First of all which ISE Logging Categories have you selected and sending to your Splunk? In experience, I had to select two different Categories to get what I was looking for in the SYSLOGS. Failed and Passed as shown below not only sends TACACS auth events, but also the RADIUS events. This can be an issue because ISE doesn't have an option to distinguish and pre-filter them. The SYSLOG receiver will need a pre-filter rule to discard a lot of unwanted noise.
The other categories under AAA Diagnostics such as "Administration Authentication and Authorization" contain only TACACS AuthN and AuthZ events.And then finally, the "Accounting" category "TACACS Accounting" contains the TACACS Accounting.
Your question about filtering this in ISE: you can't filter anything - the best we can do is to select the absolute minimum number of categories in ISE to prevent sending stuff that the SIEM doesn't need. The filtering and processing is done on the receiving end.
Thank you Arne.
For now, TACACS Accounting is selected.
And to assess the volume of requests, I've been asked to create separate report for each component: authentication, authorization, and accounting for a week.
Since there is the option to filter Type Accounting and Authentication, I was expecting to be able to apply the same filter in splunk.
However, so far I 've been only able to see Type Accounting, nothing for Authentication, though events for Authentication are seen under Live Logs.
I am able to filter for Type Accounting, but not activities seen for Authentication. Therefore, I was wondering whether the Type Authentication has to be enabled in Cisco ISE / Logging / Logging Categories.
