Release notes for the Splunk Add-on for Cisco ESA

Version 1.7.1 of the Splunk Add-on for Cisco ESA was released on June 30, 2026.

Compatibility

Version 1.7.1 of the Splunk Add-on for Cisco ESA is compatible with the following platforms, CIM versions, and products:

Component	Description
Splunk platform versions	9.1.x, 9.2.x, 9.3.x, 9.4.x, 10.0.x, 10.1.x, 10.2.x, 10.3.x, 10.4.x
CIM	v5.3.2
Platforms	Platform independent
Vendor Products	Cisco ESA AsyncOS v15.5.2

New features

Version 1.7.1 of the Splunk Add-on for Cisco ESA has the following new features:

• Added parsing support for Cisco ESA AsyncOS v15.5.2 audit authentication logs under the cisco:esa:authentication source type.
• Added field extractions for successful login, session timeout/logout, user input, API access success, and permission denied audit events.
• Added command extraction for Cisco ESA audit events where the event value contains user input.
• Added logout/session-timeout mapping for new-format audit events to the existing account-management eventtypes.

Data model changes

sourcetype	DM Identification Criteria	Previous CIM model	New CIM model
cisco:esa:authentication	New-format AsyncOS v15.5.2 audit logout/session-timeout events where vendor_action=logout	None	Change:Account_Management

Field changes

Source type	Fields added	Fields removed
cisco:esa:authentication	log_level, user, user_role, src, src_ip, dest, dest_ip, interaction_mode, event, result, vendor_action, status, action, command, session_id, api_path, reason, change_type, object, object_id, object_attrs, object_category, dvc

Fixed issues

Version 1.7.1 of the Splunk Add-on for Cisco ESA fixes the following issues.

Known issues

Version 1.7.1 of the Splunk Add-on for Cisco ESA contains the following known issues.

If no issues appear here, no issues have yet been reported.

Third-party software attributions

Version 1.7.1 of the Splunk Add-on for Cisco ESA does not incorporate any third-party software or libraries.