We've reorganized our documentation navigation structure to align directly with your operational workflows. See the release notes and the walkthrough video for more information.

Change log for CISCO_ACS

Date	Changes
2026-06-18	Enhancement: - `event.idm.read_only_udm.additional.fields`: Newly mapped `NAS-Identifier`, `cribl_pipe`, `event_data.created`, `_time`, `@timestamp`, `organization.name`, `organization.id` and `kafkaTopic` raw log fields with `event.idm.read_only_udm.additional.fields` UDM field. - `event.idm.read_only_udm.network.session_id`: Newly mapped `AcsSessionID` raw log field with `event.idm.read_only_udm.network.session_id` UDM field when `audit_session_id` field is not present. - `event.idm.read_only_udm.metadata.product_version`: Newly mapped `@version` raw log field with `event.idm.read_only_udm.metadata.product_version` UDM field when `product_version` field is not present. - `event.idm.read_only_udm.target.ip` and `event.idm.read_only_udm.target.asset.ip`: Mapped `NAS-IP-Address` raw log field with `event.idm.read_only_udm.target.ip` and `event.idm.read_only_udm.target.asset.ip` UDM field for all events.
2026-05-07	Enhancement: - Modified a grok pattern to parse the new raw logs. - Added support for the event `CisACS_02_FailedAuth` and relevant corresponding raw log fields. - Added support for the event `CisACS_05_TACACSAdmin` and relevant corresponding raw log fields. - `event.idm.read_only_udm.principal.hostname` and `event.idm.read_only_udm.principal.asset.hostname`: Removed mapping of `hostname` from `event.idm.read_only_udm.principal.hostname` and `event.idm.read_only_udm.principal.asset.hostname` UDM fields as this is a syslog header it should be mapped to `event.idm.read_only_udm.intermediary.hostname` and `event.idm.read_only_udm.intermediary.asset.hostname` UDM fields. - `event.idm.read_only_udm.intermediary.hostname` and `event.idm.read_only_udm.intermediary.asset.hostname`: Mapped `hostname` raw log field with `event.idm.read_only_udm.intermediary.hostname` and `event.idm.read_only_udm.intermediary.asset.hostname` UDM fields. - `event.idm.read_only_udm.intermediary.ip` and `event.idm.read_only_udm.intermediary.asset.ip`: Mapped `hostname` raw log field with `event.idm.read_only_udm.intermediary.ip` and `event.idm.read_only_udm.intermediary.asset.ip` UDM fields if the `hostname` is an IP address. - `event.idm.read_only_udm.target.ip` and `event.idm.read_only_udm.target.asset.ip`: Mapped `kv.NAS-IP-Address` raw log field with `event.idm.read_only_udm.target.ip` and `event.idm.read_only_udm.target.asset.ip` UDM field - `event.idm.read_only_udm.principal.asset.ip`: Mapped `kv.source_ip` raw log field with `event.idm.read_only_udm.principal.asset.ip` UDM field - `event.idm.read_only_udm.target.asset.hostname`: Mapped `kv.NetworkDeviceName` raw log field with `event.idm.read_only_udm.target.asset.hostname` UDM field - `event.idm.read_only_udm.target.asset.ip`: Mapped `kv.Remote-Address` raw log field with `event.idm.read_only_udm.target.asset.ip` UDM field - `event.idm.read_only_udm.principal.asset.ip`: Mapped `kv.DeviceIPAddress` raw log field with `event.idm.read_only_udm.principal.asset.ip` UDM field - `event.idm.read_only_udm.principal.asset.ip`: Mapped `kv.AD-IP-Address` raw log field with `event.idm.read_only_udm.principal.asset.ip` UDM field - `event.idm.read_only_udm.principal.asset.ip`: Mapped `kv.Framed-IP-Address` raw log field with `event.idm.read_only_udm.principal.asset.ip` UDM field - `event.idm.read_only_udm.principal.ip` and `event.idm.read_only_udm.principal.asset.ip`: Newly mapped `kv.Caller-Id` raw log field with `event.idm.read_only_udm.principal.ip` and `event.idm.read_only_udm.principal.asset.ip` UDM field. - `event.idm.read_only_udm.principal.group.group_display_name`: Newly mapped `kv.Group-Name` raw log field with `event.idm.read_only_udm.principal.group.group_display_name` UDM field. - `event.idm.read_only_udm.network.session_id`: Newly mapped `kv.Session ID` raw log field with `event.idm.read_only_udm.network.session_id` UDM field. - `event.idm.read_only_udm.security_result.detection_fields`: Newly mapped `kv.FailureReason`, `kv.IdentityPolicyMatchedRule` raw log fields with `event.idm.read_only_udm.security_result.detection_fields` UDM field. - `event.idm.read_only_udm.security_result.rule_name`: Newly mapped `kv.ServiceSelectionMatchedRule` raw log field with `event.idm.read_only_udm.security_result.rule_name` UDM field. - `event.idm.read_only_udm.principal.process.command_line`: Newly mapped `kv.cmd` raw log field with `event.idm.read_only_udm.principal.process.command_line` UDM field. - `event.idm.read_only_udm.additional.fields`: Newly mapped `kv.Network Device Group`, `kv.Access Device`, `kv.Priv-lvl`, `kv.Network Access Profile Name`, `kv.Authen-Failure-Code`, `kv.Message-Type`, `kv.Privilege-Level`, `kv.Authen-Type`, `kv.Service`, `kv.Port`, `kv.NAS-Portname`, `kv.service`, `kv.priv-lvl`, `kv.task_id`, `kv.Acct-Flags`, `kv.Acct-Method`, `kv.Acct-Type`, `kv.Acct-Service`, `kv.timezone`, `kv.AAA Server`, `kv.start_time`, `steps`, `kv.NetworkDeviceGroups` raw log fields with `event.idm.read_only_udm.additional.fields` UDM field. - `event.idm.read_only_udm.metadata.event_type`: - If target machine data is present AND network dns data is present, set `event.idm.read_only_udm.metadata.event_type` to `NETWORK_DNS`. - If `log_type` is `CSCOacs_Passed_Authentications` OR `CSCOacs_Failed_Attempts` AND target machine AND target user data is present, set `event.idm.read_only_udm.metadata.event_type` to `USER_LOGIN`. - If principal machine AND target machine data is present, set `event.idm.read_only_udm.metadata.event_type` to `NETWORK_CONNECTION`. - If `log_type` is CSCOacs_System_Statistics and principal machine data is present, set `event.idm.read_only_udm.metadata.event_type` to `STATUS_UNCATEGORIZED`. - If principal machine data is present, set `event.idm.read_only_udm.metadata.event_type` to `STATUS_UPDATE`. - If user data is present, set `event.idm.read_only_udm.metadata.event_type` to `USER_UNCATEGORIZED`. - Else, set `event.idm.read_only_udm.metadata.event_type` to `GENERIC_EVENT`.
2024-11-14	Enhancement: - Added support to parse unparsed logs.
2023-09-26	Enhancement - - Initialized `hostname` to null and added a hostname not null check prior setting `metadata.event_type` to `STATUS_UPDATE`. - Added a valid IP address check to `kv.DeviceIPAddress`, `kv.Remote-Address` prior to mapping to UDM fields.
2022-08-19	Enhancement - -Mapped `User-Name` to `principal.user.userid`. -Renamed ip:source-ip `to` source_ip `and Mapped it to` principal.ip". -Renamed `kv.audit-session-id` to `kv.audit_session_id` and Mapped it to `network.session_id`. -Mapped `kv.AuthenticationMethod` to `additional.fields`. -Mapped `kv.SelectedAccessService` to `additional.fields`. -Mapped `kv.SelectedAuthorizationProfiles` to `security_result.detection_fields`. -Mapped `kv.SelectedAuthenticationIdentityStores` to `security_result.detection_fields`. -Mapped `kv.device-uid-global` to `principal.asset.product_object_id`. -Mapped `kv.device-uid` to `principal.asset.asset_id`. -Mapped `metadata.event_type` to `USER_UNCATEGORIZED` where kv.DestinationIPAddress and kv.NAS-IP-Address and kv.NAS-IP-Address and kv.UserName and kv.NetworkDeviceName is null. -Added support for logs with LEEF format.
2022-06-14	Enhancement - Modified grok to parse logs of log_type = `CSCOacs_Passed_Authentications` which were failing due to multiple spaces. - Replaced the value of `device-mac` with the dummy value of `00:00:00:00:00:00` for logtype `CSCOacs_RADIUS_Accounting` in case of invalid value (00).
2022-06-06	Enhancement - Parsed logs of type `CSCOacs_Passed_Authentications` that doesn't have either of `DestinationIPAddress` or `NAS-IP-Address` present in the logs. - Modified metadata.event_type from `USER_UNCATEGORIZED` to `USER_LOGIN` for logs of type `CSCOacs_Passed_Authentications`
2022-05-05	Enhancement - The newly ingested logs which do not have message code are parsed and dropped.
2022-04-27	Enhancement - Parsed the logs with log_type=CISE_TACACS_Accounting.