cancel
Showing results for 
Search instead for 
Did you mean: 
bberes
Level 7

Using Cisco ISE as a data source?

Is anyone using Cisco ISE as a data source in SIEM? It says that is a supported device, but there is only one rule that exists in SIEM for it. So we are able to get the data in, but almost everything shows up as a "unknown event." ISE does a lot of authentications for us and seems valuable to have as a data source that could parse the authentications for correlation. Any thoughts or help would be great.

0 Kudos
6 Replies
xded
Level 12

Re: Using Cisco ISE as a data source?

We use our own parser for this Datasource. I can attach in this forum if you want.

0 Kudos

Re: Using Cisco ISE as a data source?

Cloud you please help me to integrate cisco ISE with SIEM.

0 Kudos
xded
Level 12

Re: Using Cisco ISE as a data source?

Yes i can but your log will be different as mine log. but if you want i can write the parser for you.

0 Kudos
y0da
Level 7

Re: Using Cisco ISE as a data source?

I'm also interested in seeing how you parsed these xded.

0 Kudos
miguelarce
Level 7

Re: Using Cisco ISE as a data source?

I recommend that you register the ciso Teams in ESM and in the support Generic Syslogs: Log "unknown syslog"

Then clear that you configure CISCO to send the syslog logging log to the collector, then log it as I told you and you will see "unknown" events, you see the detail of those events and then you go to package and poesteas those packages and I can help you To create the rule so that you can understand them.

0 Kudos
xded
Level 12

Re: Using Cisco ISE as a data source?

Hi,

go to the Policy Editor and search for this Parser Signature ID: 1029310 Than copy this parser and paste it. After the copy process open the copy and add some parser strings.

+ Button and

Name: srcUser

RegularExpression: \s(?:U|u)ser\x3d([^\s\x2e]+)

Name: srcMac

RegularExpression: EndpointID\x3d([^\s]+)

Name: nasID

RegularExpression: NAS\sIdentifier\x3d([^\s\x3b]+)

Name: server

RegularExpression: Server\x3d(^\s\x3b]+)

Name: nasIP

RegularExpression: NAS\sIP\x3d(^\s\x3b]+)

Name: failReason

RegularExpression: Failure\sReason\x3d\d{0,5}\s*([^$]+)

Hope this will help you.

Regards

Xded

0 Kudos