Metrics Library | Liongard

Boards

Feature Requests

Metrics Library

This is a community-led space where Liongard users can come to teach and learn from one another. Share custom Metrics, get inspired and see what’s trending in the Pride.

Details

Cisco ASA: SSH Rules Allowed Globally

This metric checks a Cisco ASA configuration for SSH traffic that is allowed globally on an outside interface. Management.SSH.Channels[?Source=='0.0.0.0' && (Service=='Outside' || Service=='OUTSIDE' || Service=='outside')] | length(@)

submitted

Cisco ASA: HTTP Rules Allowed Globally

This metric checks a Cisco ASA configuration for HTTP traffic that is allowed globally on an outside interface. Management.HTTP.Channels[?Source=='0.0.0.0' && (Service=='Outside' || Service=='OUTSIDE' || Service=='outside')] | length(@)

submitted

Cisco IOS: Syslog Detected

Determines if the device is logging to an external syslog server. contains(RunningConfig,'logging host') || contains(RunningConfig,'logging 1')

submitted

Cisco ASA: ASDM Version

Determines the ASDM image that is installed on the device. SystemInfo.DeviceManagerVersion

submitted

Cisco ASA: Windows Anyconnect Image Version

Determines the version of Windows Anyconnect that's installed on the ASA. SystemInfo.AnyConnectClientWindowsVersion

submitted

Cisco ASA: RDP (Port 3389) Rules Detected

Checks to see if RDP/Port 3389 is listed in an access list. AccessList[?DestinationPort=='3389'] | length(@)

submitted

CIsco ASA: Detect if management has SSH 0.0.0.0 outside rule exists

Detect if management has SSH open to the outside. The outside can also be changed to 'inside' as well Management.SSH.Channels[?(Mask == 0.0.0.0 && Source == 0.0.0.0 && Service == outside )]

submitted

Cisco ASA check for CVE-2024-20353 | CVE-2024-20359

To check if the above CVE's are present on your Cisco ASA you will need to preform the below steps.First you will need to use the above metric to return a list of your ASA's software versionsIf your ASA version returns a value with parentheses () remove the () and replace with a period . Example: 9.14(4)23 will be 9.14.4.23After you have your ASA Software Version you will use the Cisco Software checker for each CVE and add the software version to check if the device is effected CVE-2024-20353https: //sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-websrvs-dos-X8gNucD2CVE-2024-20359https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-persist-rce-FLsNXF4hYou will need to use the Cisco Checker to confirm if the specific versions of your ASA are effected SystemInfo.CiscoAdaptiveSecurityApplianceSoftwareVersion

submitted