<html lang="en">
<body>

	<p>
		<b>[OOTB] Cisco ISE syslog. Version 2</b><br>
		Change list:
		<ul>
			<li>Two new regular expressions have been added to the main normalizer. In the main normalizer, the mapping of the "tag" event field from the KUMA DeviceEventClassID field has been removed. The mapping in the main normalizer has been modified. The "tag" event field from the KUMA DeviceFacility field is mapped to the DeviceProcessName field. The "msg" event field from the KUMA FlexString2 field is mapped to the DestinationRegion field. In the main normalizer, all enrichments with the FlexString2 field have been changed to enrichments with the DestinationRegion field. A regex enrichment with a source field of DestinationRegion and a target field of EventOutcome has been changed to a regex enrichment with a source field of DestinationRegion and a target field of SourceRegion. The replaceWithRegex type enrichment with the DestinationRegion source field and the Reason target field has been changed to a replaceWithRegex type enrichment with the DestinationRegion source field and the DestinationRegion target field. A constant enrichment has been added to the SourceRegion field. The replaceWithRegex type enrichments have been added to the DestinationRegion field. The replaceWithRegex type enrichments have been added to the DestinationUserName field. The replaceWithRegex type enrichments have been added to the DestinationRegion field. The replaceWithRegex type enrichments have been added to the SourceUserName source field and the SourceUserName target field. The replaceWithRegex type enrichment with the DestinationRegion source field and the DestinationRegion target field has been changed to a constant type enrichment with the DestinationRegion target field. The replaceWithRegex type enrichments have been added to the Reason field. The replacewithRegex type enrichment has been removed from the DeviceAction field. Event enrichment have been added to the KUMA feild SourceHostName, DestinationHostName, EventOutcome, DeviceProcessName, DeviceHostName, DestinationUserName, Reason (lower case). Event enrichment have been added to the KUMA feild SourceNtDomain, SourceMacAddress, DestinationMacAddress, DeviceMacAddress (upper case). Event enrichment with go template have been added to the KUMA field DeviceEventClassID, Reason, EventOutcome, DestinationNtDomain, SourceNtDomain, DeviceCustomFloatingPoint1Label, DeviceCustomFloatingPoint2Label, DeviceCustomFloatingPoint3Label, DeviceCustomFloatingPoint4Label, FlexNumber1Label, FlexNumber2Label, DeviceCustomIPv6Address2Label, DeviceCustomIPv6Address3Label, DeviceCustomIPv6Address4Label, DeviceCustomNumber1Label, DeviceCustomNumber2Label, DeviceCustomNumber3Label.</li>
			<li>New extra normalizers have been added: “extraNormalizer Message kv part”, “extraNormalizer CISE_Identity_Stores_Diagnostics”, “extraNormalizer CISE_Posture_and_Client_Provisioning_Audit”, “extraNormalizer CISE_Profiler”, “extraNormalizer CISE_RADIUS_Diagnostics”, “OperationMessageText regex part", "Event 61025", "Event with CN and OU", "Event with Acct-Session-Id", "Event with SSID", "extraNormalizer CISE_TACACS_Accounting Response part", "Event with EapTunnel", "Event with EextraNormalizer CISE_Failed_AttemptsapAuthentication", "extraNormalizer CISE_Identity_Stores_Diagnostics Response part", "extraNormalizer CISE_Licensing", "extraNormalizer CISE_Guest", "extraNormalizer CISE_System_Statistics", "extraNormalizer CISE_Internal_Operations_Diagnostics", "extraNormalizer CISE_MyDevices", "extraNormalizer CISE_TACACS_Diagnostics", "extraNormalizer CISE_Alarm", "extraNormalizer CISE_TACACS_Diagnostics Response part", "extraNormalizer CISE_Internal_Operations_Diagnostics LdapServer part".</li>
			<li>The "message" field transformations have been added to the "extraNormalizer CISE_Administrative_and_Operational_Audit" extra normalizer.</li>
			<li>In the extra normalizers “extraNormalizer CISE_AD_Connector”, “extraNormalizer CISE_Administrative_and_Operational_Audit”, “extraNormalizer CISE_Failed_Attempts”, “extraNormalizer CISE_Passed_Authentications”, “extraNormalizer CISE_RADIUS_Accounting”, “extraNormalizer CISE_TACACS_Accounting” the mapping of the “ConfigVersionId” event field to the KUMA DeviceCustomString1 field has been removed.</li>
			<li>A transformation has been added to the "Response" event field in the "extraNormalizer CISE_Administrative_and_Operational_Audit" extra normalizer. A replaceWithRegex transformation has been added to the "Calling-Station-ID" event field.</li>
			<li>The mapping in the extra normalizer "extraNormalizer CISE_Administrative_and_Operational_Audit" the mapping has been changed. The event field "PeerAddress" was mapped to the KUMA SourceMacAddress field. The event field "PeerName" was mapped to the KUMA FlexString1 field. The event field "UniqueConnectionIdentifier" was mapped to the KUMA DeviceExternalID field. The event field "ShutdownReason" was mapped to the KUMA Reason field. The event field "UserName" was mapped to the KUMA DestinationUserName field. The event field "FailureFlag" has been mapped from the KUMA DeviceCustomString5 field to the FlexString2 field.</li>
			<li>The "message" field transformation has been added to the "extraNormalizer CISE_AD_Connector" extra normalizer.</li>
			<li>In the extra normalizer  "extraNormalizer CISE_AD_Connector" mapping was changed. The "AD-Domain-Controller" event field was mapped to the KUMA DeviceCustomString4 field. The "AD-Site" event field was mapped to the KUMA FlexString1 field. The "AD-Log-Id" event field was mapped to the DeviceExternalID field. The "AD-Srv-Query" event field was mapped to the DeviceCustomString3 field. The "Records" event field was mapped to the FlexString2 field.</li>
			<li>A trim type transformation has been added to the mapping of the "extraNormalizer CISE_AD_Connector" extra normalizer for the "Response" event field. A replaceWithRegex type transformation has been added to the "Calling-Station-ID" event field.</li>
			<li>Enrichments with go template have been added to the extra normalizer "extraNormalizer CISE_AD_Connector" to the fields DestinationHostName, DeviceCustomString4, DeviceCustomString4Label.</li>
			<li>Transformations of the message field have been added to the extra normalizer "extraNormalizer CISE_Failed_Attempts".</li>
			<li>In the extra normalizer "extraNormalizer CISE_Failed_Attempts" the pair separator has been changed from the "," symbol to "|".</li>
			<li>In the extra normalizer "extraNormalizer CISE_Failed_Attempts" the mapping of the "NAS-Port" event field to the KUMA SourceTranslatedPort field has been removed. The "Calling-Station-ID" event field has been mapped to the KUMA SourceAddress field. The "Device Type" event field has been mapped to the KUMA DeviceCustomString2 field.</li>
			<li>In the extra normalizer "extraNormalizer CISE_Failed_Attempts" the mapping has been changed. The "Device IP Address" event field was mapped from the KUMA DestinationTranslatedAddress field to the DeviceAddress field. The "Device Port" event field was mapped from the KUMA DevicveCustomNumber3 field to the FlexNumber1 field. The "FailureReason" event field was mapped from the KUMA OldFileName field to the Reason field. The "RadiusPacketType" event field was mapped from the KUMA DeviceCustomString6 field to the FileType field. The "CPMSessionID" event field was mapped from the KUMA DeviceCustomNumber5 field to the DeviceExternalID field. The "NAS-IP-Address" event field was mapped from the KUMA DestinationAddress field to the DestinationTranslatedAddress field. The "Called-Station-ID" event field was mapped from the KUMA DestinationAddress field to the DestinationMacAddress field. The "NAS-Port" event field was mapped from the KUMA DeviceCustomNumber2 field to the FlexNumber2 field.</li>
			<li>In the extra normalizer "extraNormalizer CISE_Failed_Attempts"  the mapping has been changed. The event field "OpenSSLErrorMessage" was mapped to the KUMA Message field. The event field "Tunnel-Medium-Type" was mapped to the KUMA DeviceFloatingPoint3 field. The event field "Tunnel-Private-Group-ID" was mapped to the KUMA DeviceFloatingPoint4 field. The event field "ISEPolicySetName" was mapped to the KUMA DeviceCustomString4 field. The event field "RequestLatency" was mapped to the KUMA DeviceFloatingPoint1 field. The event field "ClientLatency" was mapped to the KUMA DeviceFloatingPoint2 field. The event field "OpenSSLErrorStack" was mapped to the KUMA RequestContext field. The "NAS-Port-Id" event field was mapped to the KUMA FlexString1 field. The "NAS-Port-Type" event field was mapped to the KUMA FlexString1Label field. The "NetworkDeviceProfileId" event field was mapped to the KUMA OldFileID field. The "SelectedAccessService" event field was mapped to the KUMA DestinationServiceName field. The "method" event field was mapped to the KUMA FlexString2 field. The "Framed-IP-Address" event field was mapped to the KUMA DeviceCustomIPv6Address1 field. The "NAS-Identifier" event field was mapped to the KUMA OldFileType field. The "TLSCipher" event field was mapped to the KUMA FileHash field. The "Issuer - Country" event field was mapped to the KUMA DestinationCountry field. The "Issuer - Common Name" event field was mapped to the KUMA FileName field. The "AKI" event field was mapped to the KUMA OldFileHash field. The "AD-User-DNS-Domain" event field was mapped to the KUMA DestinationDnsDomain field. The "Acct-Input-Octets" event field was mapped to the KUMA BytesIn field. The "Acct-Output-Octets" event field was mapped to the KUMA BytesOut field. The "Acct-Input-Packets" event field was mapped to the KUMA DeviceCustomNumber1 field. The "Acct-Output-Packets" event field was mapped to the KUMA DeviceCustomNumber2 field. The "addrv6" event field was mapped to the KUMA DeviceCustomIPv6Address2 field.</li>
			<li>In the extra normalizer "extraNormalizer CISE_Failed_Attempts" the replaceWithRegex type conversion has been removed for the source DestinationPort. The prepend type conversion has been removed for the source FailureReason field. A trim type conversion has been added for the source Response field. Prepend type conversions have been added for the source AKI, Issuer - Common Name, NAS-Identifier, NetworkDeviceProfileId, OpenSSLErrorStack, and RadiusPacketType fields. ReplaceWithRegex type conversions have been added for the source FailureReason, Calling-Station-ID, Called-Station-ID, Tunnel-Private-Group-ID, and Tunnel-Medium-Type fields.</li>
			<li>Transformations of the message field have been added to the extra normalizer "extraNormalizer CISE_Passed_Authentications".</li>
			<li>In the extra normalizer "extraNormalizer CISE_Passed_Authentications" the pair separator has been changed from "," to "|".</li>
			<li>The mapping has been changed in the extra normalizer "extraNormalizer CISE_Passed_Authentications". The mapping of the "Calling-Station-ID" event field to the KUMA SourceAddress field has been removed. The mapping of the "Device Type" event field to the KUMA DeviceCustomString2 field has been removed.</li>
			<li>In the extra normalizer "extraNormalizer CISE_Passed_Authentications" the mapping has been changed. The "Device IP Address" event field has been mapped from the KUMA DestinationAddress field to the DeviceAddress field. The "Called-Station-ID" event field has been mapped from the KUMA DestinationAddress field to the DestinationMacAddress field. The "CPMSessionID" event field has been mapped from the KUMA DeviceCustomNumber5 field to the DeviceExternalID field. The "AD-User-Resolved-Identities" event field has been mapped from the KUMA DestinationUserName field to the DestinationUserPrivileges field. The "AD-User-Candidate-Identities" event field has been mapped from the KUMA SourceUserName field to the SourceUserPrivileges field.</li>
			<li>New event field mapping has been added to the extra normalizer "extraNormalizer CISE_Passed_Authentications". The event field "AKI" has been mapped to the KUMA OldFileHash field. The event field "Acct-Session-Id" has been mapped to the KUMA OldFileID field. The event field "ClientLatency" has been mapped to the KUMA DeviceFloatingPoint2 field. The event field "Days to Expiry" has been mapped to the KUMA FlexNumber2 field. The event field "ISEPolicySetName" has been mapped to the  KUMA OldFIleType field. The event field "IdentityGroup" has been mapped to the  KUMA DestinationUserID field. The event field "Issuer - Country" has been mapped to the  KUMA DestinationCountry field. The event field "LicenseTypes" has been mapped to the  KUMA FlexNumber1 field. The event field "RequestLatency" has been mapped to the  KUMA DeviceFloatingPoint1 field. The "SelectedAccessService" event field has been mapped to the  KUMA DestinationServiceName field. The "TLSCipher" event field has been mapped to the KUMA FileHash field. The "Tunnel-Medium-Type" event field has been mapped to the KUMA DeviceCustomFloatingPoint3 field. The "Tunnel-Private-Group-ID" event field has been mapped to the KUMA DeviceCustomFloatingPoint4 field. "User-Name" in the KUMA SourceUserName field. The "UserName" event field in the KUMA DestinationUserName field. The "HostIdentityGroup" event field in the KUMA FileType field. The "NAS-Port-Id" event field in the KUMA FlexString1 field. The "NAS-Port-Type" event field in the KUMA FlexString1Label field. The "Name" event field in the KUMA FileName field. The "url-redirect" event field in the KUMA RequestUrl field. The "method" event field in the KUMA RequestCookies field. The "Framed-IP-Address" event field in the KUMA DeviceCustomIPv6Address1 field. The "ExternalGroups_all" event field in the KUMA RequestContext field. The "Event-Timestamp" event field in the KUMA EndTime field. The "EndPointIPAddress" event field in the KUMA DeviceCustomIPv6Address2 field. The "ac-user-agent" event field in the KUMA RequestClientApplication field. The "device-mac" event field in the KUMA DeviceMacAddress field. The "ip:source-ip" event field in the KUMA SourceAddress field. The "Authen-Method" event field in the KUMA FlexString2 field. The "Remote-Address" event field in the KUMA DeviceCustomIPv6Address3 field. The "CoAReason" event field in the KUMA Reason field. The "AD-Host-DNS-Domain" event field in the KUMA SourceDnsDomain field. The "addrv6" event field in the KUMA DeviceCustomIPv6Address4 field.</li>
			<li>In the "extraNormalizer CISE_Passed_Authentications" extra normalizer, the replaceWithRegex conversion has been removed from the DestinationPort KUMA field. A trim conversion has been added to the "Response" field. A prepend conversion has been added to the "ExternalGroups_all", "Name", "HostIdentityGroup", "IdentityGroup", "ISEPolicySetName", "Acct-Session-Id", and "AKI" event fields. A replcaWithRegex conversion has been added to the "Tunnel-Private-Group-ID", "Tunnel-Medium-Type", "Calling-Station-ID", and "Called-Station-ID" event fields.</li>
			<li>The following enrichments have been added to the "extraNormalizer CISE_Passed_Authentications" extra normalizer: enrichment with go template to the DestinationUserName KUMA field. Enrichment enrichment with go template to the SourceUserName target field. Enrichment with go template to the  DestinationUserPrivileges target field. Enrichment with constant to the SourceUserPrivileges KUMA field. Enrichment with go template to the  FlexString2 KUMA field. Enrichment with  constant to the RequestCookies KUMA field. Enrichment with go template to the  FlexString2Label KUMA field.</li>
			<li>In the extra normalizer "extraNormalizer CISE_RADIUS_Accounting" transformations of the message field have been added.</li>
			<li>In the extra normalizer CISE_RADIUS_Accounting, the mapping has been changed. The "SSID" event field mapping has been removed from the KUMA FileID field. The "Acct-Session-Id" event field mapping has been removed from the KUMA FileID field. The "cisco-av-pair" event field mapping has been removed from the KUMA FileName field. The "Acct-Status-Type" event field mapping has been removed from the KUMA OldFilePath field. The "Calling-Station-ID2" event field mapping has been removed from the KUMA SourceMacAddress field. The "NetworkDeviceGroups" event field mapping has been removed from the KUMA DeviceCustomString6 field.</li>
			<li>In the extra normalizer "extraNormalizer CISE_RADIUS_Accounting", the mapping was changed. The "Device IP Address" event field was mapped from the KUMA DestinationAddress field to the DeviceAddress field. The "CPMSessionID" event field was mapped from the KUMA DeviceCustomNumber5 field to the DeviceExternalID field. The "NAS-Port" event field was mapped from the KUMA DeviceCutomNumber2 field to the FlexNumber2 field. The "Acct-Input-Packets" event field was mapped from the KUMA DeviceInboundInterface field to the DeviceCustomNumber1 field. The "Acct-Output-Packets" event field was mapped from the KUMA DeviceOutboundInterface field to the DeviceCustomNumber2 field.</li>
			<li>In the extra normalizer "extraNormalizer CISE_RADIUS_Accounting", the mapping was changed. The event field "Event-Timestamp" was mapped to the KUMA EndTime field. The event field "NAS-Port-Id" was mapped to the KUMA FlexString1 field. The event field "NAS-Port-Type" was mapped to the KUMA FlexString1Label field. The event field "RequestLatency" was mapped to the KUMA DeviceFloatingPoint1 field. The event field "host-name" was mapped to the KUMA DestinationHostName field. The event field "method" was mapped to the KUMA DeviceCustomString6 field. The event field "Framed-Protocol" was mapped to the KUMA ApplicationProtocol field. The event field "ac-user-agent" was mapped to the KUMA RequestClientApplication field. The "device-mac" event field was mapped to the KUMA DeviceMacAddress field. The "device-uid" event field was mapped to the KUMA FlexString2 field. The "DestinationIPAddress" event field was mapped to the KUMA DestinationAddress field. The "DestinationPort" event field was mapped to the KUMA DestinationPort field. The "Tunnel-Medium-Type" event field was mapped to the KUMA DeviceFloatingPoint3 field. The "Tunnel-Private-Group-ID" event field was mapped to the KUMA DeviceFloatingPoint4 field. The "ClientLatency" event field was mapped to the KUMA DeviceFloatingPoint2 field. The "UserName" event field was mapped to the KUMA SourceUserName field. The "Acct-Terminate-Cause" event field was mapped to the KUMA Reason field. The "Airespace-Wlan-Id" event field was mapped to the KUMA FlexNumber1 field. The "Framed-IPv6-Address" event field was mapped to the KUMA DeviceCustomIPv6Address1 field. The "addrv6" event field was mapped to the KUMA DeviceCustomIPv6Address2 field.</li>
			<li>In the extra normalizer "CISE_RADIUS_Accounting," a trim type transformation has been added to the "Response" evet field. The prepend type transformation has been removed from the "Acct-Output-Packets" and "Acct-Input-Packets" event fields. The reaplaceWithRegex type transformation for the "Calling-Station-ID" event field has been changed. The reaplaceWithRegex type transformation for the "Called-Station-ID" event field has been changed.</li>
			<li>Transformations of the message field have been added to the extra normalizer "extraNormalizer CISE_TACACS_Accounting".</li>
			<li>The mapping has been changed in the "extraNormalizer CISE_TACACS_Accounting" extra normalizer. The mapping for the "Device Type" event field has been removed from the KUMA DeviceCustomString2 field.</li>
			<li>The mapping has been changed in the "extraNormalizer CISE_TACACS_Accounting" extra normalizer. The mapping for the "CmdSet" event field has been changed from the KUMA DeviceCustomString3 field to the DeviceCustomString4 field.</li>
			<li>In the extra normalizer "extraNormalizer CISE_TACACS_Accounting", the mapping was changed. The "User" event field was mapped to the KUMA DestinationUserName field. The "AcsSessionID" event field was mapped to the KUMA DeviceCustomString3 field. The "Authen-Method" event field was mapped to the KUMA FlexString1 field. The "CPMSessionID" event field was mapped to the KUMA DeviceExternalID field. The "Device IP Address" event field was mapped to the KUMA DeviceAddress field. The "Network Device Profile" event field was mapped to the KUMA FlexString2 field. The "Remote-Address" event field was mapped to the KUMA DeviceCustomIPv6Address1 field. The "SelectedAccessService" event field was mapped to the KUMA DestinationServiceName field. The "NetworkDeviceName" event field was mapped to the KUMA FileName field. The "Privilege-Level" event field was mapped to the KUMA DestinationUserPrivileges field. The "Service" event field was mapped to the KUMA SourceServiceName field. The "Service-Argument" event field was mapped to the KUMA RequestCookies field. The "Type" event field was mapped to the KUMA FileType field. The "start_time" event field was mapped to the KUMA StartTime field. The "timezone" event field was mapped to the KUMA DeviceTimeZone field. The "task_id" event field was mapped to the KUMA DeviceCustomNumber1 field. The "Protocol-Argument" event field was mapped to the KUMA ApplicationProtocol field. The "stop_time" event field was mapped to the KUMA EndTime field. The "Location" event field was mapped to the KUMA RequestContext field. The "Port" event field was mapped to the KUMA FlexNumber2Label field. The "RequestLatency" event field was mapped to the KUMA DeviceFloatingPoint1 field. The "ClientLatency" event field was mapped to the KUMA DeviceFloatingPoint2 field. The "priv-lvl" event field was mapped to the KUMA SourceUserPrivileges field. The "disc-cause-ext" event field was mapped to the KUMA DeviceFloatingPoint4 field.</li>
			<li>The "extraNormalizer CISE_TACACS_Accounting" extra normalizer now includes a trim transformation for the "Response" and "CmdSet" event fields. A replaceWithRegex transformation has been added for the "Calling-Station-ID" event field.</li>
			<li>The "extraNormalizer CISE_TACACS_Accounting" extra normalizer has been modified. A replace type conversion has been added to the "NetworkDeviceGroups_all" event field.</li>
			<li>The "extraNormalizer CISE_TACACS_Accounting" extra normalizer has been updated with the following enrichments: replaceWithRegex enrichment in the FlexNumber2 field. ReplaceWithRegex and prepend enrichments in the FlexNumber2Label field.</li>
			<li>In the extra normalizers "extraNormalizer CISE_RADIUS_Accounting", "extraNormalizer CISE_Failed_Attempts", "extraNormalizer CISE_Passed_Authentications" the enrichment to the FlexString1Label KUMA field with go template has been added.</li>
			<li>In the dictionary "[OOTB] Cisco ISE Message Codes" the values of the following keys have been changed: 11111, 11227, 22051, 24100, 24101, 24102, 24428, 24447, 24539, 24540, 24541, 24542, 24543, 24551, 33212, 41037, 41044, 60082.</li>
			<li>1503 new keys and values have been added to the «[OOTB] Cisco ISE Message Codes» dictionary.</li>
		</ul>
	</p>

	<p>
		<b>[OOTB] Cisco ISE syslog. Version 1</b><br>
		This is the first version of the package. 
	</p>

</body>
</html>