SIEM Parsing Failures Due to VIP Enterprise Gateway Shared-Secret Mismatch Log Format

Products

• VIP Service

Issue/Introduction

Security Information and Event Management (SIEM) platforms (such as Palo Alto Networks Cortex XSIAM or other syslog forwarders) may fail to parse or normalize specific syslog events from Symantec VIP Enterprise Gateway.

The issue typically occurs when the RADIUS Validation Engine encounters a Shared-secret mismatch and generates a log containing structured delimiter symbols (+-+-+-+).

Example Log Snippet

Plaintext

 

CEF:0|Symantec|VIP Enterprise Gateway|9.10.3|0|ERROR|"2026-06-15 11:34:26.615 GMT-0400" 10.xx.xx.xx ISE:1812 0 0 "text=VSValidationEngineProcessRequest() -- Authentication Failed for user [user].
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-++-+-+-+-+-+-+-+-+-+-+
!!WARNING!! Detected a possible Shared-secret mismatch.
Ensure that both the RADIUS server and the RADIUS client share the same Shared-secret.
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-++-+-+-+-+-+-+-+-+-+-+"

Environment

Symantec VIP Enterprise Gateway

Cause

The symbols (+-+-+-+) inside the log message are hardcoded and intentional:

1. Visual Prominence: They are designed to draw immediate administrator attention to a critical configuration issue (a RADIUS shared-secret mismatch).

2. Backward Compatibility: Modifying or removing these symbols at the product level would break existing parser rules, custom regex patterns, and alert conditions used by other organizations globally.

Therefore, this log format cannot be modified or filtered out by changing the log logging levels on the VIP Enterprise Gateway.

Resolution

Because the EG cannot alter the output log structure, parsing and normalization issues must be resolved at the ingestion or SIEM layer (e.g., Palo Alto Cortex XSIAM, local syslog forwarder, or collector).

Recommended Action: Define a Custom Parsing Rule

Configure a custom parser rule on your SIEM / XSIAM platform to safely ingest the multi-line message and ignore the decorative delimiters.

1. Regex Pattern Approach

Use a regular expression that captures the actual warning text inside the block and treats everything between the +-+-+-+ lines as the value of the text field, stripping out or bypassing the delimiters.

Example Capture Concept:

Code snippet

 

text=VSValidationEngineProcessRequest\(\)[^\+]+(?:\+|-)*\s*!!WARNING!!\s*(?<message>[^+-]+)

2. XSIAM Custom Log Parser Guidance

Create a parsing rule in Cortex XSIAM that defines:

• Message Delimiter: Configure the log parser to treat the content between the +-+ delimiters as a single string variable.

• Normalization: Map the extracted warning value directly into the standard schema field (such as action_result or msg), while dropping the literal +-+-+-+ string elements during the normalization stage.