Project Objective
QRadar Community Edition did not include a suitable native pfSense DSM, so pfSense events initially arrived as raw syslog without useful normalization. The goal was to build a maintainable custom DSM that could:
Identify pfSense daemons Map firewall actions Normalize IP addresses Normalize ports Extract protocol Expose rule metadatafilterlog
Forwarding
Log Source
pfSense DSM
Security Event
Sample Raw Event
The following pfSense firewall event was used during parser development:
<134>Jul 26 13:19:09 filterlog[80467]: 68,,,12004,vtnet0,match,block,in,4,0x0,,255,0,0,DF,17,udp,274,192.168.1.75,224.0.0.251,5353,5353,254
The payload is a comma-separated filterlog message containing rule metadata, action, direction, IP version, protocol details, addresses and ports.
DSM Creation
1. Create a Dedicated Log Source Type
A new custom Log Source Type named pfSense was created in DSM Editor.
2. Attach the Existing Log Source
The pfSense log source was changed from Universal DSM to the new custom pfSense type.
3. Save and Deploy
The parser changes were saved and deployed so incoming events would be processed by the custom DSM.
Event Identification
Event Category
The daemon name is extracted as the event category, allowing one DSM to support multiple pfSense services.
^[^ ]+ +[^ ]+ +[^ ]+ +([A-Za-z0-9_.-]+)
Format string: $1
Result: filterlog
Event ID
The firewall action is extracted from the seventh CSV field.
filterlog[^:]*: *[^,]*,[^,]*,[^,]*,[^,]*,[^,]*,[^,]*,([^,]+)
Format string: $1
Result: block or pass
Event Mappings
| Event Category | Event ID | Mapped Event Name | Purpose |
|---|---|---|---|
| filterlog | block | pfSense Firewall Block | Identifies denied firewall traffic |
| filterlog | pass | pfSense Firewall Permit | Identifies permitted firewall traffic |
Once deployed, QRadar stopped treating these records as unknown events and displayed the mapped names in Log Activity.
Normalized Network Properties
Core network fields were extracted into QRadar system properties. This allows the events to participate in searches, correlation rules, offenses and network-based investigations in the same way as events from a supported commercial DSM.
| QRadar Property | Parsed Value | Example |
|---|---|---|
| Source IP | IPv4 source address | 192.168.1.75 |
| Destination IP | IPv4 destination address | 224.0.0.251 |
| Source Port | Transport source port | 5353 |
| Destination Port | Transport destination port | 5353 |
| Protocol | Transport protocol name | udp |
pfSense-Specific Custom Properties
| Property | Regex | Example |
|---|---|---|
| pfSense Rule Number | filterlog[^:]*: *([^,]+) |
68 |
| pfSense Tracker ID | filterlog[^:]*: *[^,]*,[^,]*,[^,]*,([^,]+) |
12004 |
| pfSense Interface | filterlog[^:]*: *[^,]*,[^,]*,[^,]*,[^,]*,([^,]+) |
vtnet0 |
| pfSense Reason | filterlog[^:]*: *[^,]*,[^,]*,[^,]*,[^,]*,[^,]*,([^,]+) |
match |
| pfSense Direction | filterlog[^:]*: *[^,]*,[^,]*,[^,]*,[^,]*,[^,]*,[^,]*,[^,]*,([^,]+) |
in |
| pfSense Packet Length | filterlog[^:]*: *[^,]*,[^,]*,[^,]*,[^,]*,[^,]*,[^,]*,[^,]*,[^,]*,[^,]*,[^,]*,[^,]*,[^,]*,[^,]*,[^,]*,[^,]*,[^,]*,[^,]*,([^,]+) |
274 |
| pfSense TCP Flags | filterlog[^:]*: *[^,]*,[^,]*,[^,]*,[^,]*,[^,]*,[^,]*,[^,]*,[^,]*,[^,]*,[^,]*,[^,]*,[^,]*,[^,]*,[^,]*,[^,]*,[^,]*,tcp,[^,]*,[^,]*,[^,]*,[^,]*,[^,]*,[^,]*,([^,]+) |
TCP events only |
Format string for each property: $1
Compatibility Note
QRadar CE 7.3.3 accepted simple character classes and repeated [^,]* field skipping, but rejected several more complex escaped patterns during testing. The final parser deliberately uses conservative syntax proven to work in this environment.
Final Parsed Event
| Field | Result |
|---|---|
| Event Name | pfSense Firewall Block |
| Event Category | filterlog |
| Event ID | block |
| Source IP | 192.168.1.75 |
| Destination IP | 224.0.0.251 |
| Source Port | 5353 |
| Destination Port | 5353 |
| Protocol | udp |
| Rule Number | 68 |
| Tracker ID | 12004 |
| Interface | vtnet0 |
| Reason | match |
| Direction | in |
| Packet Length | 274 |
What Was Learned
This project demonstrated how QRadar DSM Editor identifies event types, maps them to QIDs and populates normalized properties from raw vendor logs. It also provided practical experience testing parser expressions against real events and adapting them to an older regex implementation.
Logical Next Steps
Extend the same DSM to additional pfSense services such as DHCP, DNS Resolver, OpenVPN and IPsec, then add IPv6-aware firewall expressions and more detailed mappings for protocol-specific event types.