Package cisco/ise Release Notes

Package cisco/ise Release Notes Version 1.4.0

  • Added support for CISE_TACACS_Accounting events (codes 3300, 3301, 3302)

  • Added comprehensive TACACS+ diagnostics parsing for CISE_TACACS_Diagnostics category

  • Enhanced event categorization for TACACS+ authentication, authorization, and accounting events

  • Added support for TACACS+ network access control and user management events

  • Updated parser version to 2.1.0

Package cisco/ise Release Notes Version 1.3.4

  • Added parsing for CmdSet field to extract command line information into process.command_line field

  • Enhanced command parsing to filter and extract command arguments from TACACS authorization logs

  • Updated parser version to 2.0.7 and CPS version to 1.1.0

Package cisco/ise Release Notes Version 1.3.3

  • Enhanced parsing for CISE_Alarm messages with improved message extraction

  • Added event categorization and type for CISE_MONITORING_DATA_PURGE_AUDIT, CISE_System_Statistics

Package cisco/ise Release Notes Version 1.3.2

  • Enhanced parsing for CISE_MONITORING_DATA_PURGE_AUDIT events to support additional message formats

  • Added support for "purging data older than" message format

  • Added support for "completed successfully" message format with event outcome set to success

  • Added support for CISE_Alarm messages with improved parsing

  • Enhanced field extraction for alarm messages

  • Added event categorization for SGT assignment and RADIUS authentication drop alarms

Package cisco/ise Release Notes Version 1.3.1

  • Fixed field mapping for service.name instead of service.type

  • Improved timestamp parsing for additional formats

  • Enhanced field formatting for fields with hyphens in names

Package cisco/ise Release Notes Version 1.3.0

  • Sets the event.outcome based on the Vendor.FailureReason field

  • The old parser cisco-ise-syslog is now officially removed from the Cisco Identity Services Engine (ISE) package

Package cisco/ise Release Notes Version 1.2.3

  • Bug fix to update timestamp parsing to accept additional timezone formats

Package cisco/ise Release Notes Version 1.2.2

  • Bugfix to update timestamp parsing to accept + and - prefixed timezones

Package cisco/ise Release Notes Version 1.2.1

  • Utilizes array:append() function for array declarations.

  • Bumps ecs.version to 8.16.0.

  • Add custom parsing for CISE_MONITORING_DATA_PURGE_AUDIT events

Package cisco/ise Release Notes Version 1.2.0

  • Adds support for the CISE_Alarm messages.

  • Bumps the minimum LogScale version to 1.142 to support assertions in yaml files.

Package cisco/ise Release Notes Version 1.1.0
Parser renaming and Deprecation notice

The old parser cisco-ise-syslog is deprecated, and replaced by the new parser cisco-ise . While the old parser will remain available during a tranisition period, all future changes will only go into the new cisco-ise parser. We recommend switching to the newer parser as soon as possible, to make for the smoothest upgrade. The old cisco-ise-syslog parser will be removed at some point in the future. In your data, the field #type contains the name of the parser, so any queries you may have that searches for this field need to accomodate this change.

Duplicated vendor fields dropped in new parser

The old cisco-ise-syslog parser would duplicate certain fields, which the new cisco-ise parser will not. The fields which were previously duplicated, would be present both under the Vendor namespace (e.g. Vendor.srcIp ), and as a field mapped to CPS (e.g. source.ip ). If the value of two such fields is byte-for-byte the same, the new parser will no longer preserve the vendor-specific field, but only the CPS field. If the value of the two fields differ, both fields will be preserved. This means the following fields will no longer be present in the parsed data, when using the new parser:

  • Vendor.AD-Error-Details

  • Vendor.AdminIPAddress

  • Vendor.DestinationIPAddress

  • Vendor.DestinationPort

  • Vendor.Detail

  • Vendor.Device IP Address

  • Vendor.EPMacAddress

  • Vendor.EndPointMACAddress

  • Vendor.FailureReason

  • Vendor.IpAddress

  • Vendor.Remote-Address

  • Vendor.Service-Type

Miscellaneous

  • Sets the fields host.ip and host.mac as arrays.

  • Bug fix: corrected a typo in a field name from eevent.category to event.category .

  • Removes the host.address as it didn't conform to CPS standard.

  • Corrects the event categorization for event.category for events with code 52002, which was incorrectly assigned as deletion instead of iam .

Package cisco/ise Release Notes Version 1.0.0

  • Removes the Product field

  • Adds new event.module and Cps.version fields

  • Sets following tags: Cps.version , Vendor , ecs.version , event.dataset , event.kind , event.module , event.outcome , observer.type

  • Bumps parser version to 1.0.0

  • Adds parsing for several event codes

  • Restructures and optimizes parsing logic

  • Categorization updates

Package cisco/ise Release Notes Version 0.1.0

  • initial version