diff --git a/packages/cisco_ftd/changelog.yml b/packages/cisco_ftd/changelog.yml
index 0b68ff74bab..8484695f8d4 100644
--- a/packages/cisco_ftd/changelog.yml
+++ b/packages/cisco_ftd/changelog.yml
@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "3.13.9"
+  changes:
+    - description: Fix grok pattern for messages 111008 and 111009 to capture usernames containing spaces.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/20563
 - version: "3.13.8"
   changes:
     - description: Convert FileSize to long instead of integer so large file sizes above the 32-bit integer limit no longer fail parsing for event.code.
diff --git a/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-ftd-fix.log b/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-ftd-fix.log
index 22369cb082e..f79afafe00c 100644
--- a/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-ftd-fix.log
+++ b/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-ftd-fix.log
@@ -55,4 +55,5 @@ May  5 17:51:17 dev01: %FTD-4-313005: No matching connection for ICMP error mess
 <166>May 01 2026 09:24:32Z  %FTD-6-113005: %ASA-6-113005: AAA user authentication Rejected : reason = Password is expiring : server = 192.0.2.20 : user = engineer@elastic.co : user IP = 198.51.100.30
 <166>May 01 2026 09:24:32Z  %FTD-6-113005: %ASA-6-113005: AAA user authentication Rejected : reason = Password malformed : server = 192.0.2.20 : user = engineer@elastic.co : user IP = 198.51.100.30
 <166>May 01 2026 09:24:32Z  %FTD-6-113005: %ASA-6-113005: AAA user authentication Rejected : reason = Unspecified : server = 192.0.2.20 : user = **** : user IP = 198.51.100.30
-<166>May 01 2026 09:24:32Z  %FTD-6-113005: %ASA-6-113005: AAA user authentication Rejected : reason = Password has expired : server = 192.0.2.20 : user = engineer@elastic.co : user IP = 198.51.100.30
\ No newline at end of file
+<166>May 01 2026 09:24:32Z  %FTD-6-113005: %ASA-6-113005: AAA user authentication Rejected : reason = Password has expired : server = 192.0.2.20 : user = engineer@elastic.co : user IP = 198.51.100.30
+<181>Jul  7 14:12:01 198.51.100.10 %FTD-5-111008: User 'example-service account' executed the 'show running-config zero-trust' command.
\ No newline at end of file
diff --git a/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-ftd-fix.log-expected.json b/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-ftd-fix.log-expected.json
index 69daa63cf48..a43289baeca 100644
--- a/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-ftd-fix.log-expected.json
+++ b/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-ftd-fix.log-expected.json
@@ -4302,6 +4302,68 @@
             "tags": [
                 "preserve_original_event"
             ]
+        },
+        {
+            "@timestamp": "2026-07-07T14:12:01.000Z",
+            "cisco": {
+                "ftd": {
+                    "command_line_arguments": "'show running-config zero-trust' command."
+                }
+            },
+            "ecs": {
+                "version": "8.17.0"
+            },
+            "event": {
+                "action": "firewall-rule",
+                "category": [
+                    "network"
+                ],
+                "code": "111008",
+                "kind": "event",
+                "original": "<181>Jul  7 14:12:01 198.51.100.10 %FTD-5-111008: User 'example-service account' executed the 'show running-config zero-trust' command.",
+                "severity": 5,
+                "timezone": "UTC",
+                "type": [
+                    "info"
+                ]
+            },
+            "host": {
+                "hostname": "198.51.100.10"
+            },
+            "log": {
+                "level": "notification",
+                "syslog": {
+                    "facility": {
+                        "code": 22
+                    },
+                    "priority": 181,
+                    "severity": {
+                        "code": 5
+                    }
+                }
+            },
+            "observer": {
+                "hostname": "198.51.100.10",
+                "product": "ftd",
+                "type": "idps",
+                "vendor": "Cisco"
+            },
+            "related": {
+                "hosts": [
+                    "198.51.100.10"
+                ],
+                "user": [
+                    "example-service account"
+                ]
+            },
+            "server": {
+                "user": {
+                    "name": "example-service account"
+                }
+            },
+            "tags": [
+                "preserve_original_event"
+            ]
         }
     ]
 }
diff --git a/packages/cisco_ftd/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/cisco_ftd/data_stream/log/elasticsearch/ingest_pipeline/default.yml
index 5fccf9ab510..76924dd50d7 100644
--- a/packages/cisco_ftd/data_stream/log/elasticsearch/ingest_pipeline/default.yml
+++ b/packages/cisco_ftd/data_stream/log/elasticsearch/ingest_pipeline/default.yml
@@ -408,8 +408,8 @@ processors:
       description: "111008, 111009"
       field: "message"
       patterns:
-        - "^%{NOTSPACE} '%{NOTSPACE:server.user.name}' executed %{NOTSPACE} %{GREEDYDATA:_temp_.cisco.command_line_arguments}"
-        - "^%{NOTSPACE} '%{NOTSPACE:server.user.name}' executed the '%{DATA}' command"
+        - "^%{NOTSPACE} '%{DATA:server.user.name}' executed %{NOTSPACE} %{GREEDYDATA:_temp_.cisco.command_line_arguments}"
+        - "^%{NOTSPACE} '%{DATA:server.user.name}' executed the '%{DATA}' command"
   - grok:
       tag: grok_message_5ccd264e
       if: "ctx._temp_.cisco.message_id == '111010'"
diff --git a/packages/cisco_ftd/manifest.yml b/packages/cisco_ftd/manifest.yml
index 317acc6384b..dfd2ce4ecca 100644
--- a/packages/cisco_ftd/manifest.yml
+++ b/packages/cisco_ftd/manifest.yml
@@ -1,7 +1,7 @@
 format_version: "3.0.3"
 name: cisco_ftd
 title: Cisco FTD
-version: "3.13.8"
+version: "3.13.9"
 description: Collect logs from Cisco FTD with Elastic Agent.
 type: integration
 categories: