diff --git a/packages/cisco_ftd/changelog.yml b/packages/cisco_ftd/changelog.yml
index 19b93dbbcd4..ac03e6593f0 100644
--- a/packages/cisco_ftd/changelog.yml
+++ b/packages/cisco_ftd/changelog.yml
@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "3.13.10"
+  changes:
+    - description: Fix grok patterns for message IDs 111008 and 111009 to correctly capture usernames containing spaces.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/20610
 - version: "3.13.9"
   changes:
     - description: Fix grok REASON pattern for message 113005 to include Account has been locked out and Users account has expired rejection reasons.
diff --git a/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-ftd-fix.log b/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-ftd-fix.log
index 06d1f887b8c..3731a3cd241 100644
--- a/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-ftd-fix.log
+++ b/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-ftd-fix.log
@@ -57,4 +57,5 @@ May  5 17:51:17 dev01: %FTD-4-313005: No matching connection for ICMP error mess
 <166>May 01 2026 09:24:32Z  %FTD-6-113005: %ASA-6-113005: AAA user authentication Rejected : reason = Unspecified : server = 192.0.2.20 : user = **** : user IP = 198.51.100.30
 <166>May 01 2026 09:24:32Z  %FTD-6-113005: %ASA-6-113005: AAA user authentication Rejected : reason = Password has expired : server = 192.0.2.20 : user = engineer@elastic.co : user IP = 198.51.100.30
 <182>Jul  7 11:22:54 198.51.100.10 %FTD-6-113005: AAA user authentication Rejected : reason = Account has been locked out : server = 203.0.113.20 : user = ***** : user IP = 192.0.2.30
-<182>Jul  7 11:22:54 198.51.100.10 %FTD-6-113005: AAA user authentication Rejected : reason = Users account has expired : server = 203.0.113.20 : user = ***** : user IP = 192.0.2.30
\ No newline at end of file
+<182>Jul  7 11:22:54 198.51.100.10 %FTD-6-113005: AAA user authentication Rejected : reason = Users account has expired : server = 203.0.113.20 : user = ***** : user IP = 192.0.2.30
+<181>Jul  7 14:12:01 198.51.100.10 %FTD-5-111008: User 'example-service account' executed the 'show running-config zero-trust' command.
\ No newline at end of file
diff --git a/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-ftd-fix.log-expected.json b/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-ftd-fix.log-expected.json
index a722bcaf4e2..a0bc228cd2c 100644
--- a/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-ftd-fix.log-expected.json
+++ b/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-ftd-fix.log-expected.json
@@ -4486,6 +4486,67 @@
             "tags": [
                 "preserve_original_event"
             ]
+        },
+        {
+            "cisco": {
+                "ftd": {
+                    "command_line_arguments": "'show running-config zero-trust' command."
+                }
+            },
+            "ecs": {
+                "version": "8.17.0"
+            },
+            "event": {
+                "action": "firewall-rule",
+                "category": [
+                    "network"
+                ],
+                "code": "111008",
+                "kind": "event",
+                "original": "<181>Jul  7 14:12:01 198.51.100.10 %FTD-5-111008: User 'example-service account' executed the 'show running-config zero-trust' command.",
+                "severity": 5,
+                "timezone": "UTC",
+                "type": [
+                    "info"
+                ]
+            },
+            "host": {
+                "hostname": "198.51.100.10"
+            },
+            "log": {
+                "level": "notification",
+                "syslog": {
+                    "facility": {
+                        "code": 22
+                    },
+                    "priority": 181,
+                    "severity": {
+                        "code": 5
+                    }
+                }
+            },
+            "observer": {
+                "hostname": "198.51.100.10",
+                "product": "ftd",
+                "type": "idps",
+                "vendor": "Cisco"
+            },
+            "related": {
+                "hosts": [
+                    "198.51.100.10"
+                ],
+                "user": [
+                    "example-service account"
+                ]
+            },
+            "server": {
+                "user": {
+                    "name": "example-service account"
+                }
+            },
+            "tags": [
+                "preserve_original_event"
+            ]
         }
     ]
 }
diff --git a/packages/cisco_ftd/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/cisco_ftd/data_stream/log/elasticsearch/ingest_pipeline/default.yml
index aaadc829805..eed1f7364ac 100644
--- a/packages/cisco_ftd/data_stream/log/elasticsearch/ingest_pipeline/default.yml
+++ b/packages/cisco_ftd/data_stream/log/elasticsearch/ingest_pipeline/default.yml
@@ -408,8 +408,8 @@ processors:
       description: "111008, 111009"
       field: "message"
       patterns:
-        - "^%{NOTSPACE} '%{NOTSPACE:server.user.name}' executed %{NOTSPACE} %{GREEDYDATA:_temp_.cisco.command_line_arguments}"
-        - "^%{NOTSPACE} '%{NOTSPACE:server.user.name}' executed the '%{DATA}' command"
+        - "^%{NOTSPACE} '%{DATA:server.user.name}' executed %{NOTSPACE} %{GREEDYDATA:_temp_.cisco.command_line_arguments}"
+        - "^%{NOTSPACE} '%{DATA:server.user.name}' executed the '%{DATA}' command"
   - grok:
       tag: grok_message_5ccd264e
       if: "ctx._temp_.cisco.message_id == '111010'"
diff --git a/packages/cisco_ftd/manifest.yml b/packages/cisco_ftd/manifest.yml
index dfd2ce4ecca..e87b8744ebd 100644
--- a/packages/cisco_ftd/manifest.yml
+++ b/packages/cisco_ftd/manifest.yml
@@ -1,7 +1,7 @@
 format_version: "3.0.3"
 name: cisco_ftd
 title: Cisco FTD
-version: "3.13.9"
+version: "3.13.10"
 description: Collect logs from Cisco FTD with Elastic Agent.
 type: integration
 categories: