---
title: "Cisco Catalyst Integration"
slug: "cisco-catalyst"
updated: 2026-11-02T10:27:30Z
published: 2026-11-02T10:27:30Z
canonical: "docs.hunters.ai/cisco-catalyst"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hunters.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Cisco Catalyst Integration

## TL;DR

| Supported data types | 3rd party detection | Hunters detection | IOC search | Search | Table name | Log format | Collection method |
| --- | --- | --- | --- | --- | --- | --- | --- |
| Cisco DNA Center (Catalyst Center) Assurance Events | ✅ |  |  | ✅ | `cisco_dna_center_assurance_events` | Syslog-wrapped JSON | S3 |

## Overview

Cisco DNA Center (now rebranded Cisco Catalyst Center) is the centralized network management and assurance platform for Cisco Catalyst switches, routers, and wireless infrastructure. It continuously monitors network device health and performance, generating Assurance events when issues such as interface errors, discards, connectivity problems, or user-defined conditions are detected. These events are emitted as syslog-wrapped JSON records (RFC5424 header followed by a JSON payload) and shipped to S3 for downstream consumption. For security operations, these logs provide visibility into network device health degradation, anomalous interface behavior, and operational issues on switches/routers that can indicate misconfiguration, compromise, or network-based attacks (e.g., traffic floods causing discards). They also carry device identity, IP addresses, and site/topology metadata useful for asset correlation and incident investigation.

## Supported data types

### Cisco DNA Center (Catalyst Center) Assurance Events

**Table name:** `cisco_dna_center_assurance_events`

This data type contains Assurance issue events generated by Cisco DNA Center/Catalyst Center as it monitors the health of managed network devices. Each event includes the affected device's identity and IP address, the issue category and priority, a human-readable description of the problem, site/topology metadata, and a direct link back to the issue in the DNA Center console. Typical events cover interface errors and discards, connectivity degradation, and user-defined health conditions, which can be indicators of misconfiguration, compromise, or attack activity (e.g., traffic floods causing elevated discards).

**Expected format**

Logs are expected in Syslog-wrapped JSON format (RFC5424 header followed by a JSON payload).

```
<46>1 2025-10-03T01:45:37.356Z 10.20.14.101 DNAC - - - {"version":"1.0.0","efInstanceId":"3f1a2b4c-5d6e-7f8a-9b0c-1d2e3f4a5b6c","instanceId":"7e2d4c6b-8a9f-4b1c-9d3e-5f6a7b8c9d0e","eventId":"NETWORK-DEVICES-3-215","namespace":"ASSURANCE","name":null,"description":null,"type":"NETWORK","category":"WARN","domain":"Know Your Network","subDomain":"Devices","severity":3,"source":"ndp","timestamp":1759455936877,"details":{"Type":"Network Device","Assurance Issue Details":"High Input/Output discard Rx 0.0% Tx 12.36% on interface GigabitEthernet1/0/1 (Interface description: --), Device SWITCH-CORE-01","Assurance Issue Priority":"P3","Device":"10.0.1.50","Assurance Issue Name":"High input/output discard on interface GigabitEthernet1/0/1 (Interface description: --)","Assurance Issue Category":"connected","Assurance Issue Status":"active"},"ciscoDnaEventLink":"https://10.20.14.101/dna/assurance/issueDetails?issueId=7e2d4c6b-8a9f-4b1c-9d3e-5f6a7b8c9d0e","note":"To programmatically get more info see here - https://<ip-address>/dna/platform/app/consumer-portal/developer-toolkit/apis?apiId=8684-39bb-4e89-a6e4","tntId":"1122ab33cde45ff6789a0b1","context":null,"userId":null,"i18n":null,"eventHierarchy":null,"message":null,"messageParams":null,"parentInstanceId":null,"network":{"siteId":"/1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d/2b3c4d5e-6f7a-8b9c-0d1e-2f3a4b5c6d7e/3c4d5e6f-7a8b-9c0d-1e2f-3a4b5c6d7e8f/4d5e6f7a-8b9c-0d1e-2f3a-4b5c6d7e8f9a/","deviceId":"5e6f7a8b-9c0d-1e2f-3a4b-5c6d7e8f9a0b"},"isSimulated":false,"startTime":1759455937354,"dnacIP":"10.20.14.101","correlationId":"6f7a8b9c-0d1e-2f3a-4b5c-6d7e8f9a0b1c","tenantId":"SYS0"}
```

## Send data to Hunters

Hunters supports the collection of Cisco DNA Center (Catalyst Center) Assurance Events logs using Amazon S3.

**To connect Cisco DNA Center logs:**

1. Configure Cisco DNA Center/Catalyst Center (or the syslog relay in front of it) to route Assurance event logs into an AWS S3 bucket.
2. Once logs are in S3, follow the steps in [this section](https://hunters.document360.io/docs/connect-data-through-aws-s3) to connect the S3 bucket to Hunters.