topic Re: stealth watch users info like mac address, device type, show unkn in Security Analytics

stealth watch users info like mac address, device type, show unknown

mubarak011 — Sun, 02 Apr 2023 09:54:46 GMT

Hi there, Recently I integrated CISCO identity service engine 3.0.0.458 with stealth watch 7.3.0, the Active directory service are enabled & I get to see the users in monitor section of stealth watch management center , when i open the user for better details all details show except the mac address, device type, mac vendor show unknown" my client wants the details to be visible, any idea why i am unable to get the details.

I have attached the snap for reference.

Re: stealth watch users info like mac address, device type, show unkn

balaji.bandi — Sun, 02 Apr 2023 11:00:11 GMT

Does the ISE show you that information in ISE Logs ?

Re: stealth watch users info like mac address, device type, show unkn

mubarak011 — Sun, 02 Apr 2023 14:20:36 GMT

yes they are appearing snap attatched

Re: stealth watch users info like mac address, device type, show unkn

jamegill — Tue, 18 Apr 2023 17:48:50 GMT

Hi @mubarak011,

Check your PxGrid integration between Stealthwatch/SNA and ISE. It looks like SNA is getting the info from AD (in the top panel of your first screenshot), but not all of the details in about the authenticated host (the lower panel of your first screenshot) which comes from ISE.