pC_ciscofpkvvpnauthenticationsuccess713049.md

Parser Content

{
Name = cisco-fp-kv-vpn-authentication-success-713049
  ParserVersion = "v1.0.0"
  Conditions = [ """%FTD-5-713049:""" ]

cisco-events-1 = {
  Vendor = Cisco
  Product = Cisco Firepower
  TimeFormat = "yyyy-MM-dd HH:mm:ss"
  Fields = [
    """%FTD-({priority}\d+)-({event_code}\d+)""",
    """Session=({session_id}\S+),""",
    """User(=|\s)<?({user}[^,>]+)""",
    """\sGroup\s*<({group_name}[^>]+)>"""
  
}