topic Re: ISE-PIC WMI filter for AD users in Network Access Control

ISE-PIC WMI filter for AD users

tato386 — Fri, 03 Jan 2025 19:38:01 GMT

I am using WMI and PassiveID to pull username to IP mapping from my Windows domain controllers. I don't need to map/monitor all the logins in my domain, I just need actually people logins. Specifically, I have many service accounts that login to several servers and show up quite often in the live session screen with multiple logins and IPs which I want to get rid of. I don't see any way to filter these service accounts. Any ideas where I need to look?

Thanks,

Re: ISE-PIC WMI filter for AD users

Rob Ingram — Fri, 03 Jan 2025 19:47:14 GMT

@tato386

Filter Passive Identity Services

You can filter certain users, based on their name or IP address. For example, if you have an administrator from IT services who logs in to an endpoint in order to assist the regular user with that endpoint, you can filter out the administrator activity so it does not appear in Live Sessions, but rather only the regular user of that endpoint will appear. The Live Session shows Passive Identity service components that are not filtered out by the Mapping Filters. You can add as many filters as needed. The “OR” logic operator applies between filters. If both the fields are specified in a single filter, the “AND” logic operator applies between these fields.

Procedure

Step 1	Choose Providers > Mapping Filters.
Step 2	Click Add, enter the Username and or IP address of the user you want to filter and click Submit.

https://www.cisco.com/c/en/us/td/docs/security/ise/3-2/pic_admin_guide/pic_admin32/pic_admin32_chapter_011.html#task_E9787621FE1146E59A0E5EC4573609EE

Re: ISE-PIC WMI filter for AD users

tato386 — Fri, 03 Jan 2025 21:00:08 GMT

man, that was right there, Idon't know how I missed it. I think I saw "mapping" and felt it was for like custom mapping of AD to ISE attributes or something similar. then again the option says "filter" so I should have investigated further. Thank you!