diff --git a/packages/cato_networks/changelog.yml b/packages/cato_networks/changelog.yml
index fdf88506865..bf2c3997dab 100644
--- a/packages/cato_networks/changelog.yml
+++ b/packages/cato_networks/changelog.yml
@@ -1,4 +1,9 @@
 # later versions go on top
+- version: '0.1.1'
+  changes:
+    - description: Simplify the audit `last_timestamp` parse guard to use `is_error` instead of `try`/`has`.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/20051
 - version: '0.1.0'
   changes:
     - description: Initial release of package.
diff --git a/packages/cato_networks/data_stream/audit/agent/stream/cel.yml.hbs b/packages/cato_networks/data_stream/audit/agent/stream/cel.yml.hbs
index 2b262cf24e1..05da35fd3ac 100644
--- a/packages/cato_networks/data_stream/audit/agent/stream/cel.yml.hbs
+++ b/packages/cato_networks/data_stream/audit/agent/stream/cel.yml.hbs
@@ -100,7 +100,7 @@ program: |
                     // auditFeed.to may echo back the non-RFC3339 request layout, so guard the
                     // parse and fall back to window_to instead of aborting the final page.
                     "last_timestamp": body.data.auditFeed.?to.optMap(v,
-                      try(timestamp(v), "error").as(t, !has(t.error) ?
+                      timestamp(v).as(t, !is_error(t) ?
                         t.format("2006-01-02/15:04:05")
                       :
                         window_to
diff --git a/packages/cato_networks/manifest.yml b/packages/cato_networks/manifest.yml
index 51dda242514..81e8a698dbc 100644
--- a/packages/cato_networks/manifest.yml
+++ b/packages/cato_networks/manifest.yml
@@ -1,7 +1,7 @@
 format_version: 3.4.2
 name: cato_networks
 title: Cato Networks
-version: 0.1.0
+version: 0.1.1
 description: Collect logs from Cato Networks with Elastic Agent.
 type: integration
 categories: