Cisco ISE
Cisco Identity Services Engine (ISE) allows for identity management across diverse devices and applications. You can configure Cisco ISE to send VPN data to InsightIDR for visibility into users' remote network ingress activity.
To set up Cisco ISE you’ll need to:
- Configure Cisco ISE to send data to your Collector.
- Set up the Cisco ISE in InsightIDR.
- Verify the configuration works.
Configure Cisco ISE to send logs to InsightIDR
To enable InsightIDR to receive data from your Cisco ISE remote system logging, complete these steps:
Task 1: Configure a remote logging target in Cisco ISE
- Log in to your Cisco ISE Administration Interface.
- From the navigation menu, select Administration > System > Logging > Remote Logging Targets.
- Click Add, and then configure the following parameters:
Option | Description |
|---|---|
Name | Type a unique name for the remote target system. |
Description | You can uniquely identify the target system for users. |
IP Address | Enter the IP address of your InsightIDR collector. |
Port | Enter the port value that you specified in your Cisco ISE log source for InsightIDR. |
Facility Code | From the Facility Code list, select the syslog facility to use for logging events. |
Maximum Length | Type 1024 as the maximum packet length allowed for the UDP syslog message. |
- Click Submit.
Task 2: Add the new target to your desired logging categories
- Select Administration > System > Logging > Logging Categories.
- Click the radio button next to the category that you want to edit, and click Edit.
- Add the target that you created in the previous section to the following categories. These are default log collection settings and can be modified as needed:
- AAA Audit
- Failed Attempts
- Passed Authentications
- AAA Diagnostics
- Administrator Authentication and Authorization
- Authentication Flow Diagnostics
- Identity Stores Diagnostics
- Policy Diagnostics
- RADIUS Diagnostics
- Accounting
- External MDM
- Passive ID
- Posture and Client Provisioning Audit
- Posture and Client Provisioning Diagnostics
- Profiler
- Administrative and Operational Audit
- System Diagnostics
- System Statistics
- AAA Audit
- Click Save.
- Go to the Logging Categories page and verify the configuration changes that were made to the specific categories.
For more information, see "Logging Mechanism" section of the Cisco Identity Services Engine Administrator Guide.
Set Up Cisco ISE in InsightIDR
- From your dashboard, select Data Collection from the left hand menu.
- When the Data Collection page appears, click the Setup Event Source dropdown and choose Add Event Source.
- From the “Security Data” section, click the VPN icon. The “Add Event Source” panel appears.
- Click Cisco ISE.
- Choose the timezone that matches the location of your event source logs.
- Optionally choose to send unparsed logs.
- Select an attribution source.
- Optionally configure inactivity timeout threshold in minutes.
- Configure your default domain and any advanced settings.
- Select syslog as your collection method and specify the port and protocol you identified during Cisco ISE configuration.
- Optionally choose to Encrypt the event source if choosing TCP by downloading the Rapid7 Certificate.
- Click the Save button.
Attribution source options
Cisco ISE product logs can contain information about hosts and accounts. When setting up Cisco ISE as an event source, you will have the ability to specify the following attribution options:
- Use IDR engine if possible; if not, use event log
By selecting this option, the InsightIDR attribution engine will perform attribution using the source address present in the log lines. If it's unable to resolve assets or accounts using the source address, it will use the assets or accounts present in the log lines, if any.
- Use event log if possible; if not, use IDR engine
By selecting this option, attribution will be done using the assets and accounts present in the log lines. If no assets or accounts are present in the log lines, the InsightIDR attribution engine will perform attribution using the source address present in the log lines.
- Use IDR engine only
By selecting this option, the InsightIDR attribution engine will perform the attribution using the source address present in the log lines, ignoring any assets and accounts present in the log lines.
- Use event log only
By selecting this option, attribution will be done using the assets and accounts present in the log lines, ignoring the source address.
Verify the Configuration
Complete the following steps to view your logs and ensure events are making it to the Collector.
- On the new event source that was just created, click the View Raw Log button. If you see log messages in the box, then this shows that logs are flowing to the Collector.
- Next, click Log Search in the left menu. Select the applicable Log Sets and the Log Names within them. The Log Name will be the event source name or “Cisco ISE” if you did not name the event source. Cisco ISE logs flow into the following log sets:
- Ingress Authentication
- Firewall Activity
Logs take a minimum of 7 minutes to appear in Log Search
Please note that logs take at least 7 minutes to appear in Log Search after you set up the event source. If you see log messages when you select View Raw Log on the event source but do not see any log messages in Log Search after waiting for a few minutes for them to appear, then your logs do not match the recommended format and type for this event source.
Sample Logs
The following are log samples that Cisco ISE sends to InsightIDR.
Ingress Authentication (VPN)
Firewall Activity (Passed Authentication)
Firewall Activity (Failed Attempts)
Sample Firewall Logs in Log Search
Sample Ingress Authentication (VPN) Logs in Log Search
.png)
Did this page help you?