topic Onboarding Cisco ISE onto QRadar 7.4.0 FP3 - Issues encountered in Network Access Control

Onboarding Cisco ISE onto QRadar 7.4.0 FP3 - Issues encountered

Singh94100 — Mon, 26 Oct 2020 09:13:50 GMT

Hello,

We are a Managed Security Services company trying to onboard a customer's Cisco ISE device onto QRadar 7.4.0 FP3.

- The logs are landing at the QRadar event collector.

- They are arriving as UDP multiline, which is what QRadar expects.

ISSUE: However, the DSM guide produced by IBM seems to deal with the older versions of QRadar, hence the log source settings are a little different. I need your guidance on onboarding it to QRadar 7.4.0 FP3.

Here are variations/differences/gaps from the DSM guide which we saw:

1. As seen in screenshot # 1 below, the field Source Name Formatting String is mandatory when you create the log source. However, that field wasn't present in the previous QRadar versions. What value should be put there?

2. As seen in screenshot # 2 below, when you enable Show Advanced Options, some more options show up. What should be enabled in the advanced settings?

3. As seen in screenshot # 3 below, we have selected the Protocol Type as UDP Multiline Syslog (instead of Syslog). Would the QRadar DSM automatically re-assemble the log messages coming over multiple packets? If we select the Protocol Type as Syslog, then the first message gets parsed but the remaining ones are not re-assembled. In any case, the recommended option in the DSM guide is UDP Multiline Syslog, which is not working.

I would appreciate some help on the same. Apart from the highlighted, the only difference is that we are sending it to a non-default port at the event collector (527 instead of 517).

Best,

Pukhraj

Re: Onboarding Cisco ISE onto QRadar 7.4.0 FP3 - Issues encountered

Jason Kunst — Mon, 26 Oct 2020 15:11:31 GMT

I'd recommend opening a ticket with support team.

https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/216120-ise-security-ecosystem-integration-guide.html#anc49

its under the troubleshooting guide

https://community.cisco.com/t5/security-documents/ibm-qradar-pxgrid-app-troubleshooting/ta-p/3891487

Re: Onboarding Cisco ISE onto QRadar 7.4.0 FP3 - Issues encountered

Wanderley Viana — Tue, 09 Mar 2021 19:54:05 GMT

Hi could please give the solution details? I've the same problem here.

Re: Onboarding Cisco ISE onto QRadar 7.4.0 FP3 - Issues encountered

Jason Kunst — Wed, 10 Mar 2021 16:56:22 GMT

Please look at the latest qRadar guides under http://cs.co/ise-guides if you're still having issues open a support ticket.

Also this seems it might be a QRadar issue and nothing to do with the ISE QRadar app. I'd recommend a ticket with IBM.

Please do share what you get so we can update guides