Use public ip for cisco ise vpn failure log

CrossRealms · Jul 30, 2024 · 9ae8caa · 9ae8caa
1 parent aba18c5
commit 9ae8caa
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/cyences_app_for_splunk/default/props.conf b/cyences_app_for_splunk/default/props.conf
@@ -225,7 +225,7 @@ EVAL-dest_category = if(subtype="vpn" AND vendor_action IN ("tunnel-up", "phase2
 ### Cisco VPN ###
 #################
 [cisco:ise:syslog]
-EVAL-dest_category = if(MESSAGE_CODE IN (5400, 5401) AND isnotnull(AD_User_Candidate_Identities), "vpn_auth", dest_category)
+EVAL-dest_category = if(MESSAGE_CODE IN (5400, 5401) AND isnull(AD_User_Candidate_Identities), "vpn_auth", dest_category)
 EVAL-action = "failure"
 
 [cisco:estreamer:data]
@@ -827,4 +827,4 @@ EVAL-src = 'properties.client_ip'
 EVAL-user = 'properties.database_principal_name'
 EVAL-app = 'properties.application_name'
 EVAL-signature_id = 'properties.action_id'
-EVAL-signature = 'properties.action_name'
+EVAL-signature = 'properties.action_name'