{
    "@timestamp": "2020-02-21T19:13:08.328Z",
    "agent": {
        "ephemeral_id": "1c70d737-7545-456d-8fb9-7033dca67ed3",
        "id": "901f4c48-583a-4848-aa7b-89dc8e9c4b76",
        "name": "docker-fleet-agent",
        "type": "filebeat",
        "version": "8.10.2"
    },
    "cisco_ise": {
        "log": {
            "acct": {
                "request": {
                    "flags": "Stop"
                }
            },
            "acs": {
                "session": {
                    "id": "ldnnacpsn1/359344348/952729"
                }
            },
            "authen_method": "TacacsPlus",
            "avpair": {
                "priv_lvl": 15,
                "start_time": "2020-03-26T01:17:12.000Z",
                "task_id": "2962",
                "timezone": "GMT"
            },
            "category": {
                "name": "CISE_TACACS_Accounting"
            },
            "cmdset": "[ CmdAV=show mac-address-table <cr> ]",
            "config_version": {
                "id": 1829
            },
            "cpm": {
                "session": {
                    "id": "81.2.69.144Accounting306034364"
                }
            },
            "device": {
                "type": [
                    "Device Type#All Device Types#Routers",
                    "Device Type#All Device Types#Routers"
                ]
            },
            "ipsec": [
                "IPSEC#Is IPSEC Device",
                "IPSEC#Is IPSEC Device"
            ],
            "location": [
                "Location#All Locations#EMEA",
                "Location#All Locations#EMEA"
            ],
            "message": {
                "code": "3300",
                "description": "Tacacs-Accounting: TACACS+ Accounting with Command",
                "id": "0000000001"
            },
            "model": {
                "name": "Unknown"
            },
            "network": {
                "device": {
                    "groups": [
                        "Location#All Locations#EMEA",
                        "Device Type#All Device Types#Routers",
                        "IPSEC#Is IPSEC Device"
                    ],
                    "name": "wlnwan1",
                    "profile": [
                        "Cisco",
                        "Cisco"
                    ]
                }
            },
            "port": "tty10",
            "privilege": {
                "level": 15
            },
            "request": {
                "latency": 1
            },
            "response": {
                "AcctReply-Status": "Success"
            },
            "segment": {
                "number": 0,
                "total": 4
            },
            "selected": {
                "access": {
                    "service": "Device Admin - TACACS"
                }
            },
            "service": {
                "argument": "shell",
                "name": "Login"
            },
            "software": {
                "version": "Unknown"
            },
            "step": [
                "13006",
                "15049",
                "15008",
                "15048",
                "13035"
            ],
            "type": "Accounting"
        }
    },
    "client": {
        "ip": "81.2.69.144"
    },
    "data_stream": {
        "dataset": "cisco_ise.log",
        "namespace": "ep",
        "type": "logs"
    },
    "destination": {
        "ip": "81.2.69.144"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "901f4c48-583a-4848-aa7b-89dc8e9c4b76",
        "snapshot": false,
        "version": "8.10.2"
    },
    "event": {
        "action": "tacacs-accounting",
        "agent_id_status": "verified",
        "category": [
            "configuration"
        ],
        "dataset": "cisco_ise.log",
        "ingested": "2023-10-03T09:31:56Z",
        "kind": "event",
        "original": "<182>Feb 21 19:13:08 cisco-ise-host CISE_TACACS_Accounting 0000000001 4 0 2020-02-21 19:13:08.328 +00:00 0018415781 3300 NOTICE Tacacs-Accounting: TACACS+ Accounting with Command, ConfigVersionId=1829, Device IP Address=81.2.69.144, CmdSet=[ CmdAV=show mac-address-table <cr> ], RequestLatency=1, NetworkDeviceName=wlnwan1, Type=Accounting, Privilege-Level=15, Service=Login, User=psxvne, Port=tty10, Remote-Address=81.2.69.144, Authen-Method=TacacsPlus, AVPair=task_id=2962, AVPair=timezone=GMT, AVPair=start_time=1585185432, AVPair=priv-lvl=15, AcctRequest-Flags=Stop, Service-Argument=shell, AcsSessionID=ldnnacpsn1/359344348/952729, SelectedAccessService=Device Admin - TACACS, Step=13006, Step=15049, Step=15008, Step=15048, Step=13035, NetworkDeviceGroups=Location#All Locations#EMEA, NetworkDeviceGroups=Device Type#All Device Types#Routers, NetworkDeviceGroups=IPSEC#Is IPSEC Device, CPMSessionID=81.2.69.144Accounting306034364, Model Name=Unknown, Software Version=Unknown, Network Device Profile=Cisco, Location=Location#All Locations#EMEA, Device Type=Device Type#All Device Types#Routers, IPSEC=IPSEC#Is IPSEC Device, Response={AcctReply-Status=Success; }, Network Device Profile=Cisco, Location=Location#All Locations#EMEA, Device Type=Device Type#All Device Types#Routers, IPSEC=IPSEC#Is IPSEC Device, Response={AcctReply-Status=Success; }",
        "sequence": 18415781,
        "timezone": "+00:00",
        "type": [
            "info"
        ]
    },
    "host": {
        "hostname": "cisco-ise-host"
    },
    "input": {
        "type": "filestream"
    },
    "log": {
        "file": {
            "device_id": 2080,
            "inode": 88860,
            "path": "/tmp/service_logs/log.log"
        },
        "level": "notice",
        "offset": 71596,
        "syslog": {
            "priority": 182,
            "severity": {
                "name": "notice"
            }
        }
    },
    "message": "2020-02-21 19:13:08.328 +00:00 0018415781 3300 NOTICE Tacacs-Accounting: TACACS+ Accounting with Command, ConfigVersionId=1829, Device IP Address=81.2.69.144, CmdSet=[ CmdAV=show mac-address-table <cr> ], RequestLatency=1, NetworkDeviceName=wlnwan1, Type=Accounting, Privilege-Level=15, Service=Login, User=psxvne, Port=tty10, Remote-Address=81.2.69.144, Authen-Method=TacacsPlus, AVPair=task_id=2962, AVPair=timezone=GMT, AVPair=start_time=1585185432, AVPair=priv-lvl=15, AcctRequest-Flags=Stop, Service-Argument=shell, AcsSessionID=ldnnacpsn1/359344348/952729, SelectedAccessService=Device Admin - TACACS, Step=13006, Step=15049, Step=15008, Step=15048, Step=13035, NetworkDeviceGroups=Location#All Locations#EMEA, NetworkDeviceGroups=Device Type#All Device Types#Routers, NetworkDeviceGroups=IPSEC#Is IPSEC Device, CPMSessionID=81.2.69.144Accounting306034364, Model Name=Unknown, Software Version=Unknown, Network Device Profile=Cisco, Location=Location#All Locations#EMEA, Device Type=Device Type#All Device Types#Routers, IPSEC=IPSEC#Is IPSEC Device, Response={AcctReply-Status=Success; }, Network Device Profile=Cisco, Location=Location#All Locations#EMEA, Device Type=Device Type#All Device Types#Routers, IPSEC=IPSEC#Is IPSEC Device, Response={AcctReply-Status=Success; }",
    "related": {
        "hosts": [
            "cisco-ise-host"
        ],
        "ip": [
            "81.2.69.144"
        ],
        "user": [
            "psxvne"
        ]
    },
    "tags": [
        "preserve_original_event",
        "forwarded",
        "cisco_ise-log"
    ],
    "user": {
        "name": "psxvne"
    }
}