Issue with parser for CISCO ISE in Sentinel

[v-nguyentruong]

Describe the bug
Parsing issue with Cisco ISE data source
Using the parser from the Cisco Identity Service Engine data connector page in Sentinel provide and still got wrong information in the logs.
I found out that the parser will apply for these logs:
Syslog
| where ProcessName has_any ("CSCO", "CISE")
There are many logs with different structures of SyslogMessage which causes the parser to not be able to function properly.
When applied this line in parser for the above results, there will be an eventid with a date (Ex 1: 2024-01-05) and an eventid with a string (Ex 2: NetworkDeviceGroups...).
| parse SyslogMessage with * " " * " " * " " EventId " " EventSeverity " " EventCategory " " RestOfMessage

To Reproduce
Steps to reproduce the behavior:

1. Go to Sentinel portal > Data Connectors > Cisco Identity Service Engine
2. Click on "Follow these steps"
3. Copy the function code then paste into Logs then Save as function.
4. See wrong information in CiscoISEEvent table.

Expected behavior
Correct data from Syslog parse into the correct field in CiscoISEEvent table.

Screenshots

[github-actions]

Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.

[v-sudkharat]

Hi v-nguyentruong, Thanks for flagging this issue, we will investigate this issue and get back to you with some updates by 15-01-2024. Thanks!

[v-sudkharat]

Hi v-nguyentruong, Could you please check with below shared parser file.
CiscoISEParser_Updated3.txt

Sharing the steps to configure it -

1. Go to Log Analytics workspace and select your workspace.
2. Click on Logs.
   In the Schema and Filter Pane, select Functions tab and enter Parser name (e.g. CiscoISEEvent) in the search box, function list would be filtered.
3. Hover over the function name and click on Load the function code link in the flyout.
4. This would load the definition of the parser in the new query window. Copy and paste the content of the function in a notepad and save it.

Please let us know if it works or you need any assistance on it.
Thanks!

[v-sudkharat]

Hi v-nguyentruong, we are waiting for your response on above comment. Thanks!

[v-nguyentruong]

Hi @sudarshan Kharat (Tata Consultancy Services ***@***.***> Thanks for your response. I'm still checking this parser on customer environment. I'm still waiting for the customer to send a reply. I will update you if I get any response. Best Regards, Nelson Truong Support Engineer Azure - Security Working Hours: 3:00 PM - 12:00 AM (UTC+7, Monday to Friday) Need help outside of my working hours? Locate an engineer: ***@***.******@***.***> Manager: Olivia Li/ ***@***.*** [image]

…

________________________________ From: v-sudkharat ***@***.***> Sent: Tuesday, January 16, 2024 12:54 PM To: Azure/Azure-Sentinel ***@***.***> Cc: Nelson Truong (WICLOUD CORPORATION) ***@***.***>; Mention ***@***.***> Subject: Re: [Azure/Azure-Sentinel] Issue with parser for CISCO ISE in Sentinel (Issue #9746) Hi @v-nguyentruong<https://github.com/v-nguyentruong>, we are waiting for your response on above comment. Thanks! — Reply to this email directly, view it on GitHub<#9746 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/BFGXNLUD2LPF22GNHRUCWZDYOYIZRAVCNFSM6AAAAABBTCIR6KVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTQOJTGEYTGMBRGA>. You are receiving this because you were mentioned.Message ID: ***@***.***>

[v-sudkharat]

Hi v-nguyentruong, Please let us know once you get update from customer on this. Thanks!

[v-sudkharat]

Hi v-nguyentruong, Any update from customer on this? Thanks!

[v-nguyentruong]

Hi v-sudkharat. Customer is still monitoring for few more days after trying the parser before letting me know the status.

[v-sudkharat]

Hi v-nguyentruong, thanks for sharing update with us, please let us know, once you get more update from customer on this.
Thanks!

[v-nguyentruong]

Hi @sudarshan Kharat (Tata Consultancy Services ***@***.***> Hope you doing well Just got a response from customer. Everything is working fine except there is no timestamp this time (No TimeGenerated column). Can you check the parser again? Here is the screenshots from customer: [cid:7389d18d-085f-46d0-a6f5-0c2bc3d9738c] Best Regards,   Nelson Truong Support Engineer Azure - Security Working Hours: 3:00 PM - 12:00 AM (UTC+7, Monday to Friday) Need help outside of my working hours? Locate an engineer: ***@***.******@***.***> Manager: Olivia Li/ ***@***.*** [image]

…

________________________________ From: v-sudkharat ***@***.***> Sent: Friday, January 19, 2024 5:04 PM To: Azure/Azure-Sentinel ***@***.***> Cc: Nelson Truong (WICLOUD CORPORATION) ***@***.***>; Mention ***@***.***> Subject: Re: [Azure/Azure-Sentinel] Issue with parser for CISCO ISE in Sentinel (Issue #9746) Hi @v-nguyentruong<https://github.com/v-nguyentruong>, thanks for sharing update with us, please let us know, once you get more update from customer on this. Thanks! — Reply to this email directly, view it on GitHub<#9746 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/BFGXNLUL2NVBWRLM7ZMZ7JDYPJALXAVCNFSM6AAAAABBTCIR6KVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTSMBQGEYDOMRXHA>. You are receiving this because you were mentioned.Message ID: ***@***.***>