Hello,

The event id 716038 of Cisco ASA has the following format:

%ASA-6-716038: Group User user@domain.com IP <xxx.xxx.xxx.xxx> Authentication: successful, Session Type: WebVPN.

So I suggest to change the parsing of this line:

| parse Message with * 'User <' TargetUsername '> IP <' SrcIpAddr '> Authentication'*

in order to trim the angle brackets from the relevant fields.

Regards,
Christos