[cisco_aironet] Parse strict ARP and NTP rejection variants

packages/cisco_aironet/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.21.2"
+  changes:
+    - description: Fix LOG-4-Q_IND grok processor to only match ARP subtype messages, preventing pipeline errors for non-ARP subtypes such as SNTP.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/1
 - version: "1.21.1"
   changes:
     - description: Add grok pattern for LOG-6-Q_IND Radius override messages

packages/cisco_aironet/data_stream/log/_dev/test/pipeline/test-aironet-messages.log

@@ -39,3 +39,4 @@
 <158>7779986: WLC001: 7842329: Oct 3 16:14:07.740 SGT: %APMGR_AWIPS_SYSLOG-6-APMGR_AWIPS_MESSAGE: Chassis 1 R0/0: wncd: AWIPS alarm:(TEST-AP-01) a1b2.c3d4.e5f6 Radio MAC a1b2.c3d4.e5f7 detected Airdrop Session (10021)
 <157>7781346: WLC001: 7843692: Oct 3 16:15:44.319 SGT: %SESSION_MGR-5-FAIL: Chassis 1 R0/6: wncd: Authorization failed or unapplied for client (de:fb:48:7c:4f:f7) on Interface capwap_12345678 AuditSessionID ABC123DEF456789012345678. Failure reason: Authc fail. Authc failure reason: Cred Fail.
 <46>host-1.example.local: *SISF BT Process: Jun 28 01:14:15.327: %LOG-6-Q_IND: [PA]apf_ms_radius_override.c:213 Radius overrides disabled, ignoring source 4
+<44>host-1.example.local: *sntpReceiveTask: Jun 27 16:49:36.033: %LOG-4-Q_IND: sntp_main.c:434 Spurious.NTP packet rejected on socket 0.[...It occurred 6 times.!]

packages/cisco_aironet/data_stream/log/_dev/test/pipeline/test-aironet-messages.log-expected.json

@@ -2,6 +2,12 @@
     "expected": [
         {
             "@timestamp": "2026-09-06T23:08:09.371+08:00",
+            "cisco": {
+                "sntp": {
+                    "source_file": "[PA]dtl_net.c",
+                    "source_line": 3393
+                }
+            },
             "client": {
                 "ip": "169.254.161.111",
                 "mac": "2C-6D-C1-F5-0C-80"
@@ -1600,6 +1606,47 @@
             "tags": [
                 "preserve_original_event"
             ]
+        },
+        {
+            "@timestamp": "2026-06-27T16:49:36.033+08:00",
+            "cisco": {
+                "sntp": {
+                    "socket_id": 0,
+                    "source_file": "sntp_main.c",
+                    "source_line": 434
+                }
+            },
+            "ecs": {
+                "version": "8.17.0"
+            },
+            "event": {
+                "action": "Q_IND",
+                "original": "<44>host-1.example.local: *sntpReceiveTask: Jun 27 16:49:36.033: %LOG-4-Q_IND: sntp_main.c:434 Spurious.NTP packet rejected on socket 0.[...It occurred 6 times.!]",
+                "provider": "LOG",
+                "severity": 4
+            },
+            "host": {
+                "name": "host-1.example.local"
+            },
+            "log": {
+                "level": "warning",
+                "syslog": {
+                    "facility": {
+                        "code": 5
+                    },
+                    "priority": 44,
+                    "severity": {
+                        "code": 4
+                    }
+                }
+            },
+            "message": "Spurious.NTP packet rejected on socket 0.[...It occurred 6 times.!]",
+            "process": {
+                "name": "sntpReceiveTask"
+            },
+            "tags": [
+                "preserve_original_event"
+            ]
         }
     ]
 }

packages/cisco_aironet/data_stream/log/elasticsearch/ingest_pipeline/default.yml

@@ -257,15 +257,24 @@ processors:
         - "Username entry \\(%{DATA:user.name}\\)%{DATA}mobile %{MAC:client.mac}"
       ignore_failure: false
   ###
+  - grok:
+      tag: grok_sntp_source_context_a3f7c891
+      description: LOG-4-Q_IND SNTP - extract source file and line from full_message before the field is stripped
+      field: _temp_.full_message
+      if: "ctx._temp_?.reason == 'LOG-4-Q_IND'"
+      patterns:
+        - "Q_IND: %{DATA:cisco.sntp.source_file}:%{INT:cisco.sntp.source_line:int} "
+      ignore_failure: true
   - grok:
       tag: grok_message_6b8b95f5
-      description: DTL-4-ARP_ORPHANPKT_DETECTED, Dot1x_NW_MsgTask_4
+      description: DTL-4-ARP_ORPHANPKT_DETECTED, LOG-4-Q_IND (ARP orphan, SNTP spurious-packet)
       field: message
       if: >-
         ctx._temp_?.reason == 'DTL-4-ARP_ORPHANPKT_DETECTED' ||
         ctx._temp_?.reason == 'LOG-4-Q_IND'
       patterns:
         - "STA\\(Target MAC Address\\) \\[%{MAC:client.mac}.*?\\] %{DATA:event.reason}\\(Source IP Address\\) %{IP:client.ip}%{DATA}\\(Destination IP Address\\) %{IP:server.ip}"
+        - "Spurious\\.NTP packet rejected on socket %{INT:cisco.sntp.socket_id:int}"
       ignore_failure: false
   - grok:
       tag: grok_message_757b5cf5

packages/cisco_aironet/data_stream/log/fields/aironet-fields.yml

@@ -67,3 +67,12 @@
 - name: cisco.radius.source
   type: short
   description: RADIUS source identifier number
+- name: cisco.sntp.socket_id
+  type: integer
+  description: Socket identifier on which a spurious SNTP/NTP packet was rejected
+- name: cisco.sntp.source_file
+  type: keyword
+  description: C source filename that generated the SNTP log entry
+- name: cisco.sntp.source_line
+  type: integer
+  description: Line number in the C source file that generated the SNTP log entry

packages/cisco_aironet/docs/README.md

@@ -315,6 +315,9 @@ The `log` data stream provides events from Cisco Aironet Wireless LAN Controller
 | cisco.radius.source | RADIUS source identifier number | short |
 | cisco.radius.status | RADIUS status (enabled/disabled) | keyword |
 | cisco.site_tag | Load balancer site tag name | keyword |
+| cisco.sntp.socket_id | Socket identifier on which a spurious SNTP/NTP packet was rejected | integer |
+| cisco.sntp.source_file | C source filename that generated the SNTP log entry | keyword |
+| cisco.sntp.source_line | Line number in the C source file that generated the SNTP log entry | integer |
 | cisco.ssid | Cisco SSID | keyword |
 | cisco.wps.channel | Cisco WPS channel | short |
 | cisco.wps.hits | Cisco WPS hits | short |

packages/cisco_aironet/manifest.yml

@@ -1,7 +1,7 @@
 format_version: "3.0.3"
 name: cisco_aironet
 title: "Cisco Aironet"
-version: "1.21.1"
+version: "1.21.2"
 description: "Integration for Cisco Aironet WLC Logs"
 type: integration
 categories: