did you use the Auto Learn feature? Maybe that function will help you to know what parser should you use for that datasources... Remember, that on the bottom of Auto Learn window is the "Show Packet" button, which can help you to see the example of particular device's event.
First of all thanks for the reply!
Today, thanks to a batch, that run on early morning, the WiFi password of the two AP was reconfigured. The SIEM catched it and showed this type of change in the dashboard. So the "Catalyst OS" parser was a great choice. It's strange that unless i've choosen to rotate the local7 log, only this evidence was showed. I'll look in to this shortly.
Thanks a lot,