Hi,
I was working on the use case of Cisco ISE anomalous behaviour particularly on MAC spoofing for my SIEM.
I've come across this https://clnv.s3.amazonaws.com/2018/usa/pdf/BRKSEC-3697-Reference.pdf
And it seems that the message codes for MAC spoofing would be 80016. However, I can't confirm this is the message code unless a spoofing activity being done, and that is not possible to request customer to do it.
Anyone have any idea on how to detect MAC spoofing other than checking on the message code. I'm stuck on this.
Please help
Oblime
