All Apps and Add-ons

Cisco ISe add-on is not CIM compliant


I'm facing two issues because of lack proper support for CIM compliance.

1) Field user is not properly extracted. App provides two aliases for fields User_Name and UserName. But I found also fields: User and AdminUser.
2) At the moment I'm observing a lot of action = unknown (on datamodel level) for the events with FailureReason="13017 Received TACACS+ packet from unknown Network Device or AAA Client". I think it should be marked with action = failure.

Jul 31 14:59:44 HOSTNAME CISE_Failed_Attempts 0000109068 1 0 2019-07-31 14:59:44.687 +09:00 0000518034 5406 NOTICE Failed-Attempt: TACACS+ Request dropped, ConfigVersionId=1054, Device IP Address=dead::beef, Device Port=58388, DestinationIPAddress=dead:beef::2, DestinationPort=49, Protocol=Tacacs, FailureReason=13017 Received TACACS+ packet from unknown Network Device or AAA Client, Step=13017, 
0 Karma
Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...