[cisco.ise]: Pipeline failed to set event.category #18153

Integration Name

Cisco ISE [cisco_ise]

Dataset Name

cisco_ise.log

Integration Version

1.25.0

Agent Version

syslog agent

Agent Output Type

logstash

Elasticsearch Version

v 8.19.11

OS Version and Architecture

Linux, Kubernetes

Software/API Version

Na

Error Message

The Cisco ISE ingestion pipeline failed to set event.category for few set of logs with cisco_ise.log.category.name set to [CISE_Passed_Authentications, CISE_Failed_Attempts]. As per elastic document, it have been mentioned that event.category is one of the always required field.

https://www.elastic.co/docs/reference/security/fields-and-object-schemas/siem-field-reference

Event Original

anonymized log samples

<181>Mar 31 11:24:45 host002 CISE_Passed_Authentications 2233445566 6 0 2026-03-31 11:24:45.159 +01:00 9988776655 5203 NOTICE Device-Administration: Session Authorization succeeded, ConfigVersionId=79, Device IP Address=192.0.2.30, DestinationIPAddress=198.51.100.30, DestinationPort=49, UserName=user02, CmdSet=[ CmdAV= ], Protocol=Tacacs, RequestLatency=13, NetworkDeviceName=device002, Type=Authorization, Privilege-Level=1, Authen-Type=ASCII, Service=Login, User=user02, Port=tty644, Remote-Address=203.0.113.40, Authen-Method=TacacsPlus, Service-Argument=shell, NetworkDeviceProfileId=22222222-3333-4444-5555-777777777777, AcsSessionID=host002/222222222/444444, AuthenticationIdentityStore=EE-SSA, AuthenticationMethod=Lookup, SelectedAccessService=Default Device Admin, SelectedShellProfile=Privilege Level 15 Shell Profile, IsMachineAuthentication=false, Step=13005, Step=15049, Step=15008, Step=15048, Step=15048, Step=15048, Step=15041, Step=22072, Step=15013, Step=24210, Step=24216, Step=15013,\r

<181>Mar 11 10:20:42 host003 CISE_Failed_Attempts 3344556677 4 0 2026-03-11 10:20:42.937 +00:00 5566778899 5401 NOTICE Failed-Attempt: Authentication failed, ConfigVersionId=77, Device IP Address=192.0.2.40, Device Port=40660, DestinationIPAddress=198.51.100.30, DestinationPort=49, UserName=user03, Protocol=Tacacs, RequestLatency=16, NetworkDeviceName=device003, Type=Authentication, Action=Login, Privilege-Level=1, Authen-Type=PAP, Service=Login, User=user03, Port=0, Remote-Address=203.0.113.50, NetworkDeviceProfileId=33333333-4444-5555-6666-888888888888, AcsSessionID=host003/333333333/5555555, AuthenticationMethod=PAP_ASCII, SelectedAccessService=Default Device Admin, FailureReason=22056 Subject not found in the applicable identity store(s), Step=13013, Step=15049, Step=15008, Step=15048, Step=15048, Step=15048, Step=15041, Step=22072, Step=15013, Step=24210, Step=24216, Step=15013, Step=24430, Step=24325, Step=24313, Step=24318, Step=24322, Step=24352, Step=24412, Step=15013, Step=24430,\r

What did you do?

data flow : source -> syslog agent -> logstash -> kafka-> logstash -> elastic

What did you see?

event.category and event.outcome not setting up for the provided sample logs.

What did you expect to see?

all the SIEM mandatory fields to be set up.

Anything else?

No response