Feat/netobs 1220 double header processing

[melvinsimmert]

Submit a pull request

Thank you for submitting a pull request!
To speed up the review process, please ensure that everything below
is true:

1. This is not a duplicate of an existing Plugin.
2. No existing features have been broken without good reason.
3. The Documentation has been updated to reflect your changes.
4. Tests have been added or updated to reflect your changes.
5. All tests pass.

---

Replace any ":question:" below with information about your pull request.

Pull Request Details

Provide details about your pull request and what it adds, fixes, or changes.

❓

Breaking Changes

Describe what features are broken by this pull request and why, if any.

❓

Issues Fixed

Enter the issue numbers resolved by this pull request below, if any.

1. ❓

Other Relevant Information

Provide any other important details below.

❓

[Copilot]

🟡 Changes recommended

The new/updated OTTL statements include confirmed syntax/regex issues that are likely to break collector config parsing or prevent intended audit classification behavior.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR updates the logs extension Helm chart to improve syslog processing by tightening double-header relay hostname parsing and adding a new syslog device classification transform that enriches logs with NetBox-oriented manufacturer/platform/role attributes.

Changes:

• Bump the logs plugin/chart versions (PluginDefinition + Helm Chart.yaml).
• Add and wire in a new transform/syslog_device_classification processor for syslog pipelines (and include it in the external collector config).
• Adjust syslog parsing/classification behavior, including double-header relay host regex and updated audit classification logic.

File summaries

File	Description
logs/plugindefinition.yaml	Bumps plugin version and referenced chart version.
logs/charts/Chart.yaml	Bumps Helm chart version.
logs/charts/templates/external-collector.yaml	Includes the new syslog device classification transform in the rendered collector config.
logs/charts/templates/_syslog-device-classification-config.tpl	Adds a new OTTL transform to classify devices/vendors/platforms from syslog content.
logs/charts/templates/_syslog-config.tpl	Wires transform/syslog_device_classification into syslog TCP/UDP/TLS pipelines and tightens double-header relay host capture regex.
logs/charts/templates/_syslog-audit-filter-config.tpl	Updates host.name handling and audit classification rules (including NetBox metadata usage).

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 3
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

There are confirmed logic/regression risks in the new classification and parsing rules (platform overwrite, Cisco audit relevance omission, TLS-only host regex behavior) that should be corrected before approval.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

Suppressed comments (1)

logs/charts/templates/_syslog-device-classification-config.tpl:95

• Spelling/wording in comment: "Platfrom" is misspelled and the sentence is grammatically awkward.

    # Trend Micro is no official Manufacturer, Platfrom or anything similar in Netbox. We will still handle it as such for transformation purposes.

• Files reviewed: 3/3 changed files
• Comments generated: 4
• Review effort level: Lite

[Copilot]

🔵 Needs a closer look

The updated audit classification can leave Palo Alto logs non-audit despite setting sap.cc.audit.source, which can break audit routing.

Review details

Suppressed comments (4)

Previously missed (2) — in code that hasn't changed since the last review.

logs/charts/templates/_syslog-audit-filter-config.tpl:338

• In transform/syslog_audit_classification, the Palo Alto Networks block sets sap.cc.audit.source after the earlier global rule that marks logs audit_relevant when sap.cc.audit.source != nil. As a result, logs that match the IPS patterns can end up with sap.cc.audit.source="ips-ids" but still have audit_relevant="false" (and won’t be routed as audit).
  logs/charts/templates/_syslog-device-classification-config.tpl:13
• The introductory comment has a dangling comma in the example list and a grammatical error (“shared between from VMs”), which makes the documentation harder to read.

This issue also appears on line 95 of the same file.

logs/charts/templates/_syslog-device-classification-config.tpl:95

• Typo in comment: “Platfrom” should be “Platform”.

    # Trend Micro is no official Manufacturer, Platfrom or anything similar in Netbox. We will still handle it as such for transformation purposes.

logs/charts/templates/_syslog-device-classification-config.tpl:77

• This NX-OS platform assignment can overwrite an existing netbox.platform.slug (e.g., if set by upstream enrichment), which contradicts the comment that attributes are only set when nil.

        - 'set(log.attributes["netbox.platform.slug"], "cisco-nx-os") where log.attributes["netbox.platform.slug"] == nil and (log.attributes["syslog.format"] == "cisco_nxos_year" or log.attributes["syslog.format"] == "cisco_nxos_year_failed")'

• Files reviewed: 3/3 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

🔵 Needs a closer look

There is a confirmed audit-routing logic bug for Palo Alto IPS/IDS events (audit source set without reliably marking the log as audit-relevant), and the updated relay-host regex is overly restrictive and can drop valid relay identifiers (e.g., IPv6).

Review details

Suppressed comments (6)

Previously missed (4) — in code that hasn't changed since the last review.

logs/charts/templates/_syslog-audit-filter-config.tpl:338

• In the Palo Alto block, IPS/IDS events set sap.cc.audit.source to "ips-ids", but audit_relevant is only set for "THREAT" messages. Because the general "audit if sap.cc.audit.source != nil" rule runs earlier in the transform, IPS/IDS events without "THREAT" will remain non-audit and be routed incorrectly.
  logs/charts/templates/_syslog-config.tpl:58
• The relay-host capture regex now only allows letters/digits/dot/underscore/hyphen, which can break double-header parsing for valid relay identifiers like IPv6 addresses (contain ':'). This would prevent syslog.host.name from being populated for those events.

This issue also appears on line 296 of the same file.
logs/charts/templates/_syslog-device-classification-config.tpl:13

• The header comment describes stage 1 as "Platform extraction" and stage 2 as setting manufacturer/role, but the transform first extracts netbox.manufacturer.slug and then derives platform/role. This mismatch makes the rule ordering harder to understand and maintain.
  logs/charts/templates/_syslog-device-classification-config.tpl:95
• Typo in comment: "Platfrom" should be "Platform".

logs/charts/templates/_syslog-config.tpl:300

• Same relay-host capture regex restriction as the TCP pipeline: this pattern will not capture IPv6 relay addresses (':' characters) and may cause syslog.host.name to be missing for double-header UDP events.

  - type: regex_parser
    id: syslog_udp_double_header_capture_relay_host
    parse_from: attributes.relay_header
    regex: '(?P<syslog_host_name>[A-Za-z0-9][A-Za-z0-9._\-]*):?\s*$'
    on_error: send_quiet

logs/charts/templates/_syslog-config.tpl:533

• Same relay-host capture regex restriction as the TCP pipeline: this pattern will not capture IPv6 relay addresses (':' characters) and may cause syslog.host.name to be missing for double-header TLS events.

  - type: regex_parser
    id: syslog_tls_double_header_capture_relay_host
    parse_from: attributes.relay_header
    regex: '(?P<syslog_host_name>[A-Za-z0-9][A-Za-z0-9._\-]*):?\s*$'
    on_error: send_quiet

• Files reviewed: 3/3 changed files
• Comments generated: 0 new
• Review effort level: Lite

[timojohlo]

chart version needs a bump, otherwise LGTM 👍