message loglevel="Notice"
           msg_id="Cisco_ASA:098"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: Group = &lt;@STRING:group@&gt;, IP = &lt;@WORD:src_addr@&gt;,&lt;@REGEXP(&quot;.+PHASE 1 COMPLETED&quot;):msg@&gt;"
           rank="159"
           table="Cisco_ASA"
           taxonomy="System" />
  <message loglevel="Warning"
           msg_id="Cisco_ASA:099"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: Group = &lt;@STRING:group@&gt;, IP = &lt;@WORD:src_addr@&gt;,&lt;@REGEXP(&quot;.+Stale PeerTblEntry found, removing!&quot;):msg@&gt;"
           rank="160"
           table="Cisco_ASA"
           taxonomy="Network" />
  <message loglevel="Critical"
           msg_id="Cisco_ASA:100"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: Group = &lt;@STRING:group@&gt;, IP = &lt;@WORD:src_addr@&gt;,&lt;@REGEXP(&quot;.+Removing TunnelTbl from tunnel table failed, no match!&quot;):msg@&gt;"
           rank="161"
           table="Cisco_ASA"
           taxonomy="Network" />
  <message loglevel="Critical"
           msg_id="Cisco_ASA:101"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: Group = &lt;@STRING:group@&gt;, IP = &lt;@WORD:src_addr@&gt;,&lt;@REGEXP(&quot;.+IKE lost contact with remote peer, deleting connection&quot;):msg@&gt; (keepalive type: &lt;@STRING:msg@&gt;)"
           rank="162"
           table="Cisco_ASA"
           taxonomy="Network.Errors" />
  <message loglevel="Warning"
           msg_id="Cisco_ASA:102"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;:&lt;@REGEXP(&quot;.+Received ARP response collision from&quot;):msg@&gt; &lt;@WORD:src_addr@&gt;/&lt;@STRING:msg@&gt; on interface &lt;@STRING:interface@&gt;&lt;@REGEXP(&quot;.+with existing ARP entry&quot;):msg@&gt; &lt;@WORD:dst_addr@&gt;/&lt;@STRING:msg@&gt;"
           rank="163"
           table="Cisco_ASA"
           taxonomy="Network.Errors" />
  <message loglevel="Warning"
           msg_id="Cisco_ASA:103"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;:&lt;@REGEXP(&quot;.+Discard IP fragment set with more than 24 elements&quot;):msg@&gt;:  src = &lt;@WORD:src_addr@&gt;, dest = &lt;@WORD:dst_addr@&gt;, proto = &lt;@WORD:protocol@&gt;, id = &lt;@STRING:msg_id@&gt;"
           rank="164"
           table="Cisco_ASA"
           taxonomy="Network" />
  <message loglevel="Notice"
           msg_id="Cisco_ASA:104"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: (&lt;@STRING:status@&gt;)&lt;@REGEXP(&quot;.+Failed to update IPSec failover runtime data on the&quot;):msg@&gt; &lt;@STRING:status@&gt; unit."
           rank="165"
           table="Cisco_ASA"
           taxonomy="System" />
  <message loglevel="Emergency"
           msg_id="Cisco_ASA:105"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: Group = &lt;@STRING:group@&gt;, IP = &lt;@WORD:src_addr@&gt;,&lt;@REGEXP(&quot;.+Unexpected cleanup of tunnel table entry during SA delete.&quot;):msg@&gt;"
           rank="166"
           table="Cisco_ASA"
           taxonomy="System.Errors" />
  <message loglevel="Warning"
           msg_id="Cisco_ASA:106"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: Group = &lt;@STRING:group@&gt;, IP = &lt;@WORD:src_addr@&gt;,&lt;@REGEXP(&quot;.+Received an unencrypted packet when crypto active!! Dropping packet.&quot;):msg@&gt;"
           rank="167"
           table="Cisco_ASA"
           taxonomy="Traffic.Denied" />
  <message loglevel="Warning"
           msg_id="Cisco_ASA:107"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: IPSEC:&lt;@REGEXP(&quot;.+Received an ESP packet&quot;):msg@&gt; (&lt;@STRING:msg@&gt;) from &lt;@WORD:src_addr@&gt; (user= &lt;@WORD:user@&gt;) to &lt;@WORD:dst_addr@&gt;&lt;@REGEXP(&quot;.+that failed authentication.&quot;):msg@&gt;"
           rank="168"
           table="Cisco_ASA"
           taxonomy="Auth.Failure" />
  <message loglevel="Warning"
           msg_id="Cisco_ASA:108"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;:&lt;@REGEXP(&quot;.+CRYPTO: The ASA hardware accelerator encountered an error &quot;):msg@&gt;(&lt;@STRING:msg@&gt;)"
           rank="169"
           table="Cisco_ASA"
           taxonomy="Hardware" />
  <message loglevel="Warning"
           msg_id="Cisco_ASA:109"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;:&lt;@REGEXP(&quot;.+CRYPTO: The ASA created Crypto Archive File&quot;):msg@&gt; &lt; &lt;@STRING:msg@&gt; &gt;&lt;@REGEXP(&quot;.+as a Soft Reset was necessary. Please forward this archived information to Cisco&quot;):msg@&gt;"
           rank="170"
           table="Cisco_ASA"
           taxonomy="System" />
  <message loglevel="Warning"
           msg_id="Cisco_ASA:110"
           pattern="&lt;@DATE_TIME_ISO:datetime@&gt; &lt;@WORD:device@&gt; &lt;@REGEXP(&quot;\%ASA-.+&quot;):msg_id@&gt;: Dropped &lt;@WORD:protocol@&gt; &lt;@WORD:protocol@&gt; request from &lt;@STRING:interface@&gt;:&lt;@WORD:src_addr@&gt;/&lt;@NUMBER:src_port@&gt; to &lt;@STRING:interface@&gt;:&lt;@WORD:dst_addr@&gt;/&lt;@NUMBER:dst_port@&gt;; domain-name length &lt;@NUMBER:bytes@&gt; bytes&lt;@REGEXP(&quot;.+exceeds protocol limit of&quot;):msg@&gt; &lt;@NUMBER:bytes@&gt; bytes"
           rank="171"
           table="Cisco_ASA"
           taxonomy="Traffic.Denied" />
</octopussy_service>