[AI-6402] DDS: Cisco Secure Client Integration v1.0.0 #22260

manan-crest · 2026-01-02T11:44:55Z

What does this PR do?

This is a initial release PR of Cisco Secure Client integration including all the required assets.

Integration Logo Sources: https://upload.wikimedia.org/wikipedia/commons/0/08/Cisco_logo_blue_2016.svg

Review checklist (to be filled by reviewers)

Feature or bugfix MUST have appropriate tests (unit, integration, e2e)
Add the qa/skip-qa label if the PR doesn't need to be tested during QA.
If you need to backport this PR to another branch, you can add the backport/<branch-name> label to the PR and it will automatically open a backport PR once this one is merged

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector · 2026-01-02T12:46:52Z

cisco_secure_client/assets/logs/cisco-secure-client.yaml

+          '%{regex("[^']*"):usr.name}' local ip %{ip:local_ip}
+          (connected|reconnected) from %{ip:network.client.ip}
+
+          parsing_session_connection %{parse_event_type_header}'%{parse_session_id_ip_and_user}:\s*%{regex("Session disconnected|Session connected"):action}. Session Type:\s*%{notSpace:session_type}(, Duration:\s*%{notSpace:duration}, Bytes xmt:\s*%{number:network.bytes_read}, Bytes rcv:\s*%{number:network.bytes_written}, Reason:\s*%{regex(".*(?= \\')"):reason})?\s*'


Capture bytes xmt/rcv into correct fields

The Meraki session parser maps Bytes xmt to network.bytes_read and Bytes rcv to network.bytes_written, which inverts transmitted vs. received counts. For AnyConnect session manager logs that include these fields, downstream dashboards and analytics will show read/write byte totals swapped (xmt is outbound, rcv is inbound). This affects any events type=anyconnect_vpn_session_manager messages with byte counters.

Useful? React with 👍 / 👎.

cisco_secure_client/datadog_checks/cisco_secure_client/data/conf.yaml.example

github-actions · 2026-01-05T06:13:31Z

⚠️ The qa/skip-qa label has been added with shippable changes

The following files, which will be shipped with the agent, were modified in this PR and
the qa/skip-qa label has been added.

You can ignore this if you are sure the changes in this PR do not require QA. Otherwise, consider removing the label.

List of modified files that will be shipped with the agent

cisco_secure_client/datadog_checks/cisco_secure_client/__about__.py
cisco_secure_client/datadog_checks/cisco_secure_client/__init__.py
cisco_secure_client/datadog_checks/cisco_secure_client/data/conf.yaml.example
cisco_secure_client/changelog.d/22260.added
cisco_secure_client/pyproject.toml

…sco-secure-client-v1.0.0

steveny91 · 2026-01-21T15:47:23Z

Also not sure why the validation is failing right now. Can you retrigger to validation by making the version change that I suggested above? Maybe it's a CI flake.

steveny91 · 2026-01-21T17:20:27Z

cisco_secure_client/assets/logs/cisco-secure-client.yaml

+    - type: arithmetic-processor
+      name: Convert epoch time to millisecond
+      enabled: true
+      expression: epoch_time * 1000
+      target: timestamp
+      replaceMissing: false
+    - type: date-remapper
+      name: Define `timestamp` as the official date of the log
+      enabled: true
+      sources:
+        - timestamp
+    - type: message-remapper
+      name: Define `message` as the official message of the log
+      enabled: true
+      sources:
+        - message


Is there a specific reason these remappers are in between grok parsing pipelines? Normally we parse everything and then remap them to more standard attributes. If there's a specific reason that's fine. Just curious.

We usually keep the date remapper close to the grok parser where the timestamp is extracted for easier access. For the message remapper, we remap the message from the first grok parser and then use the updated value as input for the second grok parser.

steveny91 · 2026-01-21T17:21:40Z

cisco_secure_client/assets/logs/cisco-secure-client.yaml

+          rule_113035  %{parse_group_user_ip} Session terminated: AnyConnect not
+          enabled or invalid AnyConnect image on the %{greedyData:device_name}
+
+          rule_716059 Group %{regex(".*(?= User )"):group} User %{notSpace:usr.name} IP %{ip:source_ip} AnyConnect session resumed connection from IP %{ip:network.client.ip}(.)?


What's the difference between ip:source_ip and ip:network.client.ip? Maybe this can also be nested under network? network.source.ip if they represent different things maybe?

source_ip is the original IP when the session starts, while network.client.ip is the IP used to resume the session.
Sure, I have changed mapping to network.source.ip.

steveny91 · 2026-01-21T18:00:45Z

cisco_secure_client/assets/logs/cisco-secure-client.yaml

+        - "<190>2025-11-20T07:37:58Z: %FTD-6-113039: Group group User test-user
+          IP 10.10.10.10 AnyConnect_parent session started."


Suggested change

- "<190>2025-11-20T07:37:58Z: %FTD-6-113039: Group group User test-user

IP 10.10.10.10 AnyConnect_parent session started."

nit. duplicate

…sco-secure-client-v1.0.0

cisco_secure_client/README.md

evazorro · 2026-01-26T17:10:25Z

cisco_secure_client/README.md

+<br>
+<b>Note</b>: To forward Cisco Secure Client logs, syslog must be configured on the Cisco firewall (ASA, FTD, or Meraki) platform that you are using with Cisco Secure Client.
+</br>


Is there a reason why you're using HTML here instead of Markdown for bolding the note?

We used HTML here mainly to get some extra spacing above and below the note.

I see, thanks. You can leave the <br> tags but I don't think you need to use HTML for the bolding. I'll add a suggestion.

Have made the changes as suggested below.

cisco_secure_client/README.md

evazorro · 2026-01-26T19:24:06Z

cisco_secure_client/README.md

+If you see the **Port <PORT-NO\> Already in Use** error, see the following instructions. The example below is for `PORT-NO = 514`.
+
+On systems using syslog, if the Agent listens for logs on port 514, the following error can appear in the Agent logs: `Can't start UDP forwarder on port 514: listen udp :514: bind: address already in use`.
+
+This error occurs because by default, Syslog listens on port 514. To resolve this error, take **one** of the following steps:
+
+- Disable syslog, or 
+- Configure the Agent to listen on a different, available port.


Suggested change

If you see the **Port <PORT-NO\> Already in Use** error, see the following instructions. The example below is for `PORT-NO = 514`.

On systems using syslog, if the Agent listens for logs on port 514, the following error can appear in the Agent logs: `Can't start UDP forwarder on port 514: listen udp :514: bind: address already in use`.

This error occurs because by default, Syslog listens on port 514. To resolve this error, take **one** of the following steps:

- Disable syslog, or

- Configure the Agent to listen on a different, available port.

On systems using syslog, if the Agent listens for logs on port 514, the following error can appear in the Agent logs: `Can't start UDP forwarder on port 514: listen udp :514: bind: address already in use`.

By default, syslog listens on port 514. To resolve this error, take **one** of the following steps:

- Disable syslog, or

- Configure the Agent to listen on a different, available port.

…into cisco-secure-client-v1.0.0

steveny91 · 2026-01-28T18:47:07Z

@manan-crest a new validation was recently added can you add a owner field for this integration like so:
https://github.com/DataDog/integrations-core/blob/master/delinea_secret_server/manifest.json#L5

cisco_secure_client/README.md

evazorro

Thank you for making those changes! One more small suggestion.

Add: Cisco Secure Client Integration

b7484c8

temporal-github-worker-1 bot added agent/review-requested docs/review-requested ecosystems/review-requested product/review-requested labels Jan 2, 2026

datadog-agent-integrations-bot bot added documentation dev/testing dev/tooling release qa/skip-qa Automatically skip this PR for the next QA labels Jan 2, 2026

Fix: CI check Failures

5d0c9d5

manan-crest changed the title ~~DDS: Cisco ASA Integration v1.0.0~~ [AI-6402] DDS: Cisco ASA Integration v1.0.0 Jan 2, 2026

Update: minor changes for CI

eed9136

manan-crest force-pushed the cisco-secure-client-v1.0.0 branch from 607d9b4 to eed9136 Compare January 2, 2026 12:31

manan-crest marked this pull request as ready for review January 2, 2026 12:43

manan-crest requested review from a team as code owners January 2, 2026 12:43

datadog-agent-integrations-bot bot added team/agent-integrations team/documentation team/logs-integrations-reviewers team/saas-integrations labels Jan 2, 2026

chatgpt-codex-connector bot reviewed Jan 2, 2026

View reviewed changes

manan-crest changed the title ~~[AI-6402] DDS: Cisco ASA Integration v1.0.0~~ [AI-6402] DDS: Cisco Secure Client Integration v1.0.0 Jan 2, 2026

hestonhoffman added the editorial review Waiting on a more in-depth review from a docs team editor label Jan 2, 2026

Update: remap bytes standard attributes

640871c

manan-crest force-pushed the cisco-secure-client-v1.0.0 branch from 7a55cb3 to 640871c Compare January 5, 2026 06:13

manan-crest force-pushed the cisco-secure-client-v1.0.0 branch from c3808b8 to 9a12c78 Compare January 16, 2026 07:55

manan-crest requested a review from steveny91 January 16, 2026 09:11

manan-crest added 2 commits January 20, 2026 19:13

Merge branch 'master' of github.com:DataDog/integrations-core into ci…

430743e

…sco-secure-client-v1.0.0

Update: CODEOWNERS

ee41716

steveny91 reviewed Jan 21, 2026

View reviewed changes

manan-crest added 2 commits January 22, 2026 11:14

Merge branch 'master' of github.com:DataDog/integrations-core into ci…

dcd27ea

…sco-secure-client-v1.0.0

Update: review comments

8f6794f

manan-crest requested a review from steveny91 January 22, 2026 10:38

evazorro requested changes Jan 26, 2026

View reviewed changes

temporal-github-worker-1 bot added docs/requested-changes and removed docs/review-requested labels Jan 26, 2026

manan-crest added 2 commits January 28, 2026 12:35

Update: readme as per review comments

4e55559

Merge branch 'master' of https://github.com/DataDog/integrations-core …

17c05be

…into cisco-secure-client-v1.0.0

manan-crest requested a review from evazorro January 28, 2026 12:27

Add: owner field in manifest.json

b38e1d7

datadog-agent-integrations-bot bot added the changelog/no-changelog label Jan 29, 2026

evazorro reviewed Feb 2, 2026

View reviewed changes

cisco_secure_client/README.md Show resolved Hide resolved

evazorro requested changes Feb 2, 2026

View reviewed changes

Update: README.md note

427e340

manan-crest requested a review from evazorro February 3, 2026 07:57

steveny91 approved these changes Feb 3, 2026

View reviewed changes

temporal-github-worker-1 bot added agent/approved and removed agent/review-requested labels Feb 3, 2026

evazorro approved these changes Feb 3, 2026

View reviewed changes

temporal-github-worker-1 bot added docs/approved and removed docs/requested-changes labels Feb 3, 2026

		- "<190>2025-11-20T07:37:58Z: %FTD-6-113039: Group group User test-user
		IP 10.10.10.10 AnyConnect_parent session started."

[AI-6402] DDS: Cisco Secure Client Integration v1.0.0 #22260

Are you sure you want to change the base?

[AI-6402] DDS: Cisco Secure Client Integration v1.0.0 #22260

Conversation

manan-crest commented Jan 2, 2026

What does this PR do?

Review checklist (to be filled by reviewers)

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector bot Jan 2, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions bot commented Jan 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

steveny91 commented Jan 21, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

steveny91 commented Jan 28, 2026

Uh oh!

Uh oh!

evazorro left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

github-actions bot commented Jan 5, 2026 •

edited

Loading