Authentication ASIM parser for Cisco ISE Administrator events
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊
Parser Information
| Property | Value |
|---|---|
| Parser Name | ASimAuthenticationCiscoISEAdministrator |
| Built-in Parser | _ASim_Authentication_CiscoISEAdministrator |
| Schema | Authentication |
| Schema Version | 0.1.4 |
| Parser Type | 🔌 Source (product-specific) |
| Product | Cisco ISE Administrator |
| Parser Version | 0.1.1 (version history) |
| Last Updated | Apr 14, 2026 |
| Unifying Parser | ASimAuthentication |
| Source File | Parsers\ASimAuthentication\Parsers\ASimAuthenticationCiscoISEAdministrator.yaml |
Description
This ASIM parser supports normalizing Cisco ISE administrator login events ingested into Microsoft Sentinel by the AMA agent to the ASIM Authentication schema.
Source Tables
This parser reads from the following tables:
| Table | Selection Criteria | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|---|
Syslog |
ProcessName has "CISE_Administrative_and_Operational_Audit"SyslogMessage has "Administrator-Login" |
✓ | ✓ | ? |
Parameters
| Name | Type | Default |
|---|---|---|
disabled |
bool | False |
pack |
bool | False |
Associated Connectors
The following connectors provide data for this parser:
| Connector | Solution |
|---|---|
| SyslogAma | Syslog |
Solutions: Syslog
References
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊