Skip to content

Commit 66cc667

Browse files
haetamoudihaetamoudi
authored
[Cisco ISE] Keep cisco-av-pair values with embedded 'equals' as keywords
1 parent d43ff23 commit 66cc667

7 files changed

Lines changed: 111 additions & 9 deletions

File tree

‎packages/cisco_ise/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "1.32.4"
3+
changes:
4+
- description: Handle the values of top-level keys under cisco-av-pair as a scalar mapped to a keyword field. Maintain separate process for mdm-tlv as it can contain sub-keys.
5+
type: bugfix
6+
link: https://github.com/elastic/integrations/pull/18964
27
- version: "1.32.3"
38
changes:
49
- description: Handle non-IP Remote-Address values in TACACS accounting logs without pipeline errors.

‎packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-passed-authentications.log‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,3 +3,4 @@
33
<181>Feb 23 21:44:54 cisco-ise-host CISE_Passed_Authentications 0000000028 1 0 2021-02-23 21:44:54.276 +00:00 0000001707 5233 NOTICE Passed-Authentication: TrustSec Data Download Succeeded, ConfigVersionId=9, Device IP Address=81.2.69.144, DestinationIPAddress=81.2.69.144, DestinationPort=1645, UserName=#CTSREQUEST#, Protocol=Radius, RequestLatency=281, NetworkDeviceName=ASAv-vpn, User-Name=#CTSREQUEST#, NAS-IP-Address=81.2.69.144, NAS-Port=2, NAS-Port-Type=Virtual, cisco-av-pair=cts-environment-version=1, cisco-av-pair=cts-environment-data=ASAv-vpn, cisco-av-pair=cts-device-capability=env-data-fragment, cisco-av-pair=cts-pac-opaque=****, cisco-av-pair=coa-push=true, NetworkDeviceProfileName=Cisco, NetworkDeviceProfileId=8ade1f15-aef1-4a9a-8158-d02e835179db, IsThirdPartyDeviceFlow=false, AcsSessionID=ise/403491114/1, SelectedAccessService=NDAC_SGT_Service, Step=11001, Step=11017, Step=11117, Step=15012, Step=15036, Step=15006, Step=11002, NetworkDeviceGroups=Location#All Locations#dCloud, NetworkDeviceGroups=Device Type#All Device Types#Security Devices#VPN, AuthorizationPolicyMatchedRule=Default, CPMSessionID=c612851bJ4_5zUNfXSy7PCu6hSY3K1tPzLJOLXwVfJMIFdTrUjg, ISEPolicySetName=NetworkDeviceAuthorization, DTLSSupport=Unknown, Network Device Profile=Cisco, Location=Location#All Locations#dCloud, Device Type=Device Type#All Device Types#Security Devices#VPN, Response={Class=CACS:c612851bJ4_5zUNfXSy7PCu6hSY3K1tPzLJOLXwVfJMIFdTrUjg:ise/403491114/1; cisco-av-pair=cts:server-list=CTSServerList1-0001; cisco-av-pair=cts:security-group-tag=0002-11; cisco-av-pair=cts:environment-data-expiry=86400; cisco-av-pair=cts:security-group-table=0001-46; },
44
<181>Mar 3 09:11:58 cisco-ise-host CISE_Passed_Authentications 0000082517 1 0 2022-03-03 09:11:58.729 +00:00 0000082584 5239 NOTICE RADIUS: NAS problem was fixed, ConfigVersionId=1626, NAS-IP-Address=81.2.69.145, MisconfiguredClientFixReason=Silent, Step=5239,
55
<181>Mar 3 09:11:58 cisco-ise-host CISE_Passed_Authentications 0000082517 1 0 2025-03-03 09:11:58.840 -07:00 0429868068 5200 NOTICE Passed-Authentication: Authentication succeeded, ConfigVersionId=509, Device IP Address=81.2.69.144, DestinationIPAddress=81.2.69.145, DestinationPort=1645, UserName=user1, Protocol=Radius, NetworkDeviceName=ASA_Firewalls, User-Name=user1, NAS-IP-Address=81.2.69.145, NAS-Port=216199168, Called-Station-ID=81.2.69.148, Calling-Station-ID=81.2.69.145, NAS-Port-Type=Virtual, Tunnel-Client-Endpoint=(tag=0) 81.2.69.145, cisco-av-pair=mdm-tlv=device-platform=win, cisco-av-pair=mdm-tlv=computer-name=User1, cisco-av-pair=mdm-tlv=device-mac=04-68-74-a2-c2-67, cisco-av-pair=mdm-tlv=device-platform-version=10.0.26100 , cisco-av-pair=mdm-tlv=device-public-mac=04-68-74-a2-c2-67, cisco-av-pair=mdm-tlv=ac-user-agent=AnyConnect Windows 5.1.10.233, cisco-av-pair=mdm-tlv=device-uid-global=2897F9C5734F41A03F0E89064463F6FAB5EEDBF1, cisco-av-pair=mdm-tlv=device-type=ACME COMPUTER, cisco-av-pair=mdm-tlv=device-uid=E835E862F6A2CE17C35D570B4746B86F9CFE9BCAD0824F872BA61C3F6F5682C1, cisco-av-pair=audit-session-id=984ffaf10ce2f00068ec8408, cisco-av-pair=coa-push=true, CVPN3000/ASA/PIX7x-Tunnel-Group-Name=RA_VPN, OriginalUserName=user1, NetworkDeviceProfileName=Cisco, NetworkDeviceProfileId=b0699505-3150-4215-a80e-6753d45bf56c, IsThirdPartyDeviceFlow=false, SSID=81.2.69.148, CVPN3000/ASA/PIX7x-Client-Type=2, AcsSessionID=lxprdisepsn04/543883580/12648582, AuthenticationIdentityStore=Duo_Radius, AuthenticationMethod=PAP_ASCII, SelectedAccessService=Default Network Access, SelectedAuthorizationProfiles=VPN full access, IsMachineAuthentication=false, RequestLatency=4302, IdentityGroup=Endpoint Identity Groups:Profiled:Windows11-Workstation, Step=11001, Step=11017, Step=15049, Step=15008, Step=15048, Step=15048, Step=15048, Step=15048, Step=15048, Step=15048, Step=15041, Step=22072, Step=15013, Step=24210, Step=24216, Step=15013, Step=24634, Step=24636, Step=24609, Step=11100, Step=11101, Step=24612, Step=24623, Step=24641, Step=22037, Step=15057, Step=24715, Step=15036, Step=24209, Step=24211, Step=24432, Step=24325, Step=24313, Step=24319, Step=24367, Step=24367, Step=24323, Step=24355, Step=24416, Step=15048, Step=15048, Step=15016, Step=22081, Step=22080, Step=11002, SelectedAuthenticationIdentityStores=Internal Users, SelectedAuthenticationIdentityStores=Duo_Radius, AuthenticationStatus=AuthenticationPassed, NetworkDeviceGroups=Location#All Locations#Example Campus, NetworkDeviceGroups=Device Type#All Device Types#ASA Firewalls, NetworkDeviceGroups=IPSEC#Is IPSEC Device#No, NetworkDeviceGroups=DNAC#DNAC Devices, IdentityPolicyMatchedRule=Default, AuthorizationPolicyMatchedRule=RemoteAllowedMFA, cisco-av-pair=AuthenticationIdentityStore=Duo_Radius, CPMSessionID=984ffaf10ce2f00068ec8408, PostureAssessmentStatus=NotApplicable, EndPointMatchedProfile=Windows11-Workstation, ISEPolicySetName=Remote Access VPN Policy, IdentitySelectionMatchedRule=Default, StepLatency=1=0\\;2=1\\;3=0\\;4=0\\;5=1\\;6=0\\;7=0\\;8=5\\;9=6\\;10=0\\;11=1\\;12=0\\;13=0\\;14=2\\;15=0\\;16=0\\;17=0\\;18=0\\;19=0\\;20=4259\\;21=1\\;22=0\\;23=0\\;24=0\\;25=0\\;26=5\\;27=0\\;28=0\\;29=4\\;39=9\\;40=7\\;41=0\\;42=1\\;43=0\\;44=1, AD-User-Resolved-Identities=user1@example.com, AD-User-Join-Point=example.com, StepData=4= Wlan-Id, StepData=5= Radius.Called-Station-ID, StepData=6= DEVICE.Device Type, StepData=7= Network Access.Protocol, StepData=8= Network Condition.Wireless Controllers, StepData=9= Network Condition.ASA VPN, StepData=11=EXPL_auth_order_DUO, StepData=12=Internal Users, StepData=15=Duo_Radius, StepData=16=Duo_Radius, StepData=17=Duo_Radius, StepData=18=Duo_Radius, StepData=19=( port = 1812 ), StepData=0=AD1, StepData=1=user1, StepData=2=example.com, StepData=3=example.com, StepData=4=aws.example.com\\,Domain trust is one-way, StepData=5=example.com\\,Domain trust is one-way, StepData=7=example.com, StepData=8=AD1, StepData=39= AD1.ExternalGroups, StepData=40= Network Condition.ASA VPN, TotalAuthenLatency=4302, ClientLatency=0, AD-User-Resolved-DNs=CN=User1 \\,OU=New Users\\,OU=PEOPLE\\,DC=Example\\,DC=com, AD-User-DNS-Domain=example.com, AD-Groups-Names=example.com/Groups/NetOpsGroups/WirelessAllowed, AD-Groups-Names=example.com/Groups/NetOpsGroups/RemoteAllowedMFA, AD-User-NetBios-Name=user1, AD-User-SamAccount-Name=user1, allowEasyWiredSession=false, DTLSSupport=Unknown, EndPointIPAddress=81.2.69.145, HostIdentityGroup=Endpoint Identity Groups:Profiled:Windows11-Workstation, ExternalGroups=S-1-5-21-1-2-3-4, ExternalGroups=S-1-5-21-1-2-3-4, Model Name=Unknown, Software Version=Unknown, Network Device Profile=Cisco, Location=Location#All Locations#Example, Device Type=Device Type#All Device Types#ASA Firewalls, IPSEC=IPSEC#Is IPSEC Device#No, DNAC=DNAC#DNAC Devices, ASA VPN=true, Response={Class=CACS:984ffaf10ce2f00068ec8408:lxprdisepsn04/543883580/12648582; cisco-av-pair=profile-name=Windows11-Workstation; LicenseTypes=1; },
6+
<181>Apr 30 09:11:25 cisco-ise-host CISE_Passed_Authentications 0000008856 1 0 2026-04-30 09:11:25.367 +00:00 0000781727 5200 NOTICE Passed-Authentication: Authentication succeeded, ConfigVersionId=11, UserName=92-09-00-00-00-01, cisco-av-pair=FQSubjectName=111-222-aaa-bbb-123456abc=abc123,ou=488-test,ou=org-sgn,ou=wireless,dc=example,dc=int#00-aa-bb-cc-dd-ee, NetworkDeviceProfileName=Cisco,

‎packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-passed-authentications.log-expected.json‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -903,6 +903,83 @@
903903
"user1"
904904
]
905905
}
906+
},
907+
{
908+
"@timestamp": "2026-04-30T09:11:25.367Z",
909+
"cisco_ise": {
910+
"log": {
911+
"category": {
912+
"name": "CISE_Passed_Authentications"
913+
},
914+
"cisco_av_pair": {
915+
"FQSubjectName": "111-222-aaa-bbb-123456abc=abc123,ou=488-test,ou=org-sgn,ou=wireless,dc=example,dc=int#00-aa-bb-cc-dd-ee"
916+
},
917+
"config_version": {
918+
"id": 11
919+
},
920+
"message": {
921+
"code": "5200",
922+
"description": "Passed-Authentication: Authentication succeeded",
923+
"id": "0000008856"
924+
},
925+
"network": {
926+
"device": {
927+
"profile_name": "Cisco"
928+
}
929+
},
930+
"segment": {
931+
"number": 0,
932+
"total": 1
933+
}
934+
}
935+
},
936+
"ecs": {
937+
"version": "8.17.0"
938+
},
939+
"event": {
940+
"action": "passed-authentication",
941+
"category": [
942+
"authentication"
943+
],
944+
"code": "5200",
945+
"kind": "event",
946+
"original": "<181>Apr 30 09:11:25 cisco-ise-host CISE_Passed_Authentications 0000008856 1 0 2026-04-30 09:11:25.367 +00:00 0000781727 5200 NOTICE Passed-Authentication: Authentication succeeded, ConfigVersionId=11, UserName=92-09-00-00-00-01, cisco-av-pair=FQSubjectName=111-222-aaa-bbb-123456abc=abc123,ou=488-test,ou=org-sgn,ou=wireless,dc=example,dc=int#00-aa-bb-cc-dd-ee, NetworkDeviceProfileName=Cisco,",
947+
"outcome": "success",
948+
"sequence": 781727,
949+
"timezone": "+00:00",
950+
"type": [
951+
"info"
952+
]
953+
},
954+
"host": {
955+
"hostname": "cisco-ise-host"
956+
},
957+
"log": {
958+
"level": "notice",
959+
"syslog": {
960+
"priority": 181,
961+
"severity": {
962+
"name": "notice"
963+
}
964+
}
965+
},
966+
"message": "2026-04-30 09:11:25.367 +00:00 0000781727 5200 NOTICE Passed-Authentication: Authentication succeeded, ConfigVersionId=11, UserName=92-09-00-00-00-01, cisco-av-pair=FQSubjectName=111-222-aaa-bbb-123456abc=abc123,ou=488-test,ou=org-sgn,ou=wireless,dc=example,dc=int#00-aa-bb-cc-dd-ee, NetworkDeviceProfileName=Cisco,",
967+
"related": {
968+
"hosts": [
969+
"cisco-ise-host"
970+
],
971+
"user": [
972+
"92-09-00-00-00-01"
973+
]
974+
},
975+
"tags": [
976+
"preserve_original_event"
977+
],
978+
"user": {
979+
"name": [
980+
"92-09-00-00-00-01"
981+
]
982+
}
906983
}
907984
]
908985
}

‎packages/cisco_ise/data_stream/log/elasticsearch/ingest_pipeline/pipeline_passed_authentications.yml‎

Lines changed: 24 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -171,14 +171,30 @@ processors:
171171
172172
def attributes = [:];
173173
ctx.cisco_ise.log.log_details.get("cisco-av-pair")?.forEach((v) -> {
174+
def firstEq = v.indexOf('=');
175+
if (firstEq <= 0) {
176+
return true;
177+
}
178+
def topKey = v.substring(0, firstEq).trim();
179+
def rest = v.substring(firstEq + 1);
180+
181+
// Only mdm-tlv uses nested subkeys (device-platform=win, ...). Other pairs
182+
// (e.g. FQSubjectName=...cn=...,ou=...) may contain '=' in the value and must stay scalar.
183+
if (!"mdm-tlv".equals(topKey)) {
184+
attributes[topKey] = rest.trim();
185+
return true;
186+
}
187+
174188
def inEscape = false;
175189
def start = 0;
176190
def key = "";
177-
def m = attributes;
191+
if (!attributes.containsKey("mdm-tlv")) {
192+
attributes["mdm-tlv"] = [:];
193+
}
194+
def m = attributes["mdm-tlv"];
178195
179-
for (def i = 0, n = v.length(); i < n; ++i) {
180-
def c = v.charAt(i);
181-
// Escape handling.
196+
for (def i = 0, n = rest.length(); i < n; ++i) {
197+
def c = rest.charAt(i);
182198
if (inEscape) {
183199
inEscape = false;
184200
continue;
@@ -189,9 +205,9 @@ processors:
189205
}
190206
191207
if (c == (char)'=') {
192-
key = v.substring(start, i).trim();
193-
def nextSplit = v.indexOf("=", i + 1);
194-
if (nextSplit != -1 && v.charAt(nextSplit - 1) != (char)'\\') {
208+
key = rest.substring(start, i).trim();
209+
def nextSplit = rest.indexOf("=", i + 1);
210+
if (nextSplit != -1 && rest.charAt(nextSplit - 1) != (char)'\\') {
195211
if (!m.containsKey(key)) {
196212
m[key] = [:];
197213
}
@@ -200,7 +216,7 @@ processors:
200216
start = i + 1;
201217
}
202218
if (i == n - 1) {
203-
m[key] = v.substring(start, n).trim();
219+
m[key] = rest.substring(start, n).trim();
204220
}
205221
}
206222

‎packages/cisco_ise/data_stream/log/fields/fields.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -243,6 +243,8 @@
243243
type: keyword
244244
- name: device-uid-global
245245
type: keyword
246+
- name: FQSubjectName
247+
type: keyword
246248
- name: mdm-tlv
247249
type: group
248250
fields:

‎packages/cisco_ise/docs/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -423,6 +423,7 @@ The following table lists the exported fields for this data stream:
423423
| cisco_ise.log.category.name | | keyword |
424424
| cisco_ise.log.cause | | keyword |
425425
| cisco_ise.log.cisco_av_pair.AuthenticationIdentityStore | | keyword |
426+
| cisco_ise.log.cisco_av_pair.FQSubjectName | | keyword |
426427
| cisco_ise.log.cisco_av_pair.audit-session-id | | keyword |
427428
| cisco_ise.log.cisco_av_pair.coa-push | | boolean |
428429
| cisco_ise.log.cisco_av_pair.cts-device-capability | | keyword |

‎packages/cisco_ise/manifest.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
format_version: "3.0.3"
22
name: cisco_ise
33
title: Cisco ISE
4-
version: "1.32.3"
4+
version: "1.32.4"
55
description: Collect logs from Cisco ISE with Elastic Agent.
66
type: integration
77
categories:

0 commit comments

Comments
 (0)