elastic / elastic/integrations
[cisco_ise.log] Does not parse Cisco ISE Profiler Logs
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 3d 4h
- Merged PRs (30d)
- 209
Description
### Integration Name
Cisco ISE [cisco_ise]
### Dataset Name
Profiler
### Integration Version
1.29
### Agent Version
8.18
### Agent Output Type
elasticsearch
### Elasticsearch Version
8.18
### OS Version and Architecture
RHEL9
### Software/API Version
_No response_
### Error Message
Doesnt parse Cisco ISE Profiler Logs
### Event Original
<182>Oct 10 16:55:03 ise CISE_Profiler 0000002339 1 0 2025-10-10 16:55:03.202 +00:00 0328257629 80002 INFO Profiler: Profiler EndPoint profiling event occurred, ConfigVersionId=156, EndpointCertainityMetric=5, EndpointMacAddress=34:6B:F2, EndpointMatchedPolicy=DigiBoard-Device, EndpointNADAddress=192.0.0.0, EndpointOUI=DigiBoard, EndpointPolicy=DigiBoard-Device, EndpointProperty=PolicyVersion=55,EndPointPolicyID=ce0f8b00-9f06-11ef-be6b-005056af69be,LogicalProfile=profdile,AuthenticationMethod=Lookup,FirstCollection=1760115303174,CacheUpdateTime=1760115303199,StaticAssignment=false,User-Name=00409d346bf2,NmapScanCount=0,NetworkDeviceName=location,DestinationIPAddress=192.0.0.0,AAA-Server=ise,MessageCode=5400,Device Type=Device Type#All Device Types#SWITCH,PortalUser=,AllowedProtocolMatchedRule=Default,BYODRegistration=Unknown,Calling-Station-ID=4-6B-F2,FailureReason=15039 Rejected per authorization profile,Total Certainty Factor=5,IdentityGroupID=aa10ae00-896c-525400b48521,PostureApplicable=Yes,NmapSubnetScanID=0t-Type=Ethernet,TimeToProfile=21,DeviceRegistrationStatus=NotRegistered,MatchedPolicyID=cef06-11ef-be6b-005056af69be,SSID=0C,UserName=00,FeedService=false,UseCase=Host Lookup,SelectedAuthorizationProfiles=DenyAccess,StaticGroupAssignment=false,NAS-Port-Id=GigabitEthernet2,DTLSSupport=Unknown,LastActivity=1760115303174,Response={RadiusPacketType=AccessReject; AuthenticationResult=UnknownUser; },LastNmapScanTime=0,UpdateTime=0,AuthorizationPolicyMatchedRule=Default,Location=Location, EndpointSourceEvent=RADIUS Probe, EndpointIdentityGroup=Profiled, ProfilerServer=com
### What did you do?
Doesnt parse
### What did you see?
nothing
### What did you expect to see?
Parsed Logs
### Anything else?
no
Contributor guide
Assessment
This issue has not been assessed yet.