Cisco on sentinelchangelog.nethttp://sentinelchangelog.net/tags/cisco/Recent content in Cisco on sentinelchangelog.netHugo -- 0.157.0enFri, 10 Jul 2026 16:24:56 +0000Cisco Secure Endpoint ASIM AlertEvent Parser: Missing Mandatory Fields Causing Data Fidelity Gaphttp://sentinelchangelog.net/posts/2026-07-10-pr-14631/Fri, 10 Jul 2026 16:24:56 +0000http://sentinelchangelog.net/posts/2026-07-10-pr-14631/TimeGenerated and Type fields were absent from the Cisco Secure Endpoint ASIM AlertEvent parser output, causing null returns for all rows referencing these now-mandatory schema fields in downstream queries.Cisco Meraki CCF Connector Expands to Cover Rogue AP Detection and Network Inventoryhttp://sentinelchangelog.net/posts/2026-07-08-pr-14629/Wed, 08 Jul 2026 21:22:13 +0000http://sentinelchangelog.net/posts/2026-07-08-pr-14629/The Cisco Meraki CCF connector (v3.1.0) adds four new ingestion streams - Organizations, Organization Networks, Network Clients, and Wireless Air Marshal Events - extending coverage beyond the original ASIM event types to include wireless threat detection and full network inventory visibility.Cisco Umbrella CCF Connector GA Promotion Fixes Template Variable Rendering in UI Querieshttp://sentinelchangelog.net/posts/2026-07-01-pr-14603/Wed, 01 Jul 2026 19:55:19 +0000http://sentinelchangelog.net/posts/2026-07-01-pr-14603/The Cisco Umbrella CCF connector graduates to GA while also resolving broken template variable references that caused Content Hub connectivity checks and sample queries to malfunction.New ASIM NetworkSession Parser for Cisco FTD Extends Network Visibility via AMA Connectorhttp://sentinelchangelog.net/posts/2026-06-30-pr-14569/Tue, 30 Jun 2026 22:04:57 +0000http://sentinelchangelog.net/posts/2026-06-30-pr-14569/Cisco Firepower Threat Defense (FTD) logs ingested via the Cisco ASA/FTD AMA connector can now be normalised into the ASIM NetworkSession schema, enabling source-agnostic detections and hunting queries to run against FTD firewall and IDS events.New ASIM Authentication Parser for Cisco Firepower Threat Defense Closes Syslog Auth Visibility Gaphttp://sentinelchangelog.net/posts/2026-06-30-pr-14581/Tue, 30 Jun 2026 16:24:52 +0000http://sentinelchangelog.net/posts/2026-06-30-pr-14581/A new ASIM Authentication parser for Cisco FTD normalises SSH login success and failure events from Syslog into the imAuthentication/ASimAuthentication schema, enabling source-agnostic detection coverage for Cisco firewall authentication activity.Cisco ISE ASIM Auth Parser: Regex Fix Restores EventOriginalType Extraction Across Log Format Variantshttp://sentinelchangelog.net/posts/2026-06-25-pr-14554/Thu, 25 Jun 2026 18:49:15 +0000http://sentinelchangelog.net/posts/2026-06-25-pr-14554/A broken regex in both the ASimAuthenticationCiscoISE and vimAuthenticationCiscoISE parsers caused EventOriginalType to return null for Cisco ISE syslog messages that include extended timestamp/sequence prefixes, silently dropping event classification for those log variants.CiscoSEG and Infoblox NIOS Package Template Sync — Metadata and Version Normalisationhttp://sentinelchangelog.net/posts/2026-06-18-pr-14497/Thu, 18 Jun 2026 09:32:21 +0000http://sentinelchangelog.net/posts/2026-06-18-pr-14497/Package template refresh for CiscoSEG (3.0.5), Infoblox NIOS (3.0.5), and Windows Server DNS (3.0.1) solutions with no changes to detection logic, parser content, or connector ingestion configuration.Cisco ETD: Migration to Message Event Logs API with Enhanced Email Security Visibilityhttp://sentinelchangelog.net/posts/2026-06-10-pr-14290/Wed, 10 Jun 2026 10:40:25 +0000http://sentinelchangelog.net/posts/2026-06-10-pr-14290/Labeled P0 — assess deployment or pipeline breakage risk explicitly. Complete connector overhaul migrates to new Message Event Logs REST API providing enhanced email visibility beyond convicted messages.Cisco Meraki Parser: Critical Self-Reference Recursion Fixed After v3.0.5 Packaging Errorhttp://sentinelchangelog.net/posts/2026-06-09-pr-14435/Tue, 09 Jun 2026 06:46:29 +0000http://sentinelchangelog.net/posts/2026-06-09-pr-14435/Restores Cisco Meraki parser functionality by fixing table reference error that caused recursive failure and broke all downstream queries.Cisco Umbrella CCF: Public Preview Expands Data Visibility with 10 New Log Tableshttp://sentinelchangelog.net/posts/2026-06-01-pr-14378/Mon, 01 Jun 2026 14:34:58 +0000http://sentinelchangelog.net/posts/2026-06-01-pr-14378/New Codeless Connector Framework introduces comprehensive log coverage across DNS, web traffic, cloud firewall, admin audit, DLP, file events, IPS, VPN and Zero Trust access for enhanced threat detection.Cisco Secure Endpoint: ASIM AlertEvent Parser for Cloud-Based Threat Detectionhttp://sentinelchangelog.net/posts/2026-05-13-pr-13741/Wed, 13 May 2026 20:29:51 +0000http://sentinelchangelog.net/posts/2026-05-13-pr-13741/New ASIM parser enables normalized threat detection from Cisco Secure Endpoint via CCF ingestion to CiscoSecureEndpointEventsV2_CL table.Cisco Duo Connector: API Throttling Resilience Improved for Log Ingestionhttp://sentinelchangelog.net/posts/2026-05-07-pr-14204/Thu, 07 May 2026 04:48:36 +0000http://sentinelchangelog.net/posts/2026-05-07-pr-14204/Doubled retry delay to 120 seconds to address Duo API throttling requirements preventing log collection.Cisco ISE ASIM Parser: Correcting IP Address Field Mappingshttp://sentinelchangelog.net/posts/2026-04-15-pr-14076/Wed, 15 Apr 2026 21:31:51 +0000http://sentinelchangelog.net/posts/2026-04-15-pr-14076/Cisco ISE Administrator authentication parser fixes swap incorrect SrcIpAddr and TargetIpAddr mappings that broke network forensics queries.ASIM Authentication: New Parser for Cisco ISE Administrator Login Eventshttp://sentinelchangelog.net/posts/2026-04-10-pr-13909/Fri, 10 Apr 2026 21:15:53 +0000http://sentinelchangelog.net/posts/2026-04-10-pr-13909/Added ASIM Authentication parser for Cisco ISE administrator authentication events, expanding centralized network device visibility.Cisco Umbrella ASIM Parser: Fixing Variable Scope Bug in IP Filter Logichttp://sentinelchangelog.net/posts/2026-04-09-pr-14027/Thu, 09 Apr 2026 20:15:05 +0000http://sentinelchangelog.net/posts/2026-04-09-pr-14027/Moves critical IP filtering variables inside parser function to prevent incorrect filtering and potential data loss.Cisco IOS: New ASIM Authentication Parser for Network Device Login Monitoringhttp://sentinelchangelog.net/posts/2026-04-06-pr-13966/Mon, 06 Apr 2026 22:43:41 +0000http://sentinelchangelog.net/posts/2026-04-06-pr-13966/ASIM authentication parser for Cisco IOS enables normalized monitoring of login, logout, and failed authentication events from network infrastructure devices.ASIM WebSession Parser: New Cisco Umbrella Proxy Log Coveragehttp://sentinelchangelog.net/posts/2026-03-25-pr-13893/Wed, 25 Mar 2026 22:24:08 +0000http://sentinelchangelog.net/posts/2026-03-25-pr-13893/New ASIM parser adds web session visibility for Cisco Umbrella proxy logs, normalizing HTTP/HTTPS traffic data to standard schema.Cisco Umbrella Connector: Critical Fix for State Manager Corruption and Data Ingestion Crasheshttp://sentinelchangelog.net/posts/2026-03-25-pr-13899/Wed, 25 Mar 2026 17:53:34 +0000http://sentinelchangelog.net/posts/2026-03-25-pr-13899/Cisco Umbrella connector fixes critical null-byte corruption in Azure File Share state markers that was causing complete ingestion failures.Cisco Firepower Workbook: Fixed DeviceProduct Filter Restores Dashboard Functionalityhttp://sentinelchangelog.net/posts/2026-03-23-pr-13865/Mon, 23 Mar 2026 06:03:53 +0000http://sentinelchangelog.net/posts/2026-03-23-pr-13865/Cisco Firepower workbook queries updated from incorrect ‘Firepower’ to ‘FTD’ filter, fixing non-functional dashboard charts.Threat Intelligence: Duo Security IP Detection Updated for ASIM Schema Compliancehttp://sentinelchangelog.net/posts/2026-03-17-pr-13774/Tue, 17 Mar 2026 05:08:53 +0000http://sentinelchangelog.net/posts/2026-03-17-pr-13774/IPEntity_DuoSecurity detection migrated from legacy DuoSecurityAuthentication_CL table to normalized CiscoDuo ASIM schema.Cisco Umbrella Connector: Critical CSV Ingestion Failure Fixedhttp://sentinelchangelog.net/posts/2026-03-13-pr-13818/Fri, 13 Mar 2026 17:27:17 +0000http://sentinelchangelog.net/posts/2026-03-13-pr-13818/Resolves complete ingestion stall caused by oversized CSV fields and null character parsing errors.Cisco Duo Connector: Function Timeout Mitigation and Dependency Security Updateshttp://sentinelchangelog.net/posts/2026-03-02-pr-13713/Mon, 02 Mar 2026 07:59:57 +0000http://sentinelchangelog.net/posts/2026-03-02-pr-13713/Fixes timeout-induced ingestion failures in offline enrollment log processing and updates duo-client library for security maintenance.Cisco Duo Security: Critical Deployment Fix Resolves Portal Installation Failureshttp://sentinelchangelog.net/posts/2026-02-05-pr-13532/Thu, 05 Feb 2026 14:59:57 +0000http://sentinelchangelog.net/posts/2026-02-05-pr-13532/Azure portal deployment failures resolved by fixing empty location parameters and updating Python runtime compatibility to prevent connector breakage.Cisco Umbrella Connector: Schema v14 Compatibility and Documentation Updateshttp://sentinelchangelog.net/posts/2025-12-05-pr-13251/Fri, 05 Dec 2025 12:53:17 +0000http://sentinelchangelog.net/posts/2025-12-05-pr-13251/Updates Cisco Umbrella Function App connectors to support log schema version 14 with enhanced workspace key documentation.ZeroFox CCF Connector: KQL Query Restoration and Multi-Solution Maintenancehttp://sentinelchangelog.net/posts/2025-12-04-pr-13209/Thu, 04 Dec 2025 10:45:58 +0000http://sentinelchangelog.net/posts/2025-12-04-pr-13209/ZeroFox CCF connector receives missing KQL query fixes alongside packaging updates across 8+ solutions.Cisco Umbrella: Enhanced Data Fidelity with Log Format v13-v14 Supporthttp://sentinelchangelog.net/posts/2025-12-02-pr-13200/Tue, 02 Dec 2025 11:18:15 +0000http://sentinelchangelog.net/posts/2025-12-02-pr-13200/Added support for Cisco Secure log formats v13-v14, exposing AI model tracking and event correlation fields for improved threat context.VMware ESXi SSH Brute Force Detection Plus Multi-Solution Updateshttp://sentinelchangelog.net/posts/2025-11-10-pr-13063/Mon, 10 Nov 2025 06:23:07 +0000http://sentinelchangelog.net/posts/2025-11-10-pr-13063/New VMware ESXi detection for multiple failed SSH login attempts, plus comprehensive solution updates across 15+ vendor solutions.Cisco Meraki Connector: Data Types Table Name Corrected for Query Consistencyhttp://sentinelchangelog.net/posts/2025-11-07-pr-12786/Fri, 07 Nov 2025 10:15:35 +0000http://sentinelchangelog.net/posts/2025-11-07-pr-12786/Cisco Meraki connector fixed incorrect table name reference in UI data types to match actual KQL queries.Cisco Duo Security: Support Information and Metadata Updateshttp://sentinelchangelog.net/posts/2025-10-03-pr-12868/Fri, 03 Oct 2025 08:14:12 +0000http://sentinelchangelog.net/posts/2025-10-03-pr-12868/Solution package updated with revised support information and compatibility metadata.Cisco Duo Security Solution: New Log Endpoints Support Added in Version 3.0.3http://sentinelchangelog.net/posts/2025-09-22-pr-12734/Mon, 22 Sep 2025 11:19:39 +0000http://sentinelchangelog.net/posts/2025-09-22-pr-12734/Cisco Duo Security solution updated to version 3.0.3 with enhanced data ingestion capabilities through new log endpoint support.Cisco Umbrella Elastic Premium Connector: Data Consistency Fix Aligns with Standard Connectorhttp://sentinelchangelog.net/posts/2025-08-28-pr-12712/Thu, 28 Aug 2025 11:00:02 +0000http://sentinelchangelog.net/posts/2025-08-28-pr-12712/Cisco Umbrella elastic premium connector updated to match standard connector data types and table structures for consistent log processing and queries.