V 2.0 RADIUS Diagnostics Event

Vendor Documentation

https://www.cisco.com/c/en/us/td/docs/security/ise/syslog/Cisco_ISE_Syslogs/m_SyslogsList.html

Classification

Rule Name	Rule Type	Common Event	Classification
V 2.0 RADIUS Diagnostics Event	Base Rule	RADIUS Information	Information
V 2.0 EVID 11001 RADIUS Access-Request Received	Sub Rule	RADIUS Access-Request Received	Information
V 2.0 EVID 11002 RADIUS Access-Accept Returned	Sub Rule	RADIUS Authentication	Network Traffic
V 2.0 EVID 11003 RADIUS Access-Reject Returned	Sub Rule	Authentication Failure Activity	Authentication Failure
V 2.0 EVID 11004 RADIUS Accounting-Req Received	Sub Rule	RADIUS Accounting-Request Received	Information
V 2.0 EVID 11005 RADIUS Accounting-Rsp Returned	Sub Rule	RADIUS Server Response Sent	Information
V 2.0 EVID 11006 RADIUS Access-Challenge Return	Sub Rule	General RADIUS Message	Information
V 2.0 EVID 11007 Could Not Locate Network Device	Sub Rule	Network Access Device Not Found	Error
V 2.0 EVID 11008 Service-Type Received	Sub Rule	General Service Information	Information
V 2.0 EVID 11009 RADIUS Listener Started	Sub Rule	Port Listening	Information
V 2.0 EVID 11010 RADIUS Listener Stopped	Sub Rule	Port Not Listening	Error
V 2.0 EVID 11011 RADIUS Listener Failed	Sub Rule	Listener Failed	Error
V 2.0 EVID 11012 RADIUS Packet Invalid Header	Sub Rule	Packet Contains Invalid Header	Error
V 2.0 EVID 11014 RADIUS Packet Invalid Attribute	Sub Rule	Packet Contains Invalid Attributes	Error
V 2.0 EVID 11015 Access-Req MUST Contain NAS-IP	Sub Rule	General Access	Other Audit Success
V 2.0 EVID 11016 Translating EAP Protocol Result	Sub Rule	General RADIUS Message	Information
V 2.0 EVID 11017 RADIUS Created New Session	Sub Rule	Object Created	Access Success
V 2.0 EVID 11018 RADIUS Re-using Existing Session	Sub Rule	Session Information	Information
V 2.0 EVID 11019 DenyAccess Service Selected	Sub Rule	General POLICY Information	Information
V 2.0 EVID 11020 RADIUS Session Auth Did Not Ret	Sub Rule	Session Error	Error
V 2.0 EVID 11021 RADIUS Could Not Decipher PW	Sub Rule	Password Not Deciphered	Error
V 2.0 EVID 11022 Added DACL Specified In Auth Pro	Sub Rule	Object Added	Access Success
V 2.0 EVID 11023 Requested DCL Not Found	Sub Rule	Requested DACL Not Found	Error
V 2.0 EVID 11024 Missing Msg-Auth Attr In DACL	Sub Rule	Request Rejected	Error
V 2.0 EVID 11025 Missing Cisco-av-pair Attribute	Sub Rule	Request Rejected	Error
V 2.0 EVID 11026 Requested DACL Not Found	Sub Rule	Requested DACL Not Found	Error
V 2.0 EVID 11027 Host Lookup Usecase Detected	Sub Rule	Detected Host Lookup UseCase	Information
V 2.0 EVID 11028 Host Lookup Usecase Detected	Sub Rule	Detected Host Lookup UseCase	Information
V 2.0 EVID 11029 Unsupported RADIUS Packet Type	Sub Rule	Packet Type Unsupported	Warning
V 2.0 EVID 11030 Pre-Parsing Of RADIUS Pkt Fail	Sub Rule	Pre-Parsing Packet Failed	Warning
V 2.0 EVID 11031 Invalid RADIUS Packet Type Req	Sub Rule	Request Not Valid	Warning
V 2.0 EVID 11032 Access Svc Type Is Not Dev Adm	Sub Rule	Access Service Selected	Information
V 2.0 EVID 11033 Service Type Is Not N/W Access	Sub Rule	Access Service Selected	Information
V 2.0 EVID 11034 Process Host Lookup Disabled	Sub Rule	Object Enabled Or Disabled	Information
V 2.0 EVID 11035 Session Associated With The Req	Sub Rule	Request Rejected	Error
V 2.0 EVID 11036 Invalid Msg-Auth RADIUS Attr	Sub Rule	Invalid Attribute	Warning
V 2.0 EVID 11037 Dropped Accounting Request	Sub Rule	Accounting Request Dropped	Warning
V 2.0 EVID 11038 RADIUS Acc-Req Header Invalid	Sub Rule	Invalid Packet Header	Warning
V 2.0 EVID 11039 RADIUS Auth Request Rejected	Sub Rule	Authentication Failure Activity	Authentication Failure
V 2.0 EVID 11040 RADIUS Accounting Req Dropped	Sub Rule	Accounting Request Dropped	Warning
V 2.0 EVID 11041 RADIUS PAP Session Timed Out	Sub Rule	PAP Session Timed Out	Warning
V 2.0 EVID 11042 Duplicate RADIUS Req Received	Sub Rule	Duplicate Request - Retransmitting	Warning
V 2.0 EVID 11043 RADIUS CoA Request Received	Sub Rule	General RADIUS Message	Information
V 2.0 EVID 11044 RADIUS Disconnect Req Received	Sub Rule	Disconnection Request	Network Traffic
V 2.0 EVID 11045 RADIUS CoA ACK Returned	Sub Rule	Returned CoA ACK	Information
V 2.0 EVID 11046 RADIUS CoA NAK Returned	Sub Rule	Returned CoA NAK	Information
V 2.0 EVID 11047 RADIUS Disconnect ACK Returned	Sub Rule	Returned Disconnect ACK	Information
V 2.0 EVID 11048 RADIUS Disconnect NAK Returned	Sub Rule	Returned Disconnect NAK	Information
V 2.0 EVID 11049 RADIUS Default N/W Device Used	Sub Rule	General RADIUS Message	Information
V 2.0 EVID 11051 RAD Pkt Contain Invalid State	Sub Rule	Packet Contains Invalid Attributes	Error
V 2.0 EVID 11052 Unsupported Port Num; Auth Req	Sub Rule	Authentication Failure Activity	Authentication Failure
V 2.0 EVID 11053 Pkt Contains Invalid Attributes	Sub Rule	Packet Contains Invalid Attributes	Error
V 2.0 EVID 11054 Req From Non-wireless Dev Drop	Sub Rule	Request Dropped	Warning
V 2.0 EVID 11055 User Name Change Detected	Sub Rule	Object Modified	Access Success
V 2.0 EVID 11056 Duplicate RADIUS Packet Receive	Sub Rule	Duplicate Packet	Error
V 2.0 EVID 11057 Requested RADIUS Access-Request	Sub Rule	General Access	Other Audit Success
V 2.0 EVID 11100 RADIUS-Client About To Send Req	Sub Rule	General RADIUS Message	Information
V 2.0 EVID 11101 RADIUS-Client Received Response	Sub Rule	Client Received Response	Information
V 2.0 EVID 11102 RADIUS-Client Discarded Invalid	Sub Rule	Client Discarded Invalid Response	Warning
V 2.0 EVID 11103 RADIUS-Client Encountered Error	Sub Rule	Client Encountered Error	Error
V 2.0 EVID 11104 RADIUS-Client Req Timeout Exp	Sub Rule	Timer Expired	Warning
V 2.0 EVID 11105 Req Received Frm KeyWrap Device	Sub Rule	Request Received	Information
V 2.0 EVID 11106 KeyWrap Configuration Error	Sub Rule	Configuration Error	Error
V 2.0 EVID 11107 Missing Req Attrib. For KeyWrap	Sub Rule	Attribute Missing	Warning
V 2.0 EVID 11108 Missing Req EapMessage Attribute	Sub Rule	Attribute Missing	Warning
V 2.0 EVID 11109 Improper KeyWrap & MsgAuth Attr	Sub Rule	Invalid Attributes	Warning
V 2.0 EVID 11110 Req Received Frm KeyWrap Enable	Sub Rule	Request Received	Information
V 2.0 EVID 11111 RADIUS Req Rcvd With KeyWrap	Sub Rule	RADIUS Request Received	Information
V 2.0 EVID 11112 KeyWrap Key Accept Frm PAC_OPAQ	Sub Rule	Transaction Accepted	Other Audit Success
V 2.0 EVID 11113 KeyWrap Not Supported In Proxy	Sub Rule	Attributes Incompatible	Error
V 2.0 EVID 11114 KeyWrap Parameter On RADIUS Req	Sub Rule	General RADIUS Message	Information
V 2.0 EVID 11115 AAA Client Msg Auth Code Key	Sub Rule	General AAA Server Information	Information
V 2.0 EVID 11116 Stitched Existing Session	Sub Rule	Reusing Existing Session	Information
V 2.0 EVID 11117 Generate New Session ID	Sub Rule	Session Information	Information
V 2.0 EVID 11200 Rcvd Invalid Dynamic Auth Req	Sub Rule	Invalid Dynamic Authorization Request Received	Error
V 2.0 EVID 11201 Disconnect Dynamic Auth Req Rcv	Sub Rule	Disconnect Dynamic Authorization Request Received	Information
V 2.0 EVID 11202 Disconn & Port Shutdown Dyn Aut	Sub Rule	Disconn And Port Shutdown Dynamic Auth Req	Information
V 2.0 EVID 11203 Rcvd Disconn & Port Bounce Dyn	Sub Rule	Disconn And Port Bounce Dynamic Auth Req Received	Information
V 2.0 EVID 11204 Reauthenticate Request Received	Sub Rule	Reauthenticate Request Received	Information
V 2.0 EVID 11205 Could Not Find N/W Access Device	Sub Rule	Network Access Device Not Found	Error
V 2.0 EVID 11206 Could Not Find Client ISE Node	Sub Rule	Server Not Found	Error
V 2.0 EVID 11207 Disconn Dynamic Auth Rsp Rcvd	Sub Rule	Disconnect Dynamic Authorization Response	Information
V 2.0 EVID 11208 Disconn & Port Shutdown Dyn Auth	Sub Rule	Disconn And Port Shutdown Dynamic Auth Rsp	Information
V 2.0 EVID 11209 Disconn & Port Bounce Dyn Auth	Sub Rule	Disconn And Port Bounce Dynamic Auth Rsp Received	Information
V 2.0 EVID 11210 Reauthenticate Response Receive	Sub Rule	Reauthenticate Response Received	Information
V 2.0 EVID 11211 Proxying Req To Dyn Auth Client	Sub Rule	Forwarding Request Received	Information
V 2.0 EVID 11212 Forwarding Request To Network	Sub Rule	Forwarding Request To Network Access Device	Information
V 2.0 EVID 11213 Rsp Not Rcvd Frm N/W Access Dev	Sub Rule	No Response Received From Network Access Device	Warning
V 2.0 EVID 11214 Invalid Rsp Rcvd Frm N/W Access	Sub Rule	Invalid Response Received	Warning
V 2.0 EVID 11215 Rsp Not Rcvd Frm Dyn Auth Client	Sub Rule	No Response Received	Warning
V 2.0 EVID 11216 Int Proxy PAC Generation Fail	Sub Rule	PAC Generation Failed	Error
V 2.0 EVID 11217 Disconn Dyn Auth Req Prepared	Sub Rule	Prepared Disconnect Dynamic Authorization Request	Information
V 2.0 EVID 11218 Disconn & Port Shutdown Dyn Auth	Sub Rule	Prepared Disconn And Port Shutdown Dynamic Auth	Information
V 2.0 EVID 11219 Disconn & Port Bounce Dyn Auth	Sub Rule	Prepared Disconn And Port Bounce Dynamic Auth Req	Information
V 2.0 EVID 11220 Reauthenticate Request Prepared	Sub Rule	Prepared Reauthenticate Request	Information
V 2.0 EVID 11221 Disconn Dyn Auth ACK Rsp Rcvd	Sub Rule	Disconnect Dynamic Authorization ACK Rsp Received	Information
V 2.0 EVID 11222 Disconn Dyn Auth NAK Rsp Rcvd	Sub Rule	Disconnect Dynamic Authorization NAK Rsp Received	Information
V 2.0 EVID 11223 Dynamic Auth CoA ACK Rsp Rcvd	Sub Rule	Dynamic Authorization CoA ACK Response Received	Information
V 2.0 EVID 11224 Dynamic Auth CoA NAK Rsp Rcvd	Sub Rule	Dynamic Authorization CoA NAK Response Received	Information
V 2.0 EVID 11225 Dynamic Auth Req Rejected	Sub Rule	Dynamic Auth Req Rejected - Critical Logging Err	Critical
V 2.0 EVID 11226 ISE Proxy Node Dereg Frm Deploy	Sub Rule	Device Unregistered	Warning
V 2.0 EVID 11227 ISE Proxy Node Marked Inactive	Sub Rule	Object Enabled Or Disabled	Information
V 2.0 EVID 11300 Could Not Locate TrustSec Device	Sub Rule	TrustSec Device Not Found	Warning
V 2.0 EVID 11301 TrustSec Device Found	Sub Rule	TrustSec Device Found	Information
V 2.0 EVID 11302 Secure RADIUS Request Received	Sub Rule	RADIUS Request Received	Information
V 2.0 EVID 11303 Could Not Parse Cts-pac-opaque	Sub Rule	RADIUS Request Failure	Warning
V 2.0 EVID 11304 Could Not Retrieve Sec. Grp Tag	Sub Rule	Invalid Tag	Warning
V 2.0 EVID 11305 Could Not Retrieve Sec. Grp ACL	Sub Rule	Unsupported ACL	Warning
V 2.0 EVID 11306 PAC Has Expired	Sub Rule	PAC Expired	Warning
V 2.0 EVID 11307 Incorrect RADIUS CHAP Attribute	Sub Rule	Invalid Attribute	Warning
V 2.0 EVID 11308 Incorrect RADIUS MS-CHAP V1 Att	Sub Rule	Invalid Attribute	Warning
V 2.0 EVID 11309 Incorrect RADIUS MS-CHAP V2 Att	Sub Rule	Invalid Attribute	Warning
V 2.0 EVID 11310 Sent Sec. Grp Access Ctrl List	Sub Rule	General ACL Message	Information
V 2.0 EVID 11311 Failed To Locate ACE Of Sec Grp	Sub Rule	Failed ACL Set	Error
V 2.0 EVID 11312 Fragmented Sec Grp Access Ctrl	Sub Rule	Fragmented Packet Received	Network Traffic
V 2.0 EVID 11313 ISE Detected Unknown SGT Provis	Sub Rule	Flow Admission Control Information	Information
V 2.0 EVID 11314 ISE Detected Malformed TrustSec	Sub Rule	Malformed Object	Suspicious
V 2.0 EVID 11315 TrustSec Env Data Req Failed	Sub Rule	Request Failed To Validate	Warning
V 2.0 EVID 11316 TrustSec CoA Message Ignored	Sub Rule	Message Ignored	Warning
V 2.0 EVID 11317 TrustSec SSH Connection Failed	Sub Rule	Connection Failure	Error
V 2.0 EVID 11318 TrustSec N/W Devices Don't Have	Sub Rule	Configuration Error	Error
V 2.0 EVID 11320 Fragmented Env Data Sent To Clnt	Sub Rule	Fragmented Packet Received	Network Traffic
V 2.0 EVID 11321 Modified TrustSec Default Egress	Sub Rule	Policy Modified : Network	Policy
V 2.0 EVID 11322 Trustsec Egress Policy Success	Sub Rule	Successfully Loaded Policy From Policy Server	Information
V 2.0 EVID 11323 Trustsec Egress Policy Failed	Sub Rule	Policy Could Not Be Updated	Warning
V 2.0 EVID 11324 Mail Send Failed Regarding Work	Sub Rule	Mail Not Sent	Information
V 2.0 EVID 11325 Successfully Downloaded Trustsec	Sub Rule	ACL Messages	Information
V 2.0 EVID 11350 Detected Proxy Loop; Req Dropped	Sub Rule	Request Dropped	Warning
V 2.0 EVID 11351 Failed To Read RADIUS Svr Seq	Sub Rule	Request Dropped	Warning
V 2.0 EVID 11352 Rsp Proxy-State Attr Valid Fail	Sub Rule	Attribute Validation Failed	Error
V 2.0 EVID 11353 No Ext RADIUS Svr; Failover Fail	Sub Rule	Failover Failed	Critical
V 2.0 EVID 11354 Accounting Request Received	Sub Rule	RADIUS Accounting-Request Received	Information
V 2.0 EVID 11355 Forwarding Req To Rem RADIUS Svr	Sub Rule	Forwarding Request To Network Access Device	Information
V 2.0 EVID 11356 Failed To Forward Req To Current	Sub Rule	Forwarding Request Failed	Error
V 2.0 EVID 11357 Successfully Forwarded Request	Sub Rule	Forwarding Request Received	Information
V 2.0 EVID 11358 Req Rcvd For RADIUS Svr Seq	Sub Rule	Request Received	Other Audit Success
V 2.0 EVID 11359 Failed To Forward Req To Current	Sub Rule	Forwarding Request Failed	Error
V 2.0 EVID 11360 RADIUS Svr Seq Failed To Valid	Sub Rule	Radius Request Failed	Error
V 2.0 EVID 11361 Valid Incoming Auth Request	Sub Rule	RADIUS Authentication	Network Traffic
V 2.0 EVID 11362 Valid Incoming Accounting Req	Sub Rule	RADIUS Accounting-Request Received	Information
V 2.0 EVID 11363 RADIUS Svr Seq Perform Loc Acc	Sub Rule	RADIUS Accounting-Request Received	Information
V 2.0 EVID 11364 RADIUS Svr Seq Perform Rem Acc	Sub Rule	RADIUS Accounting-Request Received	Information
V 2.0 EVID 11365 Attributes Modified Before Send	Sub Rule	Object Attribute Modified	Access Success
V 2.0 EVID 11366 Attributes Modified Before Send	Sub Rule	Object Attribute Modified	Access Success
V 2.0 EVID 11367 Could Not Add Attribute	Sub Rule	Modify Object Attribute Failure	Access Failure
V 2.0 EVID 11368 Review Ext RADIUS Server Logs	Sub Rule	Review Classifications	Other Audit Success
V 2.0 EVID 11369 RADIUS Svr Down; Proxy Req Rej	Sub Rule	Request Rejected	Error
V 2.0 EVID 11400 EAP-MSCHAP PW Change Not Allow	Sub Rule	Failed Password Change Attempt	Other Audit Failure
V 2.0 EVID 11401 Successful In-band PAC Prov	Sub Rule	RADIUS Access-Reject Received	Information
V 2.0 EVID 11402 EAP-GTC PW Change Not Allowed	Sub Rule	Failed Password Change Attempt	Other Audit Failure
V 2.0 EVID 11500 Invalid/Unexpected EAP Payload	Sub Rule	Invalid Payload	Warning
V 2.0 EVID 11501 Invalid EAP Payload	Sub Rule	Invalid Payload	Warning
V 2.0 EVID 11502 EAP Packet Contain Invalid Type	Sub Rule	Invalid Packet Received	Information
V 2.0 EVID 11503 Prepared EAP-Success	Sub Rule	Prepared EAP-Success	Information
V 2.0 EVID 11504 Prepared EAP-Failure	Sub Rule	Prepared EAP-Failure	Information
V 2.0 EVID 11506 Prepared EAP-Request/Identity	Sub Rule	Prepared EAP-Request	Information
V 2.0 EVID 11507 Extracted EAP-Response	Sub Rule	Extracted EAP-Response	Information
V 2.0 EVID 11508 EAP-Rsp Contain Invalid Id Data	Sub Rule	Invalid Response Received	Warning
V 2.0 EVID 11509 EAP Protocols Not Allowed	Sub Rule	Protocol Not Allowed	Warning
V 2.0 EVID 11510 Supplicant Declined EAP Method	Sub Rule	Negotiation Failed	Warning
V 2.0 EVID 11511 Extracted EAP-Response/NAK Pkt	Sub Rule	Negotiation Failed	Warning
V 2.0 EVID 11512 Extracted EAP-Response/NAK Pkt	Sub Rule	Negotiation Failed	Warning
V 2.0 EVID 11513 Extracted Second EAP-Rsp/NAK	Sub Rule	Negotiation Failed	Warning
V 2.0 EVID 11514 Empty TLS Message Received	Sub Rule	TLS Negotiation Failure	Warning
V 2.0 EVID 11515 Supplicant Declined Inner EAP	Sub Rule	Negotiation Failed	Warning
V 2.0 EVID 11516 Extracted EAP-Response/NAK Pkt	Sub Rule	Negotiation Failed	Warning
V 2.0 EVID 11517 Extracted EAP-Response/NAK Pkt	Sub Rule	Negotiation Failed	Warning
V 2.0 EVID 11518 Extracted Second EAP-Rsp/NAK	Sub Rule	Negotiation Failed	Warning
V 2.0 EVID 11519 Prepared EAP-Success For Inner	Sub Rule	Prepared EAP-Success	Information
V 2.0 EVID 11520 Prepared EAP-Failure For Inner	Sub Rule	Prepared EAP-Failure	Information
V 2.0 EVID 11521 Prepared EAP-Request For Inner	Sub Rule	Prepared EAP-Request	Information
V 2.0 EVID 11522 Extracted EAP-Rsp For Inner EAP	Sub Rule	Extracted EAP-Response	Information
V 2.0 EVID 11523 Invalid Inner-EAP Payload Rcvd	Sub Rule	Invalid Response Received	Warning
V 2.0 EVID 11524 Invalid Inner-EAP Payload	Sub Rule	Invalid Payload	Warning
V 2.0 EVID 11800 EAP-Request Prepared Proposing	Sub Rule	Prepared EAP-Request	Information
V 2.0 EVID 11801 Extracted EAP-Response/NAK Req	Sub Rule	Extracted EAP-Response NAK	Information
V 2.0 EVID 11802 Extracted EAP-Response Accepting	Sub Rule	Extracted EAP-Response	Information
V 2.0 EVID 11803 EAP-MSCHAP Not Allowed	Sub Rule	Negotiation Failed	Warning
V 2.0 EVID 11804 Extracted EAP-Response Contain	Sub Rule	Extracted EAP-Response	Information
V 2.0 EVID 11805 Prepare EAP-Request	Sub Rule	Prepared EAP-Request	Information
V 2.0 EVID 11806 Prepared EAP-Request For Inner	Sub Rule	Prepared EAP-Request	Information
V 2.0 EVID 11807 Extracted EAP-Response NAK	Sub Rule	Extracted EAP-Response NAK	Information
V 2.0 EVID 11808 Extracted EAP-Response For Inner	Sub Rule	Extracted EAP-Response	Information
V 2.0 EVID 11809 Failed To Negotiate EAP For Inn	Sub Rule	Negotiation Failed	Warning
V 2.0 EVID 11810 Extracted EAP-Rsp For Inner Met	Sub Rule	Extracted EAP-Response	Information
V 2.0 EVID 11811 EAP-Req Prepared For Inner Meth	Sub Rule	Prepared EAP-Request	Information
V 2.0 EVID 11812 EAP-MSCHAP Auth Success	Sub Rule	Authentication Activity	Authentication Success
V 2.0 EVID 11813 EAP-MSCHAP Authentication Fail	Sub Rule	Authentication Failure Activity	Authentication Failure
V 2.0 EVID 11814 EAP-MSCHAP Auth Success	Sub Rule	Authentication Activity	Authentication Success
V 2.0 EVID 11815 EAP-MSCHAP Authentication Fail	Sub Rule	Authentication Failure Activity	Authentication Failure
V 2.0 EVID 11816 MSCHAP Username Doesn't Match	Sub Rule	Username Does Not Match Method	Warning
V 2.0 EVID 11817 Unexpected EAP-MSCHAP Msg Rcv	Sub Rule	Unexpected Authentication Message Received	Error
V 2.0 EVID 11818 EAP-MSCHAP Packet Parse Failed	Sub Rule	Packet Parse Failed	Warning
V 2.0 EVID 11819 EAP-MSCHAP Pkt Rcvd With Invalid	Sub Rule	Invalid Argument	Error
V 2.0 EVID 11821 EAP-MSCHAP PW Chg Attempt Fail	Sub Rule	Failed Password Change Attempt	Other Audit Failure
V 2.0 EVID 11822 EAP-MSCHAP PW Chg Attempt Pass	Sub Rule	Password Modified	Account Modified
V 2.0 EVID 11823 EAP-MSCHAP Auth Attempt Failed	Sub Rule	Authentication Failure Activity	Authentication Failure
V 2.0 EVID 11824 EAP-MSCHAP Auth Attempt Passed	Sub Rule	Authentication Activity	Authentication Success
V 2.0 EVID 11825 Inner Method Username Missing	Sub Rule	Sending Empty Username For User	Error
V 2.0 EVID 12000 Prepared EAP-Request Proposing	Sub Rule	Prepared EAP-Request	Information
V 2.0 EVID 12001 Extracted EAP-Response/NAK Req	Sub Rule	Extracted EAP-Response NAK	Information
V 2.0 EVID 12002 Extracted EAP-Rsp Containing EAP	Sub Rule	Extracted EAP-Response	Information
V 2.0 EVID 12003 Failed Negotiate EAP; EAP-MD5	Sub Rule	General Failed Activity	Failed Activity
V 2.0 EVID 12004 EAP-Response Containing EAP-MD5	Sub Rule	Extracted EAP-Response	Information
V 2.0 EVID 12005 EAP-MD5 Authentication Succeeded	Sub Rule	General Authentication Information	Information
V 2.0 EVID 12006 EAP-MD5 Authentication Failed	Sub Rule	Authentication Failure Activity	Authentication Failure
V 2.0 EVID 12007 Invalid EAP-MD5 State	Sub Rule	Invalid State	Warning
V 2.0 EVID 12008 Failed To Parse EAP-MD5 Packet	Sub Rule	Packet Parse Failed	Warning
V 2.0 EVID 12100 Prepared EAP-Request Proposing	Sub Rule	Prepared EAP-Request	Information
V 2.0 EVID 12101 Extracted EAP-Response/NAK Req	Sub Rule	Extracted EAP-Response NAK	Information
V 2.0 EVID 12102 Extracted EAP-Rsp Containing EAP	Sub Rule	Extracted EAP-Response	Information
V 2.0 EVID 12103 EAP-FAST Not Allowed; Failed	Sub Rule	Negotiation Failed	Warning
V 2.0 EVID 12104 Extracted EAP-Rsp Containing EAP	Sub Rule	Extracted EAP-Response	Information
V 2.0 EVID 12105 EAP-Req Prepared With Anothher	Sub Rule	Prepared EAP-Request	Information
V 2.0 EVID 12106 EAP-FAST Auth Phase Finished	Sub Rule	Authentication Phase Finished	Information
V 2.0 EVID 12107 EAP-FAST Provision Phase Finish	Sub Rule	Provisioning Phase Finished	Information
V 2.0 EVID 12108 EAP-FAST Authentication Failed	Sub Rule	Authentication Failure Activity	Authentication Failure
V 2.0 EVID 12109 EAP-FAST Provision Phase Finish	Sub Rule	Provisioning Phase Finished	Information
V 2.0 EVID 12110 PAC Verification Failed To Pass	Sub Rule	Verification Failed	Warning
V 2.0 EVID 12111 PAC Contain Invalid Authority ID	Sub Rule	Invalid Object Data	Error
V 2.0 EVID 12112 PAC Containing Invalid PAC Type	Sub Rule	Invalid PAC Type	Warning
V 2.0 EVID 12113 Rejecting PAC As PAC Is Expired	Sub Rule	PAC Expired	Warning
V 2.0 EVID 12114 PAC Contains Invalid AuthTag	Sub Rule	Invalid Object Data	Error
V 2.0 EVID 12115 Successfully Finished EAP-FAST	Sub Rule	Update Complete	Information
V 2.0 EVID 12116 EAP-FAST Authentication Failed	Sub Rule	General Failed Activity	Failed Activity
V 2.0 EVID 12117 EAP-FAST Inner Method Finished	Sub Rule	Inner Method Failure	Error
V 2.0 EVID 12118 EAP-FAST Cryptobinding Ver Fail	Sub Rule	Cryptobinding Verification Failed	Warning
V 2.0 EVID 12119 EAP-FAST Needs To Update PAC	Sub Rule	Update Needed For PAC	Information
V 2.0 EVID 12120 Neither Anonymous Nor Auth Prov	Sub Rule	Provisioning Failed	Warning
V 2.0 EVID 12121 Suitable Ciphers Not Available	Sub Rule	Suitable Cyphers Unavailable	Warning
V 2.0 EVID 12122 Suitable Ciphers Not Available	Sub Rule	Suitable Cyphers Unavailable	Warning
V 2.0 EVID 12123 Suitable Ciphers Not Available	Sub Rule	Suitable Cyphers Unavailable	Warning
V 2.0 EVID 12124 EAP-FAST Inner Method Skipped	Sub Rule	Inner Method Skipped	Information
V 2.0 EVID 12125 EAP-FAST Inner Method Start	Sub Rule	Inner Method Success	Information
V 2.0 EVID 12126 EAP-FAST Cryptobinding Ver Pass	Sub Rule	Cryptobinding Verification Passed	Information
V 2.0 EVID 12127 EAP-FAST Client PAC Approved	Sub Rule	Request Approved	Other Audit Success
V 2.0 EVID 12128 EAP-FAST Inner Method Successful	Sub Rule	Inner Method Finished	Information
V 2.0 EVID 12129 EAP-FAST Provisioning Failed	Sub Rule	Provisioning Failed	Warning
V 2.0 EVID 12130 Failed To Decrypt PAC Received	Sub Rule	Decryption Failed	Warning
V 2.0 EVID 12131 EAP-FAST Built Anonymous Tunnel	Sub Rule	Tunnel Created	Network Traffic
V 2.0 EVID 12132 EAP-FAST Built PAC-Based Tunnel	Sub Rule	Tunnel Created	Network Traffic
V 2.0 EVID 12133 Successfully Updated Seed Key	Sub Rule	Update Complete	Information
V 2.0 EVID 12134 Failed To Update Seed Key	Sub Rule	Seed Key Update Failed	Error
V 2.0 EVID 12135 Master Key Updated	Sub Rule	Content Successfully Updated	Information
V 2.0 EVID 12136 NDAC Auth Sent To Client	Sub Rule	General Authentication Information	Information
V 2.0 EVID 12137 NDAC Authentication Received	Sub Rule	Authentication Response Received	Information
V 2.0 EVID 12138 Auth PAC Received From Client	Sub Rule	Authorization Received	Information
V 2.0 EVID 12139 Anonymous TLS Renegotiation Suc	Sub Rule	TLS Message	Information
V 2.0 EVID 12140 Anonymous TLS Renegotiation Fail	Sub Rule	TLS Message	Information
V 2.0 EVID 12141 Failed To Find Legacy Master Key	Sub Rule	Legacy Master Key Not Found	Warning
V 2.0 EVID 12142 Legacy Master Key Expired	Sub Rule	Legacy Master Key Expired	Warning
V 2.0 EVID 12143 Failed To Derive EAP-FAST Master	Sub Rule	General Failed Activity	Failed Activity
V 2.0 EVID 12144 Fallback On Invalid PAC	Sub Rule	Fallback On Invalid PAC	Error
V 2.0 EVID 12145 Cannot Perform Invalid PAC Fall	Sub Rule	Fallback On Invalid PAC	Error
V 2.0 EVID 12146 No Cipher On Client Side	Sub Rule	Suitable Cyphers Unavailable	Warning
V 2.0 EVID 12147 Machine Authentication Disabled	Sub Rule	Machine Authentication Disabled	Warning
V 2.0 EVID 12148 Stateless Sess Resume Not Allow	Sub Rule	Performing Full Authentication	Information
V 2.0 EVID 12149 EAP-FAST Built Anonymous Tunnel	Sub Rule	Tunnel Created	Network Traffic
V 2.0 EVID 12151 Invalid PAC Provisioning	Sub Rule	Fallback On Invalid PAC	Error
V 2.0 EVID 12152 Rejected PAC Provisioning Req	Sub Rule	Provisioning Failed	Warning
V 2.0 EVID 12153 Client Rejected ISE Local-Cert	Sub Rule	SSL Handshake Failure	Error
V 2.0 EVID 12154 EAP-FAST Failed SSL/TLS Handsha	Sub Rule	SSL Handshake Failure	Error
V 2.0 EVID 12155 Tunnel PAC Already Requested	Sub Rule	Tunnel Request Ignored	Warning
V 2.0 EVID 12156 One CTS PAC Already Requested	Sub Rule	Tunnel Request Ignored	Warning
V 2.0 EVID 12157 One Tunnel PAC Already Requested	Sub Rule	Request Ignored	Warning
V 2.0 EVID 12158 One CTS PAC Already Requested	Sub Rule	Request Ignored	Warning
V 2.0 EVID 12159 Machine PAC Already Requested	Sub Rule	Request Ignored	Warning
V 2.0 EVID 12160 Cannot Provision Machine PAC On	Sub Rule	Machine Provisioning Failed	Error
V 2.0 EVID 12161 Stateless Sess. Resume Disabled	Sub Rule	Provisioning Failed	Warning
V 2.0 EVID 12162 Cannot Provision Auth PAC	Sub Rule	Provisioning Failed	Warning
V 2.0 EVID 12163 Authorization PAC Already Req	Sub Rule	Request Ignored	Warning
V 2.0 EVID 12164 Invalid PAC Type Req-Ignoring	Sub Rule	Invalid PAC Type	Warning
V 2.0 EVID 12165 Auth PAC I-ID Does Not Match	Sub Rule	Request Ignored	Warning
V 2.0 EVID 12166 Mac PAC Req Not Contain I-ID	Sub Rule	Request Ignored	Warning
V 2.0 EVID 12167 Auth PAC Provided Only With Tunn	Sub Rule	General Authorization Warning	Warning
V 2.0 EVID 12168 CTS PAC Received From Client	Sub Rule	CTS PAC Received	Information
V 2.0 EVID 12169 EAP-FAST Tunnel PAC Prov Finish	Sub Rule	Provisioning Finished	Information
V 2.0 EVID 12170 EAP-FAST Mac PAC Provision Fin	Sub Rule	Provisioning Finished	Information
V 2.0 EVID 12171 EAP-FAST User Auth PAC Prov Fin	Sub Rule	Provisioning Finished	Information
V 2.0 EVID 12172 EAP-FAST Posture PAC Prov Finish	Sub Rule	Provisioning Finished	Information
V 2.0 EVID 12173 EAP-FAST CTS PAC Prov. Finish	Sub Rule	Provisioning Finished	Information
V 2.0 EVID 12174 Machine PAC Received Frm Client	Sub Rule	Machine PAC Received	Information
V 2.0 EVID 12175 Tunnel PAC Received From Client	Sub Rule	General TUNNEL Message	Information
V 2.0 EVID 12176 EAP-FAST PAC-Less Full H/S Succ	Sub Rule	Handshake Successful	Network Traffic
V 2.0 EVID 12177 No Cipher For PAC-less EAP-FAST	Sub Rule	Suitable Cyphers Unavailable	Warning
V 2.0 EVID 12178 Received Rejected PAC	Sub Rule	PAC Rejected	Warning
V 2.0 EVID 12179 EAP-FAST Mac Auth PAC Prov Fin	Sub Rule	Provisioning Finished	Information
V 2.0 EVID 12200 Approved EAP-FAST Client Tunnel	Sub Rule	Request Approved	Other Audit Success
V 2.0 EVID 12201 Approved EAP-FAST Client Mac	Sub Rule	Request Approved	Other Audit Success
V 2.0 EVID 12202 Approved EAP-FAST Client Auth	Sub Rule	Request Approved	Other Audit Success
V 2.0 EVID 12203 Client Certificate For Auth	Sub Rule	General Authentication Information	Information
V 2.0 EVID 12204 Client Cert Rcvd Inside Tunnel	Sub Rule	Certificate Received For Authentication	Information
V 2.0 EVID 12205 Client Certificate Req Not Rcvd	Sub Rule	Certificate Request	Activity
V 2.0 EVID 12206 Client Cert Rcvd During Tunnel	Sub Rule	Certificate Received For Authentication	Information
V 2.0 EVID 12207 No Client Certificate Received	Sub Rule	Certificate Request	Activity
V 2.0 EVID 12208 Authentication Failed	Sub Rule	Authentication Failure Activity	Authentication Failure
V 2.0 EVID 12209 Starting EAP Chaining	Sub Rule	General Information	Information
V 2.0 EVID 12210 User Authorization PAC Received	Sub Rule	Authorization Received	Information
V 2.0 EVID 12211 Machine Authorization PAC Rcvd	Sub Rule	Authorization Received	Information
V 2.0 EVID 12212 Identity Type Provided By Client	Sub Rule	General Information	Information
V 2.0 EVID 12213 Identity Type Provided By Client	Sub Rule	General Information	Information
V 2.0 EVID 12214 Client Suggest User Identity	Sub Rule	Identity Token	Information
V 2.0 EVID 12215 Client Suggest Machine Identity	Sub Rule	Identity Token	Information
V 2.0 EVID 12216 Identity Type Provided By Client	Sub Rule	Identity Token	Information
V 2.0 EVID 12217 Identity Type Provided By Client	Sub Rule	Identity Token	Information
V 2.0 EVID 12218 Selected Identity Type User	Sub Rule	Identity Token	Information
V 2.0 EVID 12219 Selected Identity Type Machine	Sub Rule	Identity Token	Information
V 2.0 EVID 12220 Client Does Not Support EAP	Sub Rule	Feature Not Supported	Warning
V 2.0 EVID 12221 Clnt Doesnot Support TLS Renego	Sub Rule	TLS Negotiation Failure	Warning
V 2.0 EVID 12222 EAP-FAST PAC-Less Session Resume	Sub Rule	Session Resumed	Other Audit Success
V 2.0 EVID 12223 PAC Ignored During Fallback	Sub Rule	Request Ignored	Warning
V 2.0 EVID 12224 Same Type PAC Already Used	Sub Rule	Request Ignored	Warning
V 2.0 EVID 12225 Same Type PAC Already Used	Sub Rule	Request Ignored	Warning
V 2.0 EVID 12226 Started Renegotiated TLS H/S	Sub Rule	Handshake Started	Network Traffic
V 2.0 EVID 12227 User Authorization PAC Expired	Sub Rule	PAC Has Expired	Warning
V 2.0 EVID 12228 Machine Auth PAC Expired	Sub Rule	PAC Has Expired	Warning
V 2.0 EVID 12229 No Valid PAC Requests On Prov.	Sub Rule	Request Not Valid	Warning
V 2.0 EVID 12230 Ignore PAC Requests In PAC-Less	Sub Rule	Request Ignored	Warning
V 2.0 EVID 12231 Ignore Machine Auth PAC Request	Sub Rule	Request Ignored	Warning
V 2.0 EVID 12232 Specified Master Key Not Found	Sub Rule	Decryption Failed	Warning
V 2.0 EVID 12233 Cisco IP Phone Detected	Sub Rule	IPP Detected	Activity
V 2.0 EVID 12234 Clnt Detected As Cisco IP Phone	Sub Rule	IPP Detected	Activity
V 2.0 EVID 12235 Unexpectedly Received Empty TLS	Sub Rule	Empty Message Received	Warning
V 2.0 EVID 12236 Machine Auth PAC I-ID Not Match	Sub Rule	PAC Rejected	Warning
V 2.0 EVID 12300 Prepared EAP-Request Proposing	Sub Rule	Prepared EAP-Request	Information
V 2.0 EVID 12301 Extracted EAP-Response/NAK Req	Sub Rule	Extracted EAP-Response	Information
V 2.0 EVID 12302 EAP-Rsp Containing PEAP Chlg-Rsp	Sub Rule	Extracted EAP-Response	Information
V 2.0 EVID 12303 Failed To Negotiate EAP	Sub Rule	Negotiation Failed	Warning
V 2.0 EVID 12304 Extracted EAP-Rsp Containing	Sub Rule	Extracted EAP-Response	Information
V 2.0 EVID 12305 Prepared EAP-Req With Another	Sub Rule	Prepared EAP-Request	Information
V 2.0 EVID 12306 PEAP Authentication Succeeded	Sub Rule	Authentication Activity	Authentication Success
V 2.0 EVID 12307 PEAP Authentication Failed	Sub Rule	Authentication Failure Activity	Authentication Failure
V 2.0 EVID 12308 Clnt Sent Res TLV Indicate Fail	Sub Rule	Transfer TLV Failure	Information
V 2.0 EVID 12309 PEAP Handshake Failed	Sub Rule	Handshake Failed	Warning
V 2.0 EVID 12310 PEAP Full Handshake Finished	Sub Rule	Handshake Failed	Warning
V 2.0 EVID 12311 PEAP Session Resumed Successful	Sub Rule	Session Resumed	Other Audit Success
V 2.0 EVID 12312 PEAP Fast-Reconn; Inner Met Skip	Sub Rule	Session Reconnected	Other Audit Success
V 2.0 EVID 12313 PEAP Inner Method Started	Sub Rule	Inner Method Success	Information
V 2.0 EVID 12314 PEAP Inner Method Finished Succ	Sub Rule	Inner Method Finished	Information
V 2.0 EVID 12315 PEAP Inner Method Finish Fail	Sub Rule	Inner Method Failure	Error
V 2.0 EVID 12316 PEAP Version Negotiation Failed	Sub Rule	Negotiation Failed	Warning
V 2.0 EVID 12317 PEAP Fast-Reconnect Failed	Sub Rule	Session Reconnection Failed	Warning
V 2.0 EVID 12318 Success Negotiated PEAP Ver 0	Sub Rule	Negotiation Successful	Network Traffic
V 2.0 EVID 12319 Success Negotiated PEAP Ver 1	Sub Rule	Negotiation Successful	Network Traffic
V 2.0 EVID 12320 Client Failed To Acknowledge Rec	Sub Rule	Client Failed To Acknowledge	Warning
V 2.0 EVID 12321 Client Rejected ISE Local-cert	Sub Rule	Handshake Failed	Warning
V 2.0 EVID 12322 PEAP Failed SSL/TLS Handshake	Sub Rule	Handshake Failed	Warning
V 2.0 EVID 12323 PEAP Cryptobinding Ver. Failed	Sub Rule	Cryptobinding Verification Failed	Warning
V 2.0 EVID 12324 PEAP Cryptobinding Ver. Passed	Sub Rule	Cryptobinding Verification Passed	Information
V 2.0 EVID 12500 Prepared EAP-Request Proposing	Sub Rule	Prepared EAP-Request	Information
V 2.0 EVID 12501 Extracted EAP-Response/NAK Req	Sub Rule	Extracted EAP-Response	Information
V 2.0 EVID 12502 EAP-Response Containing EAP-TLS	Sub Rule	Extracted EAP-Response	Information
V 2.0 EVID 12503 Negotiation Failed As EAP-TLS	Sub Rule	Negotiation Failed	Warning
V 2.0 EVID 12504 Extacted EAP-Response	Sub Rule	Extracted EAP-Response	Information
V 2.0 EVID 12505 Prepared EAP-Req With EAP-TLS	Sub Rule	Prepared EAP-Request	Information
V 2.0 EVID 12506 EAP-TLS Authentication Succeeded	Sub Rule	Authentication Activity	Authentication Success
V 2.0 EVID 12507 EAP-TLS Authentication Failed	Sub Rule	Authentication Failure Activity	Authentication Failure
V 2.0 EVID 12508 EAP-TLS Handshake Failed	Sub Rule	Handshake Failed	Warning
V 2.0 EVID 12509 EAP-TLS Full Handshake Finished	Sub Rule	Handshake Successful	Network Traffic
V 2.0 EVID 12510 EAP-TLS Session Resumed Success	Sub Rule	Session Resumed	Other Audit Success
V 2.0 EVID 12511 Unexpectedly Received TLS Alert	Sub Rule	Message Rejected	Warning
V 2.0 EVID 12512 Unexpected TLS Acknowledge Msg	Sub Rule	Message Rejected	Warning
V 2.0 EVID 12513 Can't Establish EAP TLS SSL Ses	Sub Rule	Cannot Establish Session	Error
V 2.0 EVID 12514 Unknown CA In Clnt Cert-EAP-TLS	Sub Rule	Handshake Failed	Warning
V 2.0 EVID 12515 CRL Expired In Clnt Cert-EAP-TLS	Sub Rule	Handshake Failed	Warning
V 2.0 EVID 12516 Certificate Expired - EAP-TLS	Sub Rule	Handshake Failed	Warning
V 2.0 EVID 12517 Certificate Revoked - EAP-TLS	Sub Rule	Handshake Failed	Warning
V 2.0 EVID 12518 Bad Certificate - EAP-TLS SSL	Sub Rule	Handshake Failed	Warning
V 2.0 EVID 12519 Unsupported Cert - EAP-TLS	Sub Rule	Handshake Failed	Warning
V 2.0 EVID 12520 Client Rejected ISE Local-cert	Sub Rule	Handshake Failed	Warning
V 2.0 EVID 12521 EAP-TLS SSL/TLS Handshake Fail	Sub Rule	Handshake Failed	Warning
V 2.0 EVID 12522 Prepared EAP-Req For Inner Meth	Sub Rule	Prepared EAP-Request	Information
V 2.0 EVID 12523 Extracted EAP-Response/NAK	Sub Rule	Extracted EAP-Response	Information
V 2.0 EVID 12524 Extracted EAP-Rsp Containing	Sub Rule	Extracted EAP-Response	Information
V 2.0 EVID 12525 Failed To Negotiate EAP	Sub Rule	Negotiation Failed	Warning
V 2.0 EVID 12526 Extracted EAP-Rsp For Inner Met	Sub Rule	Extracted EAP-Response	Information
V 2.0 EVID 12527 Prepared EAP-Request For Inner	Sub Rule	Prepared EAP-Request	Information
V 2.0 EVID 12528 Inner EAP-TLS Auth Succeeded	Sub Rule	Authentication Activity	Authentication Success
V 2.0 EVID 12529 Inner EAP-TLS Auth Failed	Sub Rule	Authentication Failure Activity	Authentication Failure
V 2.0 EVID 12530 Client Cert Not Yet Valid	Sub Rule	Handshake Failed	Warning
V 2.0 EVID 12531 Successfully Updated EAP-TLS	Sub Rule	Update Successful	Information
V 2.0 EVID 12532 Fail To Update Seed Key As Obj	Sub Rule	Seed Key Update Failed	Error
V 2.0 EVID 12533 Updated EAP-TLS Master Key	Sub Rule	Update Successful	Information
V 2.0 EVID 12534 EAP-TLS Session Ticket Received	Sub Rule	Session Information	Information
V 2.0 EVID 12535 Expired EAP-TLS Session Ticket	Sub Rule	Session Expired	Information
V 2.0 EVID 12536 Failed To Verify EAP-TLS Session	Sub Rule	Cannot Establish Session	Error
V 2.0 EVID 12537 EAP-TLS Session Ticket Identity	Sub Rule	Parameter Mismatch	Warning
V 2.0 EVID 12538 EAP-TLS Session Ticket Received	Sub Rule	Session Invalidated	Warning
V 2.0 EVID 12539 Failed To Decrypt EAP-TLS Sess	Sub Rule	Decryption Failed	Warning
V 2.0 EVID 12540 EAP-TLS Session Ticket Prov	Sub Rule	Update Successful	Information
V 2.0 EVID 12541 EAP-TLS Need Proactively Update	Sub Rule	Update Required	Information
V 2.0 EVID 12542 Stateless Session Resume Disable	Sub Rule	Performing Full Authentication	Information
V 2.0 EVID 12543 Cannot Generate New Session Tkt	Sub Rule	Failed To Create Session	Error
V 2.0 EVID 12544 EAP-TLS Sess Tkt Contain Invalid	Sub Rule	Authority Failure	Other Audit Failure
V 2.0 EVID 12545 Clnt Requested EAP-TLS Sess Tkt	Sub Rule	Session Information	Information
V 2.0 EVID 12546 EAP-TLS Session Ticket Received	Sub Rule	Performing Full Authentication	Information
V 2.0 EVID 12550 Sent OCSP Req To Primary OCSP	Sub Rule	OCSP Request Sent	Network Traffic
V 2.0 EVID 12551 OCSP Req Sent To Sec OCSP Svr	Sub Rule	OCSP Request Sent	Network Traffic
V 2.0 EVID 12552 OCSP Server Conversation Failure	Sub Rule	OCSP Send Request Failure	Error
V 2.0 EVID 12553 OCSP Response Received	Sub Rule	OCSP Response Received	Network Traffic
V 2.0 EVID 12554 OCSP User Cert Status Is Good	Sub Rule	Certificate Valid	Information
V 2.0 EVID 12555 OCSP User Certificate Revoked	Sub Rule	OCSP Revocation Provider Updated Revocation Info	Information
V 2.0 EVID 12556 OCSP User Cert Status Is Unknown	Sub Rule	OCSP Response Error	Error
V 2.0 EVID 12557 User Auth Failed As OCSP Status	Sub Rule	Authentication Failure Activity	Authentication Failure
V 2.0 EVID 12558 Performed Fallback To Sec OCSP	Sub Rule	Fallback	Information
V 2.0 EVID 12559 Internal Error Occurred	Sub Rule	OCSP Internal Error Handling	Error
V 2.0 EVID 12560 OCSP Server URL Invalid	Sub Rule	OCSP Response Error	Error
V 2.0 EVID 12561 Connection To OCSP Server Fail	Sub Rule	Server Connection Failed	Error
V 2.0 EVID 12562 OCSP Server Response Invalid	Sub Rule	OCSP Response Error	Error
V 2.0 EVID 12563 OCSP Server Returned Error	Sub Rule	OCSP Response Error	Error
V 2.0 EVID 12564 OCSP Svr Not Provide Req Nonce	Sub Rule	OCSP Response Error	Error
V 2.0 EVID 12565 OCSP Server Rsp Nonce Ver. Fail	Sub Rule	OCSP Response Error	Error
V 2.0 EVID 12566 OCSP Server Rsp Time Ver. Fail	Sub Rule	OCSP Response Error	Error
V 2.0 EVID 12567 OCSP Server Rsp Sign Ver. Fail	Sub Rule	OCSP Response Error	Error
V 2.0 EVID 12568 Lookup User Cert Status OCSP	Sub Rule	Certificate Request	Activity
V 2.0 EVID 12569 User Cert Status Not Found OCSP	Sub Rule	Cannot Retrieve Certificates	Error
V 2.0 EVID 12570 Lookup User Cert Status In OCSP	Sub Rule	Certificate Request	Activity
V 2.0 EVID 12571 ISE Continue To CRL Verification	Sub Rule	OCSP Response Error	Error
V 2.0 EVID 12572 OCSP Response Not Cached	Sub Rule	OCSP Response Error	Error
V 2.0 EVID 12600 Prepared EAP-Request Proposing	Sub Rule	Prepared EAP-Request	Information
V 2.0 EVID 12601 Extracted EAP-Response/NAK Req	Sub Rule	Extracted EAP-Response	Information
V 2.0 EVID 12602 Extracted EAP-Response	Sub Rule	Extracted EAP-Response	Information
V 2.0 EVID 12603 Negotiation Failed As EAP-GTC	Sub Rule	Negotiation Failed	Warning
V 2.0 EVID 12604 Extracted EAP-Response	Sub Rule	Extracted EAP-Response	Information
V 2.0 EVID 12605 Prepared EAP-Req With Another	Sub Rule	Prepared EAP-Request	Information
V 2.0 EVID 12606 Prepared EAP-Request Proposing	Sub Rule	Prepared EAP-Request	Information
V 2.0 EVID 12607 Extracted EAP-Rsp/NAK For Inner	Sub Rule	Extracted EAP-Response	Information
V 2.0 EVID 12608 Extraced EAP-Rsp For Inner Meth	Sub Rule	Extracted EAP-Response	Information
V 2.0 EVID 12609 EAP Negotiation Failed For Inned	Sub Rule	Negotiation Failed	Warning
V 2.0 EVID 12610 EAP-Rsp Inner Method Containing	Sub Rule	Extracted EAP-Response	Information
V 2.0 EVID 12611 Prepared EAP-Request Inner Meth	Sub Rule	Prepared EAP-Request	Information
V 2.0 EVID 12612 EAP-GTC Authentication Succeeded	Sub Rule	Authentication Activity	Authentication Success
V 2.0 EVID 12613 EAP-GTC Authentication Failed	Sub Rule	Authentication Failure Activity	Authentication Failure
V 2.0 EVID 12614 Inner EAP-GTC Auth Succeeded	Sub Rule	Authentication Activity	Authentication Success
V 2.0 EVID 12615 Inner EAP-GTC Auth Failed	Sub Rule	Authentication Failure Activity	Authentication Failure
V 2.0 EVID 12616 GTC Username Not Matched Inner	Sub Rule	Username Does Not Match Method	Warning
V 2.0 EVID 12617 Invalid EAP-GTC State	Sub Rule	Invalid State	Warning
V 2.0 EVID 12618 Failed To Parse EAP-GTC Packet	Sub Rule	Packet Parse Failed	Warning
V 2.0 EVID 12619 Rcvd EAP-GTC Pkt: Invalid Argu	Sub Rule	Invalid Argument	Error
V 2.0 EVID 12621 EAP-GTC PW Change Attempt Fail	Sub Rule	Failed Password Change Attempt	Other Audit Failure
V 2.0 EVID 12622 EAP-GTC PW Change Attempt Pass	Sub Rule	Password Change Attempted	Other Audit Failure
V 2.0 EVID 12623 EAP-GTC Auth Attempt Failed	Sub Rule	Authentication Failure Activity	Authentication Failure
V 2.0 EVID 12624 EAP-GTC Auth Attempt Passed	Sub Rule	Authentication Activity	Authentication Success
V 2.0 EVID 12625 EAP-Key-Name Attribute Received	Sub Rule	Attribute Received	Information
V 2.0 EVID 12626 Invalid EAP-Key-Name Attribute	Sub Rule	Invalid Attribute	Warning
V 2.0 EVID 12628 Invalid Operation Performed	Sub Rule	Invalid Operation Performed	Warning
V 2.0 EVID 12650 Invalid Operation Performed	Sub Rule	Invalid Operation Performed	Warning
V 2.0 EVID 12651 Accept Clnt Authenticated Prov	Sub Rule	Provisioning Finished	Information
V 2.0 EVID 12652 Accept Client After Invalid PAC	Sub Rule	Provisioning Finished	Information
V 2.0 EVID 12653 Negotiation Failed As Anonymous	Sub Rule	Negotiation Failed	Warning
V 2.0 EVID 12700 Prepared EAP-Request Proposing	Sub Rule	Prepared EAP-Request	Information
V 2.0 EVID 12701 Extracted EAP-Rsp/NAK Req LEAP	Sub Rule	Extracted EAP-Response	Information
V 2.0 EVID 12702 Extracted EAP-Rsp Containing	Sub Rule	Extracted EAP-Response	Information
V 2.0 EVID 12703 LEAP Not Allowed- Failed To Neg	Sub Rule	Negotiation Failed	Warning
V 2.0 EVID 12704 LEAP Completed	Sub Rule	LEAP Completed	Information
V 2.0 EVID 12705 LEAP Authentication Passed	Sub Rule	Authentication Activity	Authentication Success
V 2.0 EVID 12706 LEAP Authentication Failed	Sub Rule	Authentication Failure Activity	Authentication Failure
V 2.0 EVID 12707 LEAP Authentication Error	Sub Rule	Authentication Error	Error
V 2.0 EVID 12708 LEAP Packet Validation Failed	Sub Rule	Validation Failed	Warning
V 2.0 EVID 12709 LEAP Packet Parsing Failed	Sub Rule	Parsing Failed	Warning
V 2.0 EVID 12710 LEAP Internal Err-Invalid State	Sub Rule	Invalid State	Warning
V 2.0 EVID 12711 LEAP Challenge Not Created	Sub Rule	Challenge Not Created	Error
V 2.0 EVID 12712 LEAP Int Err- Sess Key Not Crea	Sub Rule	Internal Error Occurred	Error
V 2.0 EVID 12750 EAP-MSCHAP Not Allow Under PEAP	Sub Rule	Negotiation Failed	Warning
V 2.0 EVID 12751 EAP-MSCHAP Not Allowed Under EAP	Sub Rule	Negotiation Failed	Warning
V 2.0 EVID 12752 EAP-TLS Not Allowed Under PEAP	Sub Rule	Negotiation Failed	Warning
V 2.0 EVID 12753 EAP-TLS Not Allowed Under EAP	Sub Rule	Negotiation Failed	Warning
V 2.0 EVID 12754 EAP-GTC Not Allowed Under PEAP	Sub Rule	Negotiation Failed	Warning
V 2.0 EVID 12755 EAP-GTC Not Allowed Under EAP	Sub Rule	Negotiation Failed	Warning
V 2.0 EVID 12800 Extracted 1st TLS Rec- TLS H/S	Sub Rule	Handshake Started	Network Traffic
V 2.0 EVID 12801 Prepared TLS ChangeCipherSpec	Sub Rule	Prepared TLS Message	Information
V 2.0 EVID 12802 Prepared TLS Finished Message	Sub Rule	Prepared TLS Message	Information
V 2.0 EVID 12803 Extracted TLS ChangeCipherSpec	Sub Rule	Extracted TLS Message	Information
V 2.0 EVID 12804 Extracted TLS Finished Message	Sub Rule	Extracted TLS Message	Information
V 2.0 EVID 12805 Extracted TLS ClientHello Msg	Sub Rule	Extracted TLS Message	Information
V 2.0 EVID 12806 Prepared TLS ServerHello Msg	Sub Rule	Prepared TLS Message	Information
V 2.0 EVID 12807 Prepared TLS Certificate Msg	Sub Rule	Prepared TLS Message	Information
V 2.0 EVID 12808 Prepared TLS ServerKeyExchange	Sub Rule	Prepared TLS Message	Information
V 2.0 EVID 12809 Prepared TLS CertificateRequest	Sub Rule	Prepared TLS Message	Information
V 2.0 EVID 12810 TLS ServerDone Message	Sub Rule	Prepared TLS Message	Information
V 2.0 EVID 12811 Extracted TLS Certificate Msg	Sub Rule	Extracted TLS Message	Information
V 2.0 EVID 12812 Extracted TLS ClientKeyExchange	Sub Rule	Extracted TLS Message	Information
V 2.0 EVID 12813 Extracted TLS CertificateVerify	Sub Rule	Extracted TLS Message	Information
V 2.0 EVID 12814 Prepared TLS Alert Message	Sub Rule	Prepared TLS Message	Information
V 2.0 EVID 12815 Extracted TLS Alert Message	Sub Rule	Extracted TLS Message	Information
V 2.0 EVID 12816 TLS Handshake Succeeded	Sub Rule	Handshake Successful	Network Traffic
V 2.0 EVID 12817 TLS Handshake Failed	Sub Rule	Handshake Failed	Warning
V 2.0 EVID 12818 TLS Acknow Expect For Last Alert	Sub Rule	Unexpected Message	Other Operations
V 2.0 EVID 12819 TLS Acknow Expect For H/S Succ	Sub Rule	Unexpected Message	Other Operations
V 2.0 EVID 12830 CRL Verification Bypassed	Sub Rule	CRL Retrieval Failure	Error
V 2.0 EVID 12831 Unable To Download CRL	Sub Rule	CRL Could Not Be Retrieved	Information
V 2.0 EVID 12832 Tunnel Build Loc Svr Cert Inval	Sub Rule	Server Certificate Validation Failure	Other Audit Failure
V 2.0 EVID 12833 EAP-FAST Prov Mode Restricted	Sub Rule	Restricted Attributes Found	Information
V 2.0 EVID 12834 ISE Used CRL Inactive/Expired	Sub Rule	CRL Expired	Warning
V 2.0 EVID 12835 Expired Cert Accepted Frm Clnt	Sub Rule	Certificate Expired	Warning
V 2.0 EVID 12850 Received NAK TLV - Conversation	Sub Rule	Client Rejected Conversation	Warning
V 2.0 EVID 12851 Received Unexpected EAP NAK Msg	Sub Rule	Client Rejected Conversation	Warning
V 2.0 EVID 12852 Cryptographic Processing Of Buf	Sub Rule	Cryptographic Failure	Error
V 2.0 EVID 12853 Empty EAP-GTC Message Received	Sub Rule	Empty Message Received	Warning
V 2.0 EVID 12854 Not Auth Because PW Not Present	Sub Rule	Password Missing	Warning
V 2.0 EVID 12855 PAC Not Sent Due To Auth Fail	Sub Rule	Authorization Failed	Warning
V 2.0 EVID 12856 User Certificate Revoked By CRL	Sub Rule	Revoke Certificate Request	Activity
V 2.0 EVID 12857 Client Certificate Auth Failed	Sub Rule	Client Authentication Failure	Warning
V 2.0 EVID 12914 Weak TLS Cipher Used	Sub Rule	Cipher Incompatible	Warning
V 2.0 EVID 12915 PEAP Version Negotiation Failed	Sub Rule	Version Negotiation Failed	Warning
V 2.0 EVID 12916 TLS Acknow For TLS Fragment Exp	Sub Rule	Unexpected Message	Other Operations
V 2.0 EVID 12917 TLS Acknow PEAPv1 Protected	Sub Rule	Unexpected Message	Other Operations
V 2.0 EVID 12918 Supplicant Sent Unmatch EAP Rsp	Sub Rule	Parameter Mismatch	Warning
V 2.0 EVID 12919 Supplicant Sent Unmatched Inner	Sub Rule	Parameter Mismatch	Warning
V 2.0 EVID 12929 NAS Sends RADIUS Acc Update Msg	Sub Rule	RADIUS Warning	Warning
V 2.0 EVID 12930 Supplicant Stopped Responding	Sub Rule	Module Is Not Responding To Configuration Requests	Warning
V 2.0 EVID 12931 Supplicant Stopped Responding	Sub Rule	Module Is Not Responding To Configuration Requests	Warning
V 2.0 EVID 12932 Supplicant Stopped Responding	Sub Rule	Module Is Not Responding To Configuration Requests	Warning
V 2.0 EVID 12933 Supplicant Stopped Responding	Sub Rule	Module Is Not Responding To Configuration Requests	Warning
V 2.0 EVID 12934 Supplicant Stopped Responding	Sub Rule	Module Is Not Responding To Configuration Requests	Warning
V 2.0 EVID 12935 Supplicant Stopped Responding	Sub Rule	Module Is Not Responding To Configuration Requests	Warning
V 2.0 EVID 12936 Supplicant Stopped Responding	Sub Rule	Module Is Not Responding To Configuration Requests	Warning
V 2.0 EVID 12937 Supplicant Stopped Responding	Sub Rule	Module Is Not Responding To Configuration Requests	Warning
V 2.0 EVID 12938 Supplicant Stopped Responding	Sub Rule	Module Is Not Responding To Configuration Requests	Warning
V 2.0 EVID 12939 Supplicant Stopped Responding	Sub Rule	Module Is Not Responding To Configuration Requests	Warning
V 2.0 EVID 12940 Supplicant Stopped Responding	Sub Rule	Module Is Not Responding To Configuration Requests	Warning
V 2.0 EVID 12941 Supplicant Stopped Responding	Sub Rule	Module Is Not Responding To Configuration Requests	Warning
V 2.0 EVID 12942 Supplicant Stopped Responding	Sub Rule	Module Is Not Responding To Configuration Requests	Warning
V 2.0 EVID 12943 Supplicant Stopped Responding	Sub Rule	Module Is Not Responding To Configuration Requests	Warning
V 2.0 EVID 12944 Supplicant Stopped Responding	Sub Rule	Module Is Not Responding To Configuration Requests	Warning
V 2.0 EVID 12945 Supplicant Stopped Responding	Sub Rule	Module Is Not Responding To Configuration Requests	Warning
V 2.0 EVID 12946 Supplicant Stopped Responding	Sub Rule	Module Is Not Responding To Configuration Requests	Warning
V 2.0 EVID 12947 Supplicant Stopped Responding	Sub Rule	Module Is Not Responding To Configuration Requests	Warning
V 2.0 EVID 12948 Supplicant Sent Unexpected	Sub Rule	Unexpected Message	Other Operations
V 2.0 EVID 12949 Supplicant Sent Malformed PEAP	Sub Rule	Malformed Object	Suspicious
V 2.0 EVID 12950 Supplicant Sent Malformed PEAP	Sub Rule	Malformed Object	Suspicious
V 2.0 EVID 12951 Unexpected Renegotiation Rcvd	Sub Rule	Mechanism Not Supported	Warning
V 2.0 EVID 12952 Received EAP Packet	Sub Rule	Unexpected Return Result	Warning
V 2.0 EVID 12953 EAP Pkt Rcvd- Session Not Found	Sub Rule	Unexpected Return Result	Warning
V 2.0 EVID 12954 CRL Signature Check Failed	Sub Rule	CRL Validation Failure	Error
V 2.0 EVID 12955 RADIUS Request Contains EAP Msg	Sub Rule	Message Didn't Include Message-Authenticator	Warning
V 2.0 EVID 12956 Name Constraints Permitted	Sub Rule	Validation Failed	Warning
V 2.0 EVID 12957 Name Constraints Excluded	Sub Rule	Validation Failed	Warning
V 2.0 EVID 12958 Min Or Max Name Constraints	Sub Rule	Validation Failed	Warning
V 2.0 EVID 12959 Unsupported Name Constraint	Sub Rule	Validation Failed	Warning
V 2.0 EVID 12960 Bad/Unsupported Name Constraint	Sub Rule	Validation Failed	Warning
V 2.0 EVID 12961 Bad/Unsupported Name Syntax	Sub Rule	Validation Failed	Warning
V 2.0 EVID 12962 User Authorization PAC Reject	Sub Rule	Authorization Failed	Warning
V 2.0 EVID 12963 Received Malformed EAP Payload	Sub Rule	Malformed Object	Suspicious
V 2.0 EVID 12964 Sent EAP Res TLV Indicate Succ	Sub Rule	Successful Activity	Other Audit Success
V 2.0 EVID 12965 Sent EAP Res TLV Indicate Fail	Sub Rule	Client Indicates Failure	Warning
V 2.0 EVID 12966 Sent EAP Intermed Res TLV Succ	Sub Rule	Successful Activity	Other Audit Success
V 2.0 EVID 12967 Sent EAP Intermed Res TLV Fail	Sub Rule	Client Indicates Failure	Warning
V 2.0 EVID 12968 Clnt Not Provide Suitable Cipher	Sub Rule	Cipher Incompatible	Warning
V 2.0 EVID:12970 EAP-TTLS Inner Meth Finished Fail	Sub Rule	Inner Method Failure	Error
V 2.0 EVID 12971 Extracted EAP-Response	Sub Rule	Extracted EAP-Response	Information
V 2.0 EVID 12972 EAP-TTLS Failed SSL As ISE Loc	Sub Rule	SSL Handshake Failure	Error
V 2.0 EVID 12973 EAP-TTLS Failed SSL After Client	Sub Rule	SSL Handshake Failure	Error
V 2.0 EVID 12974 EAP-TTLS Handshake Failed	Sub Rule	Handshake Failed	Warning
V 2.0 EVID 12975 EAP-TTLS Auth Succeeded	Sub Rule	Authentication Activity	Authentication Success
V 2.0 EVID 12976 EAP-TTLS Authentication Failed	Sub Rule	Authentication Failure Activity	Authentication Failure
V 2.0 EVID 12977 EAP-TTLS Built Tunnel As Per Ear	Sub Rule	Tunnel Created	Network Traffic
V 2.0 EVID 12978 Extracted EAP-Response	Sub Rule	Extracted EAP-Response	Information
V 2.0 EVID 12979 Extracted EAP-Response/NAK Req	Sub Rule	Extracted EAP-Response NAK	Information
V 2.0 EVID 12980 EAP-TTLS Not Allow- Failed Nego	Sub Rule	Negotiation Failed	Warning
V 2.0 EVID 12981 Supplicant Stopped Responding	Sub Rule	Module Is Not Responding To Configuration Requests	Warning
V 2.0 EVID 12982 Supplicant Stopped Responding	Sub Rule	Module Is Not Responding To Configuration Requests	Warning
V 2.0 EVID 12983 Prepared EAP-Request Proposing	Sub Rule	Prepared EAP-Request	Information
V 2.0 EVID 12984 Unexpected Renegotiation Rcvd	Sub Rule	Unexpected Event	Warning
V 2.0 EVID 12985 Prepared EAP-Req With Another	Sub Rule	Prepared EAP-Request	Information
V 2.0 EVID 12986 Not Allow Client TLSv1.0/TLSv1.1	Sub Rule	TLS Message	Information
V 2.0 EVID 12987 Take OCSP Servers List From AIA	Sub Rule	General Server Information	Information
V 2.0 EVID 12988 Take OCSP Servers List From OCS	Sub Rule	General Server Information	Information
V 2.0 EVID 12989 OCSP Request Sent	Sub Rule	OCSP Request Sent	Network Traffic
V 2.0 EVID 12990 No Valid OCSP Server URLs Found	Sub Rule	General Server Information	Information
V 2.0 EVID 12991 No More OCSP Servers AIA Ext	Sub Rule	General Server Information	Information
V 2.0 EVID 12992 No AIA Extension Client Cert	Sub Rule	General Information	Information
V 2.0 EVID 12993 User Auth Failed As OCSP Unreac	Sub Rule	Authentication Failure Activity	Authentication Failure
V 2.0 EVID:12994 EAP-TTLS Inner Met CHAP Not Allow	Sub Rule	CHAP Not Allowed	Warning
V 2.0 EVID 12995 EAP-TTLS Inner Method MSCHAPv1	Sub Rule	CHAP Not Allowed	Warning
V 2.0 EVID 12996 EAP-TTLS Inner Method MSCHAPv2	Sub Rule	MS-CHAP V2 Not Allowed	Warning
V 2.0 EVID 12997 EAP-TTLS Inner Met PAP Not Allo	Sub Rule	PAP Not Allowed	Information
V 2.0 EVID 12998 EAP-MD5 Not Allow Under EAP-TTLS	Sub Rule	Negotiation Failed	Warning
V 2.0 EVID 12999 NAK Inner Method Requesting	Sub Rule	Extracted EAP-Response NAK	Information
V 2.0 EVID 11525 NDAC Authentication Sent	Sub Rule	Authentication Activity	Authentication Success
V 2.0 EVID 11526 NDAC Authentication Rsp Rcvd	Sub Rule	Authentication Response Received	Information
V 2.0 EVID 11527 TEAP Tunnel PAC Prov Finished	Sub Rule	Provisioning Finished	Information
V 2.0 EVID 11528 TEAP Machine PAC Prov Finished	Sub Rule	Provisioning Finished	Information
V 2.0 EVID 11529 TEAP User Auth PAC Prov Finish	Sub Rule	Provisioning Finished	Information
V 2.0 EVID 11530 TEAP Mac Auth PAC Prov Finished	Sub Rule	Provisioning Finished	Information
V 2.0 EVID 11531 Successfully Finished TEAP CTS	Sub Rule	Provisioning Finished	Information
V 2.0 EVID 11532 Successfully Finished TEAP Post	Sub Rule	Provisioning Finished	Information
V 2.0 EVID 11533 Successfully Finished TEAP PAC	Sub Rule	Provisioning Finished	Information
V 2.0 EVID 11534 One Tunnel PAC Already Request	Sub Rule	Tunnel Request Ignored	Warning
V 2.0 EVID 11535 One CTS PAC Already Requested	Sub Rule	Tunnel Request Ignored	Warning
V 2.0 EVID 11536 Another CTS PAC Req Ignored	Sub Rule	Request Ignored	Warning
V 2.0 EVID 11537 Another CTS PAC Request Ignored	Sub Rule	Request Ignored	Warning
V 2.0 EVID 11538 One Machine PAC Already Request	Sub Rule	Request Ignored	Warning
V 2.0 EVID 11539 One Auth PAC Already Requested	Sub Rule	Request Ignored	Warning
V 2.0 EVID 11540 Invalid PAC Type Requested	Sub Rule	Invalid PAC Type	Warning
V 2.0 EVID 11541 Ignore PAC Send By Supplicant	Sub Rule	Fallback On Invalid PAC	Error
V 2.0 EVID 11542 Ignore User Auth PAC Req	Sub Rule	Request Ignored	Warning
V 2.0 EVID 11543 Ignore Machine Auth PAC Req	Sub Rule	Request Ignored	Warning
V 2.0 EVID 11544 ISE Ignored Machine Auth PAC Req	Sub Rule	Request Ignored	Warning
V 2.0 EVID 11545 Machine Authentication Disabled	Sub Rule	Machine Authentication Disabled	Warning
V 2.0 EVID 11546 Performing Full Authentication	Sub Rule	Performing Full Authentication	Information
V 2.0 EVID 11547 Machine PAC Provisioned	Sub Rule	Machine Provisioning Failed	Error
V 2.0 EVID 11548 Stateless Sess Resume Disabled	Sub Rule	Provisioning Failed	Warning
V 2.0 EVID 11549 Cannot Provision Auth PAC	Sub Rule	Provisioning Failed	Warning
V 2.0 EVID 11550 Auth PAC Can Be Provided	Sub Rule	General Information	Information
V 2.0 EVID 11551 Auth PAC I-ID Not Match User Id	Sub Rule	Request Ignored	Warning
V 2.0 EVID 11552 Machine PAC Req Not Contain I-ID	Sub Rule	Request Ignored	Warning
V 2.0 EVID 11553 User Authorization PAC Rejected	Sub Rule	PAC Rejected	Warning
V 2.0 EVID 11554 Authorization PAC Received	Sub Rule	Authorization Received	Information
V 2.0 EVID 11555 User Authorization PAC Received	Sub Rule	Authorization Received	Information
V 2.0 EVID 11556 Machine Authorization PAC Rcvd	Sub Rule	Authorization Received	Information
V 2.0 EVID 11557 Client Certificate For Auth	Sub Rule	General Authentication Information	Information
V 2.0 EVID 11558 Client Cert Rcvd Inside Tunnel	Sub Rule	Certificate Received For Authentication	Information
V 2.0 EVID 11559 Client Cert Req But Not Rcvd	Sub Rule	Certificate Request	Activity
V 2.0 EVID 11560 Client Cert Rcvd During Tunnel	Sub Rule	Certificate Received For Authentication	Information
V 2.0 EVID 11561 Client Cert Req But Not Rcvd	Sub Rule	Certificate Request	Activity
V 2.0 EVID 11562 Client Cert Rcvd But Auth Fail	Sub Rule	Authentication Failure Activity	Authentication Failure
V 2.0 EVID 11563 TEAP Inner Method Skip	Sub Rule	Inner Method Skipped	Information
V 2.0 EVID 11564 TEAP Inner Method Start	Sub Rule	Inner Method Success	Information
V 2.0 EVID 11565 TEAP Inner Method Successfully	Sub Rule	Inner Method Finished	Information
V 2.0 EVID 11566 TEAP Inner Method Finished Fail	Sub Rule	Inner Method Failure	Error
V 2.0 EVID 11567 Identity Type Provided By Client	Sub Rule	General Information	Information
V 2.0 EVID 11568 ISE Requested Identity Type	Sub Rule	General Information	Information
V 2.0 EVID 11569 Client Suggested User Identity	Sub Rule	General Information	Information
V 2.0 EVID 11570 Machine Identity Type	Sub Rule	General Information	Information
V 2.0 EVID 11571 Identity Type Already Used For	Sub Rule	General Information	Information
V 2.0 EVID 11572 Current Identity Type Unsupport	Sub Rule	Unsupported Operation Requested	Warning
V 2.0 EVID 11573 Identity Type User	Sub Rule	General Information	Information
V 2.0 EVID 11574 Identity Type Machine	Sub Rule	General Information	Information
V 2.0 EVID 11575 Client Doesn't Support EAP Chain	Sub Rule	General Information	Information
V 2.0 EVID 11576 TEAP Cryptobinding Ver. Passed	Sub Rule	Cryptobinding Verification Passed	Information
V 2.0 EVID 11577 TEAP Cryptobinding Ver. Failed	Sub Rule	Cryptobinding Verification Failed	Warning
V 2.0 EVID 11578 Rejected PAC Provisioning Req	Sub Rule	PAC Rejected	Warning
V 2.0 EVID 11579 No Valid PAC Requests On Prov.	Sub Rule	Request Not Valid	Warning
V 2.0 EVID 11580 Unexpectedly Rcvd Rejected PAC	Sub Rule	Unexpected Event	Warning
V 2.0 EVID 11581 Perform Fallback On Invalid PAC	Sub Rule	Fallback On Invalid PAC	Error
V 2.0 EVID 11582 Approved TEAP Client Tunnel PAC	Sub Rule	Request Approved	Other Audit Success
V 2.0 EVID 11583 Approved TEAP Client Machine PAC	Sub Rule	Request Approved	Other Audit Success
V 2.0 EVID 11584 Approved TEAP Client Auth PAC	Sub Rule	Request Approved	Other Audit Success
V 2.0 EVID 11585 Tunnel PAC Received	Sub Rule	General TUNNEL Message	Information
V 2.0 EVID 11586 Machine PAC Received	Sub Rule	Machine PAC Received	Information
V 2.0 EVID 11587 CTS PAC Received	Sub Rule	CTS PAC Received	Information
V 2.0 EVID 11588 Supplicant Failed To Adhere Prot	Sub Rule	General Failed Activity	Failed Activity
V 2.0 EVID 11589 TLS Renegotiation Succeeded	Sub Rule	TLS Message	Information
V 2.0 EVID 11590 TLS Renegotiation Failed	Sub Rule	TLS Message	Information
V 2.0 EVID 11591 Accept Client On Authenticated	Sub Rule	Authentication Activity	Authentication Success
V 2.0 EVID 11592 Prepared RADIUS Access-Reject	Sub Rule	Prepared Access-Reject	Information
V 2.0 EVID 11593 TEAP Provisioning Failed	Sub Rule	Provisioning Failed	Warning
V 2.0 EVID 11594 Client Certificate Auth Failed	Sub Rule	Authentication Failure Activity	Authentication Failure
V 2.0 EVID 11595 TEAP Challenge-Response	Sub Rule	Extracted EAP-Response	Information
V 2.0 EVID 11596 Prepared EAP-Req With Another	Sub Rule	Prepared EAP-Request	Information
V 2.0 EVID 11597 TEAP Auth Phase Finished	Sub Rule	Authentication Phase Finished	Information
V 2.0 EVID 11598 TEAP Authentication Failed	Sub Rule	Authentication Failure Activity	Authentication Failure
V 2.0 EVID 11599 TEAP Provisioning Phase Finished	Sub Rule	Provisioning Finished	Information
V 2.0 EVID 11600 TEAP Provisioning Phase Finished	Sub Rule	Provisioning Finished	Information
V 2.0 EVID 11601 TEAP Failed SSL/TLS Handshake	Sub Rule	SSL Handshake Failure	Error
V 2.0 EVID 11602 TEAP Failed SSL/TLS Handshake	Sub Rule	SSL Handshake Failure	Error
V 2.0 EVID 11603 PAC Verification Failed	Sub Rule	Verification Failed	Warning
V 2.0 EVID 11604 PAC Contains Invalid Authority	Sub Rule	Invalid Object Data	Error
V 2.0 EVID 11605 PAC Contains Invalid PAC Type	Sub Rule	Invalid PAC Type	Warning
V 2.0 EVID 11606 PAC Expired	Sub Rule	PAC Expired	Warning
V 2.0 EVID 11607 Authorization PAC Expired	Sub Rule	PAC Expired	Warning
V 2.0 EVID 11608 Machine Auth PAC Expired	Sub Rule	PAC Expired	Warning
V 2.0 EVID 11609 PAC Cannot Decrypt	Sub Rule	Decryption Failed	Warning
V 2.0 EVID 11610 Invalid Authentication Tag	Sub Rule	Invalid Object Data	Error
V 2.0 EVID 11611 Failed To Decrypt PAC	Sub Rule	Decryption Failed	Warning
V 2.0 EVID 11612 Fail To Derive TEAP Master Key	Sub Rule	General Failed Activity	Failed Activity
V 2.0 EVID 11613 Fallback On Invalid PAC	Sub Rule	Fallback On Invalid PAC	Error
V 2.0 EVID 11614 Cannot Perform More Then One	Sub Rule	Fallback On Invalid PAC	Error
V 2.0 EVID 11615 No Cipher On For Invalid PAC	Sub Rule	Suitable Cyphers Unavailable	Warning
V 2.0 EVID 11616 Neither Anonymous Nor Authentic	Sub Rule	Provisioning Failed	Warning
V 2.0 EVID 11617 Client Didn't Provide Suitable	Sub Rule	Suitable Cyphers Unavailable	Warning
V 2.0 EVID 11618 Client Didn't Provide Suitable	Sub Rule	Suitable Cyphers Unavailable	Warning
V 2.0 EVID 11619 Client Didn't Provide Suitable	Sub Rule	Suitable Cyphers Unavailable	Warning
V 2.0 EVID 11620 TEAP Full Handshake Finish	Sub Rule	Handshake Successful	Network Traffic
V 2.0 EVID 11621 TEAP PAC-Less Session Resumed	Sub Rule	Session Resumed	Other Audit Success
V 2.0 EVID 11622 TEAP Built Authenticated Tunnel	Sub Rule	Tunnel Created	Network Traffic
V 2.0 EVID 11623 TEAP Built Anonymous Tunnel	Sub Rule	Tunnel Created	Network Traffic
V 2.0 EVID 11624 TEAP Built PAC-Based Tunnel	Sub Rule	Tunnel Created	Network Traffic
V 2.0 EVID 11625 No Cipher For PAC-Less TEAP Auth	Sub Rule	Suitable Cyphers Unavailable	Warning
V 2.0 EVID 11626 Empty TLS Msg Rcvd During TEAP	Sub Rule	TLS Message	Information
V 2.0 EVID 11627 EAP Chaining Start	Sub Rule	General Information	Information
V 2.0 EVID 11628 TEAP Need Proactively Update	Sub Rule	Update Needed For PAC	Information
V 2.0 EVID 11629 Machine Auth PAC I-ID Not Match	Sub Rule	Request Ignored	Warning
V 2.0 EVID 11630 TEAP Channelbinding Ver. Passed	Sub Rule	General Information	Information
V 2.0 EVID 11631 TEAP Channelbinding Ver Failed	Sub Rule	Verification Failure	Error
V 2.0 EVID 11632 Prepared Identity Type Tlv For	Sub Rule	General Information	Information
V 2.0 EVID 11633 Client Req TLSv1.1 Not Allowed	Sub Rule	TLS Message	Information
V 2.0 EVID 11634 TLS Of Unknown Version	Sub Rule	TLS Message	Information
V 2.0 EVID 11635 EMSK To MSK Downgrading Not Allo	Sub Rule	Downgrading	Information
V 2.0 EVID 11636 Client Cert Requested Not Rcvd	Sub Rule	Certificate Request	Activity
V 2.0 EVID 11637 Inner Method Supports EMSK	Sub Rule	Downgrading	Information
V 2.0 EVID 12756 Prepared EAP-Request Proposing	Sub Rule	Prepared EAP-Request	Information
V 2.0 EVID 12757 NAK Requesting To Use TEAP	Sub Rule	Extracted EAP-Response NAK	Information
V 2.0 EVID 12758 EAP-Response Containing TEAP	Sub Rule	Extracted EAP-Response	Information
V 2.0 EVID 12759 TEAP Not Allowed- Failed To Neg	Sub Rule	General Failed Activity	Failed Activity
V 2.0 EVID 12760 EAP-MSCHAP Not Allow Under TEAP	Sub Rule	General Failed Activity	Failed Activity
V 2.0 EVID 12761 EAP-TLS Not Allowed Under TEAP	Sub Rule	General Failed Activity	Failed Activity
V 2.0 EVID 12762 EAP-GTC Not Allowed Under TEAP	Sub Rule	General Failed Activity	Failed Activity
V 2.0 EVID 12921 Supplicant Stopped Responding	Sub Rule	Module Is Not Responding To Configuration Requests	Warning
V 2.0 EVID 12928 Supplicant Stopped Responding	Sub Rule	Module Is Not Responding To Configuration Requests	Warning

Mapping with LogRhythm Schema

Device Key in Log Message	LogRhythm Schema	Data Type	Schema Description
pri_num	N/A	N/A	Priority value of the message, a combination of the facility value and the severity value of the message. Priority value = (facility value * 8) + severity value. The facility code valid options are: LOCAL0 (Code = 16) LOCAL1 (Code = 17) LOCAL2 (Code = 18) LOCAL3 (Code = 19) LOCAL4 (Code = 20) LOCAL5 (Code = 21) LOCAL6 (Code = 22; default) LOCAL7 (Code = 23)
time	N/A	N/A	Date of the message generation, according to the local clock of the originating Cisco ISE server, in the format Mmm DD hh:mm:ss.
IP address/hostname	N/A	N/A	IP address of the originating Cisco ISE node, or the hostname.
cat_name	<vendorinfo>	Text/String	Logging category name preceded by the CSCOxxx string.
msg_id	N/A	N/A	Unique message ID; 1 to 4294967295. The message ID increases by 1 with each new message. Message IDs restart at 1 each time the application is restarted.
total_seg	N/A	N/A	Total number of segments in a log message. Long messages are divided into more than one segment. Note : The total_seg depends on the Maximum Length setting in the remote logging targets page. See Remote Logging Target Settings.
seg_num	N/A	N/A	Segment sequence number within a message. Use this number to determine what segment of the message you are viewing.
timestamp	N/A	N/A	Date of the message generation, according to the local clock of the originating the Cisco ISE node, in the following format : YYYY-MM-DD hh:mm:ss:xxx +/-zh:zm.
sequence_num	N/A	N/A	Global counter of each message. If one message is sent to the local store and the next to the syslog server target, the counter increments by 2. Possible values are 0000000001 to 999999999.
msg_code	<vmid> <tag1>	Number	Message code as defined in the logging categories.
msg_sev	<severity>	Text/String	Message severity level of a log message.
msg_class	<subject>	Text/String	Message class, which identifies groups of messages with the same context.
msg_text	<action>	Text/String	English language descriptive text message.
ConfigVersionId	N/A	N/A	N/A
Device IP Address	<sip>	IP Address	N/A
Device Port	<sport>	Number	N/A
DestinationIPAddress	<dip>	IP Address	N/A
DestinationPort	<dport>	Number	N/A
UserName	<domainimpacted> <account>	Text/String	N/A
NAS-IP-Address	<dnatip>	IP Address	N/A
Acct-Status-Type	<status>	Text/String	N/A
State	<status>	Text/String	N/A
AcsSessionID	<session>	Text/String	N/A
Acct-Session-ID	<session>	Text/String	N/A
cisco-av-pair=audit-session-id	<session>	Text/String	N/A
Key1	N/A	N/A	N/A
Key2	N/A	N/A	N/A