Found it on page 15 of this link:
http://www.cisco.com/en/US/docs/security/ips/6.2/configuration/guide/cli/cli_ssm.html
The question should have been which Cisco ACS, the old software based one or the newer appliance, needs the pnlog agent.
The answer:
MARS supports the native syslog format for the Cisco Secure ACS Solutions Engine (SE), version 4.x
and later. This topic explains how to configure MARS so that it can parse the syslogs it receives from
the Cisco Secure ACS SE device.
Before You Begin
You must either have enabled the ACS SE device to publish syslogs to MARS as described in Configure
Cisco Secure ACS 4.x to Generate Logs, page 26-3. The PNLog agent cannot be used to support the 4.x
devices.
Hope this helps.
