Cisco switches - new Decoders and Rules

[jmmallorq]

Hello,

I created new Decoders and Rules for Cisco switches related to NTP and network interfaces.

I assigned the Rules IDs 64250 to 64252.

The script output doesn't show any "Failed" message:

# ./runtest.py
- [ File = ./tests/cisco_switches.ini ] ---------
........

I upload the following files:

• decoders/0066-cisco_switches_decoders.xml
• rules/0685-cisco_switches_rules.xml
• tools/rules-testing/cisco_switches.ini

Regards,
J. M. Mallorquín

[rossengeorgiev]

Hi there, please consider these changes together with PR #402 as they will be in conflict. #402 expands the cisco decoder capabilities to handle a number of logging configurations. There is a comment providing a little background on the cisco log format. As this decoder is 0066 it won't work if both PRs are merged.

[juanrricci]

Hello team, we close this PR without applying the changes suggested here. The related issues were already solved in the following PR which applies on the last Wazuh version: wazuh/wazuh#7289.