cisco ise

Expression

product = "cisco ise"

Fields

Field	Core	Detection	Informational
src_ip			✓

Activity Types

Activity Type	Field	Status	Core	Detection	Informational
app-activity	src_ip	Default		✓
	app	Default			✓
	privileges	Default			✓
	dest_ip	Default		✓
	user	Default		✓
configuration-modify	severity
	additional_info
	event_code
	domain
	event_name
	domain_user_name
	user
	operation
	admin_interface
	object
endpoint-authentication	severity	Default			✓
	computer_name	Default			✓
	src_mac	Default			✓
	radius_flow_type	Default			✓
	access_type	Default			✓
	user_dn	Default			✓
	dest_mac	Default			✓
	session_id	Default			✓
	src_host	Default		✓
	ssid	Default			✓
	nas_ip_address	Default			✓
	network	Default			✓
	identity_group	Default			✓
	protocol	Default			✓
	user_type	Default			✓
	dest_ip	Default		✓
	location	Default			✓
	acs_session_id	Default			✓
	auth_server	Default			✓
	dest_port	Default			✓
	calling_station_id	Default			✓
endpoint-login	severity	Default			✓
	additional_info	Default			✓
	event_code	Default			✓
	event_name	Default			✓
	category	Default			✓
	admin_interface	Default			✓
vpn-login	src_translated_ip	Default			✓
	os	Default			✓
	event_code	Default			✓
	dest_ip	Default		✓
	os_version	Default			✓
	badge_id	Default			✓
	dest_host	Default		✓
	session_id	Default			✓
	event_name	Default			✓
	realm	Default			✓
vpn-logout	src_translated_ip
	bytes_out	Legacy		✓
	bytes_in
	additional_info
	dest_ip
	dest_host	Legacy			✓
	session_duration	Legacy		✓