elastic / elastic/integrations

[cisco_ise.log] Does not parse Cisco ISE Profiler Logs

Open
#15,655 7 comments 0 reactions 1 assignee Claimed by @ilyannn View on GitHub
bug Integration:cisco_ise Team:Integration-Experience
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
3d 4h
Merged PRs (30d)
209

Description

### Integration Name

Cisco ISE [cisco_ise]

### Dataset Name

Profiler

### Integration Version

1.29

### Agent Version

8.18

### Agent Output Type

elasticsearch

### Elasticsearch Version

8.18

### OS Version and Architecture

RHEL9

### Software/API Version

_No response_

### Error Message

Doesnt parse Cisco ISE Profiler Logs

### Event Original


<182>Oct 10 16:55:03 ise CISE_Profiler 0000002339 1 0 2025-10-10 16:55:03.202 +00:00 0328257629 80002 INFO Profiler: Profiler EndPoint profiling event occurred, ConfigVersionId=156, EndpointCertainityMetric=5, EndpointMacAddress=34:6B:F2, EndpointMatchedPolicy=DigiBoard-Device, EndpointNADAddress=192.0.0.0, EndpointOUI=DigiBoard, EndpointPolicy=DigiBoard-Device, EndpointProperty=PolicyVersion=55,EndPointPolicyID=ce0f8b00-9f06-11ef-be6b-005056af69be,LogicalProfile=profdile,AuthenticationMethod=Lookup,FirstCollection=1760115303174,CacheUpdateTime=1760115303199,StaticAssignment=false,User-Name=00409d346bf2,NmapScanCount=0,NetworkDeviceName=location,DestinationIPAddress=192.0.0.0,AAA-Server=ise,MessageCode=5400,Device Type=Device Type#All Device Types#SWITCH,PortalUser=,AllowedProtocolMatchedRule=Default,BYODRegistration=Unknown,Calling-Station-ID=4-6B-F2,FailureReason=15039 Rejected per authorization profile,Total Certainty Factor=5,IdentityGroupID=aa10ae00-896c-525400b48521,PostureApplicable=Yes,NmapSubnetScanID=0t-Type=Ethernet,TimeToProfile=21,DeviceRegistrationStatus=NotRegistered,MatchedPolicyID=cef06-11ef-be6b-005056af69be,SSID=0C,UserName=00,FeedService=false,UseCase=Host Lookup,SelectedAuthorizationProfiles=DenyAccess,StaticGroupAssignment=false,NAS-Port-Id=GigabitEthernet2,DTLSSupport=Unknown,LastActivity=1760115303174,Response={RadiusPacketType=AccessReject; AuthenticationResult=UnknownUser; },LastNmapScanTime=0,UpdateTime=0,AuthorizationPolicyMatchedRule=Default,Location=Location, EndpointSourceEvent=RADIUS Probe, EndpointIdentityGroup=Profiled, ProfilerServer=com

### What did you do?

Doesnt parse

### What did you see?

nothing

### What did you expect to see?

Parsed Logs

### Anything else?

no

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.