bokamba / loganvil / Cisco ASA firewall logs

$ loganvil generate cisco-asa

Generate synthetic Cisco ASA firewall logs

Generate realistic synthetic Cisco ASA firewall logs for pipeline testing, SIEM demos, and detection tuning — deterministic and 100% client-side. Each line is a real ASA deny message — "<PRI>%ASA-4-106023: Deny proto src outside:IP/port dst inside:IP/port by access-group …" — so it exercises an ASA-aware parser precisely. No real network or secrets.

Open the LogAnvil generator →

This sample, generated

The block below is 15 lines of Cisco ASA firewall logs, produced by the real generator at seed 42 — deterministic, so this exact output regenerates anywhere. The live tool re-runs the identical engine on whatever source, seed, line count and anomalies you pick.

15lines
4.6stime span
0anomaly lines
42seed

no anomalies injected — raise a slider to seed detectable patterns

Generated Cisco ASA firewall logs

Real on-the-wire Cisco ASA firewall logs — no real users, IPs, or secrets. Copy it into a fixture, feed it to a parser, or seed a SIEM demo.

<166>%ASA-4-106023: Deny tcp src outside:185.199.108.153/51675 dst inside:10.1.10.200/443 by access-group "outside_access_in"
<167>%ASA-4-106023: Deny udp src outside:151.101.1.69/39823 dst inside:192.168.10.7/995 by access-group "outside_access_in"
<140>%ASA-4-106023: Deny udp src outside:52.94.236.248/50007 dst inside:10.0.0.5/143 by access-group "outside_access_in"
<131>%ASA-4-106023: Deny udp src outside:8.8.8.8/40304 dst inside:10.0.0.5/23 by access-group "outside_access_in"
<161>%ASA-4-106023: Deny tcp src outside:1.1.1.1/56558 dst inside:172.16.31.77/3306 by access-group "outside_access_in"
<156>%ASA-4-106023: Deny tcp src outside:8.8.8.8/48481 dst inside:192.168.0.101/53 by access-group "outside_access_in"
<141>%ASA-4-106023: Deny tcp src outside:34.223.14.100/57011 dst inside:172.20.0.15/25 by access-group "outside_access_in"
<146>%ASA-4-106023: Deny tcp src outside:52.94.236.248/51987 dst inside:192.168.1.50/8080 by access-group "outside_access_in"
<188>%ASA-4-106023: Deny tcp src outside:93.184.216.34/36644 dst inside:10.0.1.24/20 by access-group "outside_access_in"
<158>%ASA-4-106023: Deny udp src outside:185.199.108.153/34958 dst inside:192.168.1.50/8080 by access-group "outside_access_in"
<173>%ASA-4-106023: Deny tcp src outside:13.107.42.14/55971 dst inside:10.0.1.24/8443 by access-group "outside_access_in"
<186>%ASA-4-106023: Deny tcp src outside:13.107.42.14/42281 dst inside:192.168.0.101/80 by access-group "outside_access_in"
<146>%ASA-4-106023: Deny tcp src outside:185.199.108.153/52391 dst inside:192.168.100.254/5432 by access-group "outside_access_in"
<162>%ASA-4-106023: Deny tcp src outside:1.1.1.1/52437 dst inside:10.10.10.10/3306 by access-group "outside_access_in"
<133>%ASA-4-106023: Deny tcp src outside:185.199.108.153/36437 dst inside:192.168.100.254/23 by access-group "outside_access_in"

With an anomaly injected: Port scan

The same source, regenerated with a Port scan injected at 30% intensity. 7 line sare tagged and highlighted below — One source IP hitting many sequential destination ports — reconnaissance sweeping for open services. It is a documented, detectable pattern your SIEM rules should fire on — build the test data, then prove your detection works.

<166>%ASA-4-106023: Deny tcp src outside:185.199.108.153/51675 dst inside:10.1.10.200/443 by access-group "outside_access_in"
<167>%ASA-4-106023: Deny udp src outside:151.101.1.69/39823 dst inside:192.168.10.7/995 by access-group "outside_access_in"
<140>%ASA-4-106023: Deny udp src outside:52.94.236.248/50007 dst inside:10.0.0.5/143 by access-group "outside_access_in"
<131>%ASA-4-106023: Deny udp src outside:8.8.8.8/40304 dst inside:10.0.0.5/23 by access-group "outside_access_in"
<161>%ASA-4-106023: Deny tcp src outside:1.1.1.1/56558 dst inside:172.16.31.77/3306 by access-group "outside_access_in"
<156>%ASA-4-106023: Deny tcp src outside:8.8.8.8/48481 dst inside:192.168.0.101/53 by access-group "outside_access_in"
<141>%ASA-4-106023: Deny tcp src outside:34.223.14.100/57011 dst inside:172.20.0.15/25 by access-group "outside_access_in"
<146>%ASA-4-106023: Deny tcp src outside:52.94.236.248/51987 dst inside:192.168.1.50/8080 by access-group "outside_access_in"
<146>%ASA-4-106023: firewall: DENY src=80.82.77.139 dst=203.0.113.111 dpt=943 bytes=51Port scan
<146>%ASA-4-106023: firewall: DENY src=80.82.77.139 dst=203.0.113.111 dpt=944 bytes=48Port scan
<146>%ASA-4-106023: firewall: DENY src=80.82.77.139 dst=203.0.113.111 dpt=945 bytes=41Port scan
<146>%ASA-4-106023: firewall: DENY src=80.82.77.139 dst=203.0.113.111 dpt=946 bytes=69Port scan
<146>%ASA-4-106023: firewall: DENY src=80.82.77.139 dst=203.0.113.111 dpt=947 bytes=79Port scan
<146>%ASA-4-106023: firewall: DENY src=80.82.77.139 dst=203.0.113.111 dpt=948 bytes=89Port scan
<146>%ASA-4-106023: firewall: DENY src=80.82.77.139 dst=203.0.113.111 dpt=949 bytes=112Port scan

FAQ

Are these real Cisco ASA logs?
No — the output is synthetic. It reproduces the ASA %ASA-4-106023 deny-line format exactly (PRI, message ID, proto, outside/inside src/dst, access-group), but every address and port is fabricated. Safe for fixtures, demos and parser tests.
Can I inject anomalies?
Yes. A port scan fits ASA deny logs well: the slider appends a sweep from one source IP across many sequential destination ports, and the injected lines are highlighted and badged so you can verify your recon detection fires.
Is the output deterministic?
Yes — fully seeded. The same seed and config always produce byte-identical ASA lines, so a committed seed regenerates the identical log on any machine or in CI.

Generate other log sources

Open the LogAnvil generator to tune the seed, line count, EPS, format and anomaly sliders — or build a parser with LogForge for a log you already have.

Generate your own Cisco ASA firewall logs

Pick the seed, line count and EPS, inject the anomalies your rules should catch, and copy or download the result. Free, no account, nothing uploaded — generation runs entirely in your browser.

Open the LogAnvil generator →