I have successfully created a syslog parser to pull the login and logoff messages from Cisco AnyConnect VPN sessions:
#Create a logging list on the Cisco ASA for the needed messages and send them to the IDC:
(config)# logging list MYLIST message 746012-746013
(config)# logging trap MYLIST
(config)# logging host inside [IP of server running the IDC]
#IDC Parser:
I called it "CiscoACUserId" but the name can be anything you want.
##Logins:
Message Subject: (.+Add\sIP) **Check the box for Regex
Event Type: Login
Delimiter: :
Username Prefix: \sLOCAL\\
Username: (\w+\.*\w*)
Address Prefix: User\smapping\s
Address: (\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})
##Logouts:
Click the * (asterisk) to add another message
Message Subject: (.+Delete\sIP) **Check the box for Regex
Event Type: Logout
Delimiter: :
Username Prefix: \sLOCAL\\
Username: (\w+\.*\w*)
Address Prefix: User\smapping\s
Address: (\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})
#IDC Identity Source:
Name: My Cisco ASA hostname
IP Address: My Cisco ASA IP address
Port: 514
Site: MySiteName where the ASA is located
Parser: CiscoACUserId (the one created above)
#Query Pools:
Edit your query pool and check the box for the new syslog Identity Source
#Filters:
If you're filtering things, be sure the IPs and/or usernames you expect to collect from the ASA are not filtered out. Otherwise nothing should be needed here.
