[cisco_ise]: Pipeline failed to set event.outcome and user.name

[qcorporation]

Proposed commit message

Set event.outcome and user.name for Administrative and Operational Audit message codes 60080, 60081, and 60084.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

Related issues

• Closes [cisco_ise]: Pipeline failed to set event.outcome and user.name #19929

[github-actions]

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[infra-vault-gh-plugin-prod]

Pinging @elastic/integration-experience (Team:Integration-Experience)

[vera-review-bot]

Review summary

Issues found across the latest commits 7647daf — 4 medium, 2 low

• 🟡 The changelog says event.outcome is set for codes 60080, 60081 and 60084, but the pipeline change actually sets it for 14 codes (link) (Unresolved)
• 🔵 The changelog link uses the /issues/ path with this PR's own number (20386) (link) (Unresolved)
• 🟡 The 60084 failure branch is a negation of the success regex, so any message that simply lacks the word "successfully" is labelled a failure and a missing OperationMessageText throws in the condition (link) (Unresolved)
• 🟡 For a non-existent account sshd logs "Failed password for invalid user bob from ...", and the first grok pattern captures user.name as "invalid user bob" (link) (Unresolved)
• 🟡 The new grok already matches the SSH client IP with %{IP} but discards it, so 60080/60081 authentication events carry no source address (link) (Unresolved)
• 🔵 The user.name copy runs at line 591, before UserName is renamed to user.name at line 644 and before default.yml splits email-shaped admin names, so AdminName can win over UserName and an email can land in user.name (link) (Unresolved)

A new commit triggers another review — at most once every 15 minutes. I skip the PR while it's approved or has merge conflicts.

🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.

[mjwolf]

I think it would be good to address some of these bot comments, otherwise this looks good to me

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request

[elastic-vault-github-plugin-prod]

✅ All changelog entries have the correct PR link.

[infra-vault-gh-plugin-prod]

💚 Build Succeeded

• Buildkite Build
• Commit: 18d257b

History

• 💚 Build #46786 succeeded 7647daf
• 💚 Build #46783 succeeded c92b2c4

cc @qcorporation

[elastic-vault-github-plugin-prod]

Package cisco_ise - 1.32.10 containing this change is available at https://epr.elastic.co/package/cisco_ise/1.32.10/