elastic · haetamoudi · May 13, 2026 · May 12, 2026 · May 12, 2026 · May 12, 2026
@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.32.4"
+  changes:
+    - description: Handle the values of top-level keys under cisco-av-pair as a scalar mapped to a keyword field. Maintain separate process for mdm-tlv as it can contain sub-keys.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/18964
 - version: "1.32.3"
   changes:
     - description: Handle non-IP Remote-Address values in TACACS accounting logs without pipeline errors.

@@ -3,3 +3,4 @@
 <181>Feb 23 21:44:54 cisco-ise-host CISE_Passed_Authentications 0000000028 1 0 2021-02-23 21:44:54.276 +00:00 0000001707 5233 NOTICE Passed-Authentication: TrustSec Data Download Succeeded, ConfigVersionId=9, Device IP Address=81.2.69.144, DestinationIPAddress=81.2.69.144, DestinationPort=1645, UserName=#CTSREQUEST#, Protocol=Radius, RequestLatency=281, NetworkDeviceName=ASAv-vpn, User-Name=#CTSREQUEST#, NAS-IP-Address=81.2.69.144, NAS-Port=2, NAS-Port-Type=Virtual, cisco-av-pair=cts-environment-version=1, cisco-av-pair=cts-environment-data=ASAv-vpn, cisco-av-pair=cts-device-capability=env-data-fragment, cisco-av-pair=cts-pac-opaque=****, cisco-av-pair=coa-push=true, NetworkDeviceProfileName=Cisco, NetworkDeviceProfileId=8ade1f15-aef1-4a9a-8158-d02e835179db, IsThirdPartyDeviceFlow=false, AcsSessionID=ise/403491114/1, SelectedAccessService=NDAC_SGT_Service, Step=11001, Step=11017, Step=11117, Step=15012, Step=15036, Step=15006, Step=11002, NetworkDeviceGroups=Location#All Locations#dCloud, NetworkDeviceGroups=Device Type#All Device Types#Security Devices#VPN, AuthorizationPolicyMatchedRule=Default, CPMSessionID=c612851bJ4_5zUNfXSy7PCu6hSY3K1tPzLJOLXwVfJMIFdTrUjg, ISEPolicySetName=NetworkDeviceAuthorization, DTLSSupport=Unknown, Network Device Profile=Cisco, Location=Location#All Locations#dCloud, Device Type=Device Type#All Device Types#Security Devices#VPN, Response={Class=CACS:c612851bJ4_5zUNfXSy7PCu6hSY3K1tPzLJOLXwVfJMIFdTrUjg:ise/403491114/1; cisco-av-pair=cts:server-list=CTSServerList1-0001; cisco-av-pair=cts:security-group-tag=0002-11; cisco-av-pair=cts:environment-data-expiry=86400; cisco-av-pair=cts:security-group-table=0001-46; },
 <181>Mar 3 09:11:58 cisco-ise-host CISE_Passed_Authentications 0000082517 1 0 2022-03-03 09:11:58.729 +00:00 0000082584 5239 NOTICE RADIUS: NAS problem was fixed, ConfigVersionId=1626, NAS-IP-Address=81.2.69.145, MisconfiguredClientFixReason=Silent, Step=5239,
 <181>Mar 3 09:11:58 cisco-ise-host CISE_Passed_Authentications 0000082517 1 0 2025-03-03 09:11:58.840 -07:00 0429868068 5200 NOTICE Passed-Authentication: Authentication succeeded, ConfigVersionId=509, Device IP Address=81.2.69.144, DestinationIPAddress=81.2.69.145, DestinationPort=1645, UserName=user1, Protocol=Radius, NetworkDeviceName=ASA_Firewalls, User-Name=user1, NAS-IP-Address=81.2.69.145, NAS-Port=216199168, Called-Station-ID=81.2.69.148, Calling-Station-ID=81.2.69.145, NAS-Port-Type=Virtual, Tunnel-Client-Endpoint=(tag=0) 81.2.69.145, cisco-av-pair=mdm-tlv=device-platform=win, cisco-av-pair=mdm-tlv=computer-name=User1, cisco-av-pair=mdm-tlv=device-mac=04-68-74-a2-c2-67, cisco-av-pair=mdm-tlv=device-platform-version=10.0.26100 , cisco-av-pair=mdm-tlv=device-public-mac=04-68-74-a2-c2-67, cisco-av-pair=mdm-tlv=ac-user-agent=AnyConnect Windows 5.1.10.233, cisco-av-pair=mdm-tlv=device-uid-global=2897F9C5734F41A03F0E89064463F6FAB5EEDBF1, cisco-av-pair=mdm-tlv=device-type=ACME COMPUTER, cisco-av-pair=mdm-tlv=device-uid=E835E862F6A2CE17C35D570B4746B86F9CFE9BCAD0824F872BA61C3F6F5682C1, cisco-av-pair=audit-session-id=984ffaf10ce2f00068ec8408, cisco-av-pair=coa-push=true, CVPN3000/ASA/PIX7x-Tunnel-Group-Name=RA_VPN, OriginalUserName=user1, NetworkDeviceProfileName=Cisco, NetworkDeviceProfileId=b0699505-3150-4215-a80e-6753d45bf56c, IsThirdPartyDeviceFlow=false, SSID=81.2.69.148, CVPN3000/ASA/PIX7x-Client-Type=2, AcsSessionID=lxprdisepsn04/543883580/12648582, AuthenticationIdentityStore=Duo_Radius, AuthenticationMethod=PAP_ASCII, SelectedAccessService=Default Network Access, SelectedAuthorizationProfiles=VPN full access, IsMachineAuthentication=false, RequestLatency=4302, IdentityGroup=Endpoint Identity Groups:Profiled:Windows11-Workstation, Step=11001, Step=11017, Step=15049, Step=15008, Step=15048, Step=15048, Step=15048, Step=15048, Step=15048, Step=15048, Step=15041, Step=22072, Step=15013, Step=24210, Step=24216, Step=15013, Step=24634, Step=24636, Step=24609, Step=11100, Step=11101, Step=24612, Step=24623, Step=24641, Step=22037, Step=15057, Step=24715, Step=15036, Step=24209, Step=24211, Step=24432, Step=24325, Step=24313, Step=24319, Step=24367, Step=24367, Step=24323, Step=24355, Step=24416, Step=15048, Step=15048, Step=15016, Step=22081, Step=22080, Step=11002, SelectedAuthenticationIdentityStores=Internal Users, SelectedAuthenticationIdentityStores=Duo_Radius, AuthenticationStatus=AuthenticationPassed, NetworkDeviceGroups=Location#All Locations#Example Campus, NetworkDeviceGroups=Device Type#All Device Types#ASA Firewalls, NetworkDeviceGroups=IPSEC#Is IPSEC Device#No, NetworkDeviceGroups=DNAC#DNAC Devices, IdentityPolicyMatchedRule=Default, AuthorizationPolicyMatchedRule=RemoteAllowedMFA, cisco-av-pair=AuthenticationIdentityStore=Duo_Radius, CPMSessionID=984ffaf10ce2f00068ec8408, PostureAssessmentStatus=NotApplicable, EndPointMatchedProfile=Windows11-Workstation, ISEPolicySetName=Remote Access VPN Policy, IdentitySelectionMatchedRule=Default, StepLatency=1=0\\;2=1\\;3=0\\;4=0\\;5=1\\;6=0\\;7=0\\;8=5\\;9=6\\;10=0\\;11=1\\;12=0\\;13=0\\;14=2\\;15=0\\;16=0\\;17=0\\;18=0\\;19=0\\;20=4259\\;21=1\\;22=0\\;23=0\\;24=0\\;25=0\\;26=5\\;27=0\\;28=0\\;29=4\\;39=9\\;40=7\\;41=0\\;42=1\\;43=0\\;44=1, AD-User-Resolved-Identities=user1@example.com, AD-User-Join-Point=example.com, StepData=4= Wlan-Id, StepData=5= Radius.Called-Station-ID, StepData=6= DEVICE.Device Type, StepData=7= Network Access.Protocol, StepData=8= Network Condition.Wireless Controllers, StepData=9= Network Condition.ASA VPN, StepData=11=EXPL_auth_order_DUO, StepData=12=Internal Users, StepData=15=Duo_Radius, StepData=16=Duo_Radius, StepData=17=Duo_Radius, StepData=18=Duo_Radius, StepData=19=( port = 1812 ), StepData=0=AD1, StepData=1=user1, StepData=2=example.com, StepData=3=example.com, StepData=4=aws.example.com\\,Domain trust is one-way, StepData=5=example.com\\,Domain trust is one-way, StepData=7=example.com, StepData=8=AD1, StepData=39= AD1.ExternalGroups, StepData=40= Network Condition.ASA VPN, TotalAuthenLatency=4302, ClientLatency=0, AD-User-Resolved-DNs=CN=User1 \\,OU=New Users\\,OU=PEOPLE\\,DC=Example\\,DC=com, AD-User-DNS-Domain=example.com, AD-Groups-Names=example.com/Groups/NetOpsGroups/WirelessAllowed, AD-Groups-Names=example.com/Groups/NetOpsGroups/RemoteAllowedMFA, AD-User-NetBios-Name=user1, AD-User-SamAccount-Name=user1, allowEasyWiredSession=false, DTLSSupport=Unknown, EndPointIPAddress=81.2.69.145, HostIdentityGroup=Endpoint Identity Groups:Profiled:Windows11-Workstation, ExternalGroups=S-1-5-21-1-2-3-4, ExternalGroups=S-1-5-21-1-2-3-4, Model Name=Unknown, Software Version=Unknown, Network Device Profile=Cisco, Location=Location#All Locations#Example, Device Type=Device Type#All Device Types#ASA Firewalls, IPSEC=IPSEC#Is IPSEC Device#No, DNAC=DNAC#DNAC Devices, ASA VPN=true, Response={Class=CACS:984ffaf10ce2f00068ec8408:lxprdisepsn04/543883580/12648582; cisco-av-pair=profile-name=Windows11-Workstation; LicenseTypes=1; },
+<181>Apr 30 09:11:25 cisco-ise-host CISE_Passed_Authentications 0000008856 1 0 2026-04-30 09:11:25.367 +00:00 0000781727 5200 NOTICE Passed-Authentication: Authentication succeeded, ConfigVersionId=11, UserName=92-09-00-00-00-01, cisco-av-pair=FQSubjectName=111-222-aaa-bbb-123456abc=abc123,ou=488-test,ou=org-sgn,ou=wireless,dc=example,dc=int#00-aa-bb-cc-dd-ee, NetworkDeviceProfileName=Cisco,
@@ -903,6 +903,83 @@
                     "user1"
                 ]
             }
+        },
+        {
+            "@timestamp": "2026-04-30T09:11:25.367Z",
+            "cisco_ise": {
+                "log": {
+                    "category": {
+                        "name": "CISE_Passed_Authentications"
+                    },
+                    "cisco_av_pair": {
+                        "FQSubjectName": "111-222-aaa-bbb-123456abc=abc123,ou=488-test,ou=org-sgn,ou=wireless,dc=example,dc=int#00-aa-bb-cc-dd-ee"
+                    },
+                    "config_version": {
+                        "id": 11
+                    },
+                    "message": {
+                        "code": "5200",
+                        "description": "Passed-Authentication: Authentication succeeded",
+                        "id": "0000008856"
+                    },
+                    "network": {
+                        "device": {
+                            "profile_name": "Cisco"
+                        }
+                    },
+                    "segment": {
+                        "number": 0,
+                        "total": 1
+                    }
+                }
+            },
+            "ecs": {
+                "version": "8.17.0"
+            },
+            "event": {
+                "action": "passed-authentication",
+                "category": [
+                    "authentication"
+                ],
+                "code": "5200",
+                "kind": "event",
+                "original": "<181>Apr 30 09:11:25 cisco-ise-host CISE_Passed_Authentications 0000008856 1 0 2026-04-30 09:11:25.367 +00:00 0000781727 5200 NOTICE Passed-Authentication: Authentication succeeded, ConfigVersionId=11, UserName=92-09-00-00-00-01, cisco-av-pair=FQSubjectName=111-222-aaa-bbb-123456abc=abc123,ou=488-test,ou=org-sgn,ou=wireless,dc=example,dc=int#00-aa-bb-cc-dd-ee, NetworkDeviceProfileName=Cisco,",
+                "outcome": "success",
+                "sequence": 781727,
+                "timezone": "+00:00",
+                "type": [
+                    "info"
+                ]
+            },
+            "host": {
+                "hostname": "cisco-ise-host"
+            },
+            "log": {
+                "level": "notice",
+                "syslog": {
+                    "priority": 181,
+                    "severity": {
+                        "name": "notice"
+                    }
+                }
+            },
+            "message": "2026-04-30 09:11:25.367 +00:00 0000781727 5200 NOTICE Passed-Authentication: Authentication succeeded, ConfigVersionId=11, UserName=92-09-00-00-00-01, cisco-av-pair=FQSubjectName=111-222-aaa-bbb-123456abc=abc123,ou=488-test,ou=org-sgn,ou=wireless,dc=example,dc=int#00-aa-bb-cc-dd-ee, NetworkDeviceProfileName=Cisco,",
+            "related": {
+                "hosts": [
+                    "cisco-ise-host"
+                ],
+                "user": [
+                    "92-09-00-00-00-01"
+                ]
+            },
+            "tags": [
+                "preserve_original_event"
+            ],
+            "user": {
+                "name": [
+                    "92-09-00-00-00-01"
+                ]
+            }
         }
     ]
 }
@@ -171,14 +171,30 @@ processors:
 
         def attributes = [:];
         ctx.cisco_ise.log.log_details.get("cisco-av-pair")?.forEach((v) -> {
+          def firstEq = v.indexOf('=');
+          if (firstEq <= 0) {
+            return true;
+          }
+          def topKey = v.substring(0, firstEq).trim();
+          def rest = v.substring(firstEq + 1);
+
+          // Only mdm-tlv uses nested subkeys (device-platform=win, ...). Other pairs
+          // (e.g. FQSubjectName=...cn=...,ou=...) may contain '=' in the value and must stay scalar.
+          if (!"mdm-tlv".equals(topKey)) {
+            attributes[topKey] = rest.trim();
+            return true;
+          }
+
           def inEscape = false;
           def start = 0;
           def key = "";
-          def m = attributes;
+          if (!attributes.containsKey("mdm-tlv")) {
+            attributes["mdm-tlv"] = [:];
+          }
+          def m = attributes["mdm-tlv"];
 
-          for (def i = 0, n = v.length(); i < n; ++i) {
-            def c = v.charAt(i);
-            // Escape handling.
+          for (def i = 0, n = rest.length(); i < n; ++i) {
+            def c = rest.charAt(i);
             if (inEscape) {
               inEscape = false;
               continue;
@@ -189,9 +205,9 @@ processors:
             }
 
             if (c == (char)'=') {
-              key = v.substring(start, i).trim();
-              def nextSplit = v.indexOf("=", i + 1);
-              if (nextSplit != -1 && v.charAt(nextSplit - 1) != (char)'\\') {
+              key = rest.substring(start, i).trim();
+              def nextSplit = rest.indexOf("=", i + 1);
+              if (nextSplit != -1 && rest.charAt(nextSplit - 1) != (char)'\\') {
                 if (!m.containsKey(key)) {
                   m[key] = [:];
                 }
@@ -200,7 +216,7 @@ processors:
               start = i + 1;
             }
             if (i == n - 1) {
-              m[key] = v.substring(start, n).trim();
+              m[key] = rest.substring(start, n).trim();
             }
           }
 

@@ -243,6 +243,8 @@
           type: keyword
         - name: device-uid-global
           type: keyword
+        - name: FQSubjectName
+          type: keyword
         - name: mdm-tlv
           type: group
           fields:

@@ -423,6 +423,7 @@ The following table lists the exported fields for this data stream:
 | cisco_ise.log.category.name |  | keyword |
 | cisco_ise.log.cause |  | keyword |
 | cisco_ise.log.cisco_av_pair.AuthenticationIdentityStore |  | keyword |
+| cisco_ise.log.cisco_av_pair.FQSubjectName |  | keyword |
 | cisco_ise.log.cisco_av_pair.audit-session-id |  | keyword |
 | cisco_ise.log.cisco_av_pair.coa-push |  | boolean |
 | cisco_ise.log.cisco_av_pair.cts-device-capability |  | keyword |

@@ -1,7 +1,7 @@
 format_version: "3.0.3"
 name: cisco_ise
 title: Cisco ISE
-version: "1.32.3"
+version: "1.32.4"
 description: Collect logs from Cisco ISE with Elastic Agent.
 type: integration
 categories: