What Changed

Added new ASIM AlertEvent parsers for Cisco Secure Endpoint with CCF ingestion support, enabling normalized alert processing from the CiscoSecureEndpointEventsV2_CL table. Updated top-level ASIM parsers to include the new Cisco Secure Endpoint parser functions.

Parser Impact

The new parser normalizes Cisco Secure Endpoint security events to the ASIM AlertEvent schema v0.1. Key field mappings include:

  • Event severity mapping (Critical/High → High, Medium → Medium, Low → Low)
  • Device information extraction from ComputerConnectorGuid and network addresses
  • User context from matched activity events (process start, API invoke telemetry)
  • File hashes (SHA1, SHA256, MD5) from both primary and parent files
  • Process information including command lines and PIDs
  • MITRE ATT&CK tactics and techniques from native Cisco data

No change to existing parser logic or filter operations — this is additive content that extends ASIM coverage to Cisco endpoint telemetry.

MITRE Coverage

Parser extracts MITRE ATT&CK tactics and techniques directly from native Cisco Secure Endpoint event data via the Tactics and Techniques fields, enabling cross-platform threat correlation.

Affected Files

.script/tests/KqlvalidationsTests/CustomTables/CiscoSecureEndpointEventsV2_CL.json
Parsers/ASimAlertEvent/ARM/ASimAlertEvent/ASimAlertEvent.json
Parsers/ASimAlertEvent/ARM/ASimAlertEventCiscoSecureEndpoint/ASimAlertEventCiscoSecureEndpoint.json
Parsers/ASimAlertEvent/ARM/ASimAlertEventCiscoSecureEndpoint/README.md
Parsers/ASimAlertEvent/ARM/FullDeploymentAlertEvent.json
Parsers/ASimAlertEvent/ARM/imAlertEvent/imAlertEvent.json
Parsers/ASimAlertEvent/ARM/vimAlertEventCiscoSecureEndpoint/README.md
Parsers/ASimAlertEvent/ARM/vimAlertEventCiscoSecureEndpoint/vimAlertEventCiscoSecureEndpoint.json
Parsers/ASimAlertEvent/CHANGELOG/ASimAlertEvent.md
Parsers/ASimAlertEvent/CHANGELOG/ASimAlertEventCiscoSecureEndpoint.md
Parsers/ASimAlertEvent/CHANGELOG/imAlertEvent.md
Parsers/ASimAlertEvent/CHANGELOG/vimAlertEventCiscoSecureEndpoint.md
Parsers/ASimAlertEvent/Parsers/ASimAlertEvent.yaml
Parsers/ASimAlertEvent/Parsers/ASimAlertEventCiscoSecureEndpoint.yaml
Parsers/ASimAlertEvent/Parsers/imAlertEvent.yaml
Parsers/ASimAlertEvent/Parsers/vimAlertEventCiscoSecureEndpoint.yaml
Sample Data/ASIM/Cisco_Secure Endpoint_AlertEvent_IngestedLogs.csv