Cisco Unified Communications Manager Audit Log

Quick Start

uv tool install eventum-generator
git clone https://github.com/eventum-generator/content-packs.git
cd content-packs
eventum generate \
  --path generators/application-cisco-cucm-audit/generator.yml \
  --id cucm \
  --live-mode true

Event Types

Realism Features

• Thirty administrator accounts work in Cisco Unified CM Administration, each with its own activity weight: the busiest open a dozen or more sessions a day, the rarest (such as Administrator and breakglass-admin) about three or four. A session comes from the account's usual workstation address or, in about 15% of sessions, a second address, and an account pauses a few minutes to hours (median about 17 minutes) between sessions.
• About 730 rows a day (+/- 3% from day to day) follow a working day in UTC: rising from 04:00, peaking at about 70 rows an hour around 10:00-12:00 and fading out by 20:00, with one or two logins an hour at night. Configuration changes fall between 05:00 and 19:00 UTC.
• About 40% of daytime sessions and every night session only look around (login, logout). The rest carry one to about a dozen changes one to a few minutes apart (median about two minutes) on 24 processnode server records, about half present at any time: updates, often of the same record several times in a row, a quarter saved again shortly after; adds of absent records, half followed by an update of the same record as in the Cisco sample and more than half of the rest deleted again later in the same session; deletes of present records, some after an update in the same session. About a quarter of sessions end without a logout row because the session expires.
• Field names, spacing and the constant values of each form follow the four-row Cisco DevNet Audit00000001.log sample for build 14.0.1.10000-20. The deleted row reuses the added/updated form with the verb seen in Cisco Community posts for other tables; it is not a captured line.
• Only successful Administration logins and processnode changes are modeled: no failed logins, other tables (device, numplan, users), Serviceability or CLI events, for lack of primary row examples, so about 360 configuration changes a day land on server records, which real clusters change rarely. Rows of one session are one to a few minutes apart, where a real administrator saving twice produces rows seconds apart. Rates, durations and the operation mix are synthetic workload choices, not measured CUCM production frequencies.
• The file HDR line and remote syslog framing (AuditEventGenerated alarms) are not emitted; native rows carry only a UTC time of day and @timestamp supplies the date. cucm.audit.record is parsed from AuditDetails, and the event, user, source and related fields are ECS normalization. Compatibility with the KUMA CUCM 11.5(1) normalizer is not claimed, and no live system output, exact-build trace or maintained Elastic integration was available as a reference.
• Every step and each pair of steps of the episode is ordinary administration: without episodes, 14 days hold about 790 updates of a record by the account that added it within the previous two hours, about 250 adds followed by a delete of the same record by the same account and about 140 updates followed by a delete. The complete add, update, delete of one record by one account within two hours never occurs there: such a delete removes another present record instead, about 3 to 4 deletes a day. The detection idea is a server entry staged and then removed, for example to register a rogue node temporarily.

Sample Output

{
  "@timestamp": "2026-09-02T06:58:35.314+00:00",
  "cucm": {
    "audit": {
      "app_id": "Cisco Tomcat",
      "audit_category": "AdministrativeEvent",
      "audit_details": "record in table processnode with key field name = cucm-dr-01.example.test deleted",
      "client_address": "10.20.31.5",
      "cluster_id": "",
      "component_id": "Cisco CUCM Administration",
      "compulsory_event": "No",
      "correlation_id": "",
      "event_status": "Success",
      "event_type": "GeneralConfigurationUpdate",
      "node_id": "cucm-pub-01",
      "record": {
        "key_field": "name",
        "key_value": "cucm-dr-01.example.test",
        "operation": "deleted",
        "table": "processnode"
      },
      "resource_accessed": "CUCMAdmin",
      "severity": 5,
      "timestamp_local": "06:58:35.314",
      "user_id": "akumar"
    }
  },
  "ecs": {
    "version": "8.17.0"
  },
  "event": {
    "action": "processnode_deleted",
    "category": [
      "configuration"
    ],
    "code": "GeneralConfigurationUpdate",
    "dataset": "cucm.audit",
    "kind": "event",
    "module": "cucm",
    "original": "06:58:35.314 |LogMessage   UserID : akumar  ClientAddress : 10.20.31.5  Severity : 5  EventType : GeneralConfigurationUpdate  ResourceAccessed: CUCMAdmin  EventStatus : Success  CompulsoryEvent : No  AuditCategory : AdministrativeEvent  ComponentID : Cisco CUCM Administration  CorrelationID :   AuditDetails :  record in table processnode with key field name = cucm-dr-01.example.test deleted  App ID: Cisco Tomcat Cluster ID:  Node ID: cucm-pub-01",
    "outcome": "success",
    "type": [
      "deletion"
    ]
  },
  "host": {
    "name": "cucm-pub-01"
  },
  "message": "record in table processnode with key field name = cucm-dr-01.example.test deleted",
  "related": {
    "hosts": [
      "cucm-pub-01"
    ],
    "ip": [
      "10.20.31.5"
    ],
    "user": [
      "akumar"
    ]
  },
  "service": {
    "name": "Cisco Unified Communications Manager",
    "version": "14.0.1.10000-20"
  },
  "source": {
    "ip": "10.20.31.5"
  },
  "user": {
    "name": "akumar"
  }
}

Parameters