topic ISE and SIEM integration in Network Access Control

ISE and SIEM integration

Octavian Szolga — Mon, 11 Mar 2019 04:22:04 GMT

Hi,

One of the major concerns regarding security solutions is the way they interact. ISE specifically, is compatible with most of the SIEMs available today, as stated by Cisco (http://www.cisco.com/en/US/prod/vpndevc/ecosystem.html).

In my particular case, I want to integrate ISE with ArcSight.

For ArcSight to correctly parse the syslog messages that ISE sends, you have to install/configure an ISE smartconnector.

What I'm missing though is how does ArcSight instructs ISE to take specific actions on users/devices that are involved in a network attack.

Please check: http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5712/ps11640/at_a_glance_c45-728401.pdf

SIEM/TD partners may utilize ISE as a conduit for taking mitigation actions within the Cisco network infrastructure. SIEM/TD platforms can instruct ISE to undertake quarantine or access-block actions on users and/or device based on ISE policies that have been defined for such actions.

Thanks!

Octavian

ISE and SIEM integration

Naveen Kumar — Thu, 13 Feb 2014 03:26:34 GMT

There is no such docs available till now for ArcSight integration with ISE. I also found only these two links:

http://www.cisco.com/c/dam/en/us/products/collateral/security/identity-services-engine/at_a_glance_c45-728401.pdf

http://www.cisco.com/c/dam/en/us/solutions/enterprise-networks/context-aware-mobility-solution/profile_arcsight_c07-538803.pdf

ISE and SIEM integration

Octavian Szolga — Thu, 13 Feb 2014 11:28:17 GMT

It seems you're right. Cisco will publish the details regarding ISE/SIEM integration late this summer.

Is there a document available

apaldhikar1 — Wed, 17 Jun 2015 16:30:50 GMT

Is there a document available for the integration of ArcSight SIEM with Cisco ISE which includes the milestones and the success criteria? I am not able to find anything specific.

I don' think there will be

Octavian Szolga — Wed, 19 Aug 2015 08:57:22 GMT

I don' think there will be any (personal opinion). Some Cisco moderator should answer this one.

If you ask me, all the effort is put into developing pxGrid. If you environment does not work with pxGrid, that's it. It will not work.