topic Re: Integerating MSE/WLC into SIEM? in Wireless

Integerating MSE/WLC into SIEM?

asad ali — Sun, 04 Jul 2021 07:01:41 GMT

I'm from the sec team, and the company in which i work in is using Wireless Control System Plus with MSE (mobility security engine).

Now using syslog I'm interested in detecting rogue access points, What source should i enable syslog either controller or mse? I want to brng that logs to SIEM for higher correlation. I'm still confused.

We are using cisco aironet 3500 series .

Lan controller 5500

MSE 3300 series

WCS v 5.0

Re: Integerating MSE/WLC into SIEM?

Scott Fella — Sun, 05 May 2013 13:26:01 GMT

Well first off, the MSE is a Mobility Services Engine not a security engine. You also have to make sure you have the correct code versions on your WLC, WCS and MSE. The WCS version is very old and the rule of thumb is to have the WCS and MSE an equal or higher version than the WLC. The WLC only supports the WLC on v7.0.x. You might have to upgrade your WCS to Prime infrastructure. Please refer to the compatibility matrix below.

http://www.cisco.com/en/US/docs/wireless/controller/5500/tech_notes/Wireless_Software_Compatibility_Matrix.html

Rogue detection can come from the WLC, but it might be unusable if you have many rogue AP's being detected especially if your in a downtown building for example.

Sent from Cisco Technical Support iPhone App

Re: Integerating MSE/WLC into SIEM?

asad ali — Sun, 05 May 2013 13:33:29 GMT

Thank you for your respons.

I was seeing the syslog options In the facility drop down menu , there was list of options (kernel,mail,cron) by defualt its set to local use 0. Does this level mean that it caters for all the levels that are less or equal then its.

E.g

Kernel = Facility level 0

•User Process = Facility level 1

•Mail = Facility level 2

•System Daemons = Facility level 3

•Authorization = Facility level 4

•Syslog = Facility level 5 (default value)

•Line Printer = Facility level 6

•USENET = Facility level 7

•Unix-to-Unix Copy = Facility level 8

•Cron = Facility level 9

•FTP Daemon = Facility level 11

•System Use 1 = Facility level 12

•System Use 2 = Facility level 13

•System Use 3 = Facility level 14

•System Use 4 = Facility level 15

Re: Integerating MSE/WLC into SIEM?

Scott Fella — Sun, 05 May 2013 13:37:57 GMT

If you set a syslog level, only those messages whose severity is equal to or less than that level are sent to the syslog servers. For example, if you set the syslog level to Warnings (severity level 4), only those messages whose severity is between 0 and 4 are sent to the syslog servers.

Sent from Cisco Technical Support iPhone App

Re: Integerating MSE/WLC into SIEM?

asad ali — Sun, 05 May 2013 13:44:45 GMT

That i understand, but what i don't understand is the faciliy levels? how are they define and set.