elasticsearch/logstash — pull request #2211 by Nespa (2014-12-09 14:46:23+00:00)
Title: 1.5-PATERN-FIREWALLS-PFSENSE

diff --git a/patterns/firewalls b/patterns/firewalls
index ff7baea..4b13d12 100644
--- a/patterns/firewalls
+++ b/patterns/firewalls
@@ -58,3 +58,7 @@ CISCOFW713172 Group = %{GREEDYDATA:group}, IP = %{IP:src_ip}, Automatic NAT Dete
# ASA-4-733100
CISCOFW733100 \[\s*%{DATA:drop_type}\s*\] drop %{DATA:drop_rate_id} exceeded. Current burst rate is %{INT:drop_rate_current_burst} per second, max configured rate is %{INT:drop_rate_max_burst}; Current average rate is %{INT:drop_rate_current_avg} per second, max configured rate is %{INT:drop_rate_max_avg}; Cumulative total count is %{INT:drop_total_count}
#== End Cisco ASA ==
+
+#pfsense
+##icmpv6
+PFSENSEICMPV6 rule (?.*)\(.*\): (?pass|block) .* on (?.*): \(.*\(.*\).*\) (?.*) > (?.*) \[icmp6 sum ok] (?ICMP6), (?.*), (?.*)