[Cisco ise] Tag device-sensor fragments instead of erroring per line

packages/cisco_ise/_dev/build/docs/README.md

@@ -204,6 +204,7 @@
 - Logging categories not enabled: Cisco ISE won't send logs unless specific logging categories are explicitly assigned to a remote logging target. Ensure your target is selected in the **Remote Logging Targets** list for each desired category under **Administration > System > Logging > Logging Categories**.
 - SSL/TLS configuration issues: When you're using the `ssl` settings for TCP, ensure that certificate and key file paths are correct and that the Elastic Agent has sufficient permissions to access them. Mismatched certificates or incorrect `YAML` configuration will prevent the agent from establishing a secure connection.
 - Parsing failures due to malformed logs: Cisco ISE logs that are segmented or contain unexpected formats can cause parsing errors. Review the raw logs in Kibana by checking the `message` or `event.original` field for `_grokparsefailure` tags. Ensure the **Maximum Length** in Cisco ISE is set to `8192`.
+- Split device sensor records: When the device sensor feature is enabled, Cisco ISE forwards CDP and LLDP attribute values verbatim. A neighboring switch or access point reports its multi-line version banner in `lldpSystemDescription`, so the record reaches syslog with embedded newlines and the TCP and log file inputs split it into several messages. Only the first message carries the ISE header and is parsed; the remaining lines are tagged `cisco_ise.device_sensor_fragment` and their text is kept in `message`, so any attributes that followed the embedded newline (such as `AcsSessionID` or `NetworkDeviceGroups`) aren't parsed into fields. To collect these records whole, exclude the system description from the device sensor TLV list on the network device, for example `device-sensor filter-list lldp list <name>` with `no tlv name system-description`, and apply it with `device-sensor filter-spec lldp include list <name>`.
 - UDP buffer limitations: In high-volume environments using the UDP input, you might need to increase the `read_buffer` size in the advanced settings to prevent packet loss during bursts of activity. The default is `100MiB`.
 
 ### Vendor resources

packages/cisco_ise/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.32.11"
+  changes:
+    - description: Tag CDP/LLDP device-sensor continuation lines as `cisco_ise.device_sensor_fragment` and keep their text in `message` instead of reporting a parse error for each line. Remove the unreachable `@timestamp` fallback added in 1.32.9.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/20528
 - version: "1.32.10"
   changes:
     - description: Set event.outcome for Administrative and Operational Audit login, logoff and configuration message codes (51000, 51001, 51002, 51020, 51021, 60077, 60078, 60080, 60081, 60084, 60115, 60116, 60188, 61077). Extract user.name and source.ip from OperationMessageText for SSH CLI login events (60080, 60081). Populate user.name from AdminName for all admin audit events.

packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-device-sensor-fragments.log

@@ -1 +1,4 @@
 CISE_Profiler 0000034521 2 1 cisco-av-pair=cdp-tlv=cdpCacheAddress=192.0.2.10, cisco-av-pair=lldp-tlv=lldpSystemDescription=Cisco IOS Software C3700 Software, cisco-av-pair=cdp-tlv=cdpCacheDeviceId=SAMPLE-AP-0001,
+Technical Support: http://www.cisco.com/techsupport\
+Copyright (c) 1986-2024 by Cisco Systems, Inc.\
+Compiled Tue 16-Jul-24 14:24 by mcpre, cisco-av-pair=cdp-tlv=cdpCacheDeviceId=SAMPLE-AP-0001.8, cisco-av-pair=audit-session-id=C000020A00001111AAAA2222, cisco-av-pair=method=mab, AcsSessionID=SAMPLE-ISE-01/000000000/1111111, Step=11004, NetworkDeviceGroups=Location#All Locations#SAMPLE, CPMSessionID=C000020A00001111AAAA2222, StepLatency=1=0;2=0;3=0;4=1;5=0, TotalAuthenLatency=2, Operation=Operation#Operation#CLOSED,

packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-device-sensor-fragments.log-expected.json

@@ -1,7 +1,6 @@
 {
     "expected": [
         {
-            "@timestamp": "2026-07-29T11:52:24.610988003Z",
             "cisco_ise": {
                 "log": {
                     "category": {
@@ -23,9 +22,47 @@
                 "original": "CISE_Profiler 0000034521 2 1 cisco-av-pair=cdp-tlv=cdpCacheAddress=192.0.2.10, cisco-av-pair=lldp-tlv=lldpSystemDescription=Cisco IOS Software C3700 Software, cisco-av-pair=cdp-tlv=cdpCacheDeviceId=SAMPLE-AP-0001,"
             },
             "message": "cisco-av-pair=cdp-tlv=cdpCacheAddress=192.0.2.10, cisco-av-pair=lldp-tlv=lldpSystemDescription=Cisco IOS Software C3700 Software, cisco-av-pair=cdp-tlv=cdpCacheDeviceId=SAMPLE-AP-0001,",
+            "tags": [
+                "preserve_original_event"
+            ]
+        },
+        {
+            "ecs": {
+                "version": "8.17.0"
+            },
+            "event": {
+                "original": "Technical Support: http://www.cisco.com/techsupport\\"
+            },
+            "message": "Technical Support: http://www.cisco.com/techsupport\\",
+            "tags": [
+                "preserve_original_event",
+                "cisco_ise.device_sensor_fragment"
+            ]
+        },
+        {
+            "ecs": {
+                "version": "8.17.0"
+            },
+            "event": {
+                "original": "Copyright (c) 1986-2024 by Cisco Systems, Inc.\\"
+            },
+            "message": "Copyright (c) 1986-2024 by Cisco Systems, Inc.\\",
+            "tags": [
+                "preserve_original_event",
+                "cisco_ise.device_sensor_fragment"
+            ]
+        },
+        {
+            "ecs": {
+                "version": "8.17.0"
+            },
+            "event": {
+                "original": "Compiled Tue 16-Jul-24 14:24 by mcpre, cisco-av-pair=cdp-tlv=cdpCacheDeviceId=SAMPLE-AP-0001.8, cisco-av-pair=audit-session-id=C000020A00001111AAAA2222, cisco-av-pair=method=mab, AcsSessionID=SAMPLE-ISE-01/000000000/1111111, Step=11004, NetworkDeviceGroups=Location#All Locations#SAMPLE, CPMSessionID=C000020A00001111AAAA2222, StepLatency=1=0;2=0;3=0;4=1;5=0, TotalAuthenLatency=2, Operation=Operation#Operation#CLOSED,"
+            },
+            "message": "Compiled Tue 16-Jul-24 14:24 by mcpre, cisco-av-pair=cdp-tlv=cdpCacheDeviceId=SAMPLE-AP-0001.8, cisco-av-pair=audit-session-id=C000020A00001111AAAA2222, cisco-av-pair=method=mab, AcsSessionID=SAMPLE-ISE-01/000000000/1111111, Step=11004, NetworkDeviceGroups=Location#All Locations#SAMPLE, CPMSessionID=C000020A00001111AAAA2222, StepLatency=1=0;2=0;3=0;4=1;5=0, TotalAuthenLatency=2, Operation=Operation#Operation#CLOSED,",
             "tags": [
                 "preserve_original_event",
-                "cisco_ise.timestamp_defaulted_to_ingest_time"
+                "cisco_ise.device_sensor_fragment"
             ]
         }
     ]

packages/cisco_ise/data_stream/log/elasticsearch/ingest_pipeline/default.yml

@@ -22,10 +22,40 @@ processors:
       pattern_definitions:
         TIMEONLYSTAMP_ISO8601: '%{YEAR}-%{MONTHNUM}-%{MONTHDAY}[T]%{HOUR}:?%{MINUTE}(?::?%{SECOND})?'
       on_failure:
+        - set:
+            tag: set_device_sensor_fragment_flag
+            description: >-
+              ISE forwards device-sensor values verbatim, so a neighbor's
+              multi-line banner (lldpSystemDescription) arrives with its newlines
+              intact, each escaped as a trailing backslash. The inputs split on
+              them, leaving continuation lines that carry no ISE header and can
+              never match. Flag them so they are tagged instead of erroring once
+              per line.
+            field: _tmp.device_sensor_fragment
+            value: true
+            if: >-
+              ctx.event?.original instanceof String &&
+              (ctx.event.original.endsWith('\\') ||
+              ctx.event.original.trim().endsWith(','))
+        - append:
+            tag: append_tag_device_sensor_fragment
+            field: tags
+            value: cisco_ise.device_sensor_fragment
+            allow_duplicates: false
+            if: ctx._tmp?.device_sensor_fragment == true
+        - set:
+            tag: set_message_from_device_sensor_fragment
+            description: >-
+              The attributes a fragment carries belong to the preceding record and
+              cannot be rejoined here, so keep the raw text searchable in message.
+            field: message
+            copy_from: event.original
+            if: ctx._tmp?.device_sensor_fragment == true
         - append:
             tag: append_error_message_62c1fc01
             field: error.message
             value: '{{{ _ingest.on_failure_processor_tag }}}: {{{_ingest.on_failure_message}}}'
+            if: ctx._tmp?.device_sensor_fragment == null
   - grok:
       field: _tmp.message
       tag: grok_message_details
@@ -287,26 +317,6 @@ processors:
       value: preserve_original_event
       allow_duplicates: false
       if: ctx.error?.message != null
-  - append:
-      tag: append_tag_timestamp_defaulted_to_ingest_time
-      description: >-
-        Tag events whose @timestamp is defaulted to ingest time (no event date
-        parsed) so the assumed timestamps can be filtered out or audited.
-      field: tags
-      value: cisco_ise.timestamp_defaulted_to_ingest_time
-      allow_duplicates: false
-      if: ctx['@timestamp'] == null
-  - set:
-      tag: set_fallback_timestamp_to_ingest_time
-      description: >-
-        Default @timestamp to ingest time when no event date was parsed, so
-        valid but timestamp-less events (e.g. device-sensor fragments) are not
-        routed to the failure store. Guarded on null to never overwrite a
-        parsed event time.
-      field: '@timestamp'
-      value: '{{{_ingest.timestamp}}}'
-      if: ctx['@timestamp'] == null
-      ignore_failure: true
 on_failure:
   - set:
       field: event.kind

packages/cisco_ise/docs/README.md

@@ -204,6 +204,7 @@ You might encounter these issues when configuring the Cisco ISE integration:
 - Logging categories not enabled: Cisco ISE won't send logs unless specific logging categories are explicitly assigned to a remote logging target. Ensure your target is selected in the **Remote Logging Targets** list for each desired category under **Administration > System > Logging > Logging Categories**.
 - SSL/TLS configuration issues: When you're using the `ssl` settings for TCP, ensure that certificate and key file paths are correct and that the Elastic Agent has sufficient permissions to access them. Mismatched certificates or incorrect `YAML` configuration will prevent the agent from establishing a secure connection.
 - Parsing failures due to malformed logs: Cisco ISE logs that are segmented or contain unexpected formats can cause parsing errors. Review the raw logs in Kibana by checking the `message` or `event.original` field for `_grokparsefailure` tags. Ensure the **Maximum Length** in Cisco ISE is set to `8192`.
+- Split device sensor records: When the device sensor feature is enabled, Cisco ISE forwards CDP and LLDP attribute values verbatim. A neighboring switch or access point reports its multi-line version banner in `lldpSystemDescription`, so the record reaches syslog with embedded newlines and the TCP and log file inputs split it into several messages. Only the first message carries the ISE header and is parsed; the remaining lines are tagged `cisco_ise.device_sensor_fragment` and their text is kept in `message`, so any attributes that followed the embedded newline (such as `AcsSessionID` or `NetworkDeviceGroups`) aren't parsed into fields. To collect these records whole, exclude the system description from the device sensor TLV list on the network device, for example `device-sensor filter-list lldp list <name>` with `no tlv name system-description`, and apply it with `device-sensor filter-spec lldp include list <name>`.
 - UDP buffer limitations: In high-volume environments using the UDP input, you might need to increase the `read_buffer` size in the advanced settings to prevent packet loss during bursts of activity. The default is `100MiB`.
 
 ### Vendor resources

packages/cisco_ise/manifest.yml

@@ -1,7 +1,7 @@
 format_version: "3.0.3"
 name: cisco_ise
 title: Cisco ISE
-version: "1.32.10"
+version: "1.32.11"
 description: Collect logs from Cisco ISE with Elastic Agent.
 type: integration
 categories: