With IPHost Network Monitor you can run simple snmp requests against a Cisco device in your network.
cfwNetEventIdentity
Cisco Firewall Net Event Identity
1.3.6.1.4.1.9.9.147.1.1.2.2.1.13
This object will contain a description of the entity that caused the event. The entity could be a userid, username, processid or other identifier for the entity using the service. If there is no such information then this object will contain a zero-length string.
Back to CISCO-FIREWALL-MIB MIB page.
IPHost Network monitor allows you to monitor cfwNetEventIdentity on Cisco device via the SNMP protocol. Download IPHost Network Monitor (500 monitors for 30 days, 50 monitors free forever) to start monitoring Cisco routers right now.