ISE AD Security Event log?

[rangerdangerx]

If you have ISE integrated with AD, when a user authenticates with ISE does it create a login event on the DC security event log?

[Gagandeep Singh]

Yes, it does as ISE sends request to DC for user check and once it gets confirmation then ISE looks for authorizing that AD user. So in a nutshell, DC should have a log for that user event viewer.

Regards

Gagan

PS : rate if it helps!!!!!

[rangerdangerx]

but it would be a dot1x login event and not ldap correct? 

[Gagandeep Singh · Accepted solution]

It should be irrespective of AD/LDAP. As during authentication of user, ISE talks to Kerberos and for group retrieval/Lookup from AD, it uses LDAP application.

In both cases, event should generate on AD.

Request can be DOT1X which uses RADIUS protocol or it can be TACACS user authentication from AD/LDAP server.

Regards

Gagan

PS : rate if it helps!!!!!

[rangerdangerx]

lets say I have a firepower user agent, which picks up login events from a dc, would the user agent see those events?

[Gagandeep Singh]

We can do that from ISE by sending logs to Syslog server. But don't know how to do that from Microsoft end. It would be better to open a thread with Microsoft team.

You can keep this thread running if required any further questions from our end.

Regards

Gagan

PS : rate helpful posts...

[Sakun Sharma]

Hi

How do we configure ISE to send those logs to FMC or FTD?

Thanks