import 'cisco_msg_id.csv' from /envs.splunk.'eps-shw-522513dc5758f0'.lookups
import route from /splunk/ingest/commands
import logs_to_metrics from /splunk/ingest/commands


function extract_useful_fields($source) {
   return | from $source
   /* Extracted message matches with ASA or FTD */
   | rex field=_raw /(?P<_raw>(%ASA|%FTD).*)/
   /* Extract message number */
   | rex field=_raw /(%ASA|%FTD)-\d+-(?P\d+)/
   /* Extract username */
   | rex field=_raw /^[^'\n]*'(?P[^']+)/}

function drop_security_noise($source) {
   return | from $source
   | where message_id != "302013"
   | where message_id != "302015"
   | where message_id != "302016"
   | where message_id != "110003"
   | where message_id != "110002"
}

function mask_usernames($source) {
   return | from $source
   | eval _raw=replace(_raw, username, "[NAME_REDACTED]")
}

function enrich_with_explanation($source) {
   return | from $source |
   lookup 'cisco_msg_id.csv' message_id AS message_id OUTPUT explanation AS explanation
}

$pipeline = | from $source
 // extract the useful fields
    | extract_useful_fields
 // Filter "302013", "302015" message ID number
    | drop_security_noise
 // enrich log events with explanations based on message ID
    | enrich_with_explanation
 // convert logs to metrics and send to o11y cloud
     | thru [
        | logs_to_metrics name="cisco_asa" metrictype="counter" value=1 time=_time dimensions={"message_id": message_id}
       | into $metrics_destination
     ]
 // send authentication logs to Splunk index
     | route message_id == 109025, [
      // Mask usernames to protect PII
      | mask_usernames
      | fields -username 
      | eval index = "cisco_auth_logs"
      | into $splunk_destination
  ]
// // Archive rest of the logs to AWS S3
| into $aws_s3_destination;