ISE and SIEM integration

[Octavian Szolga]

Hi,

One of the major concerns regarding security solutions is the way they interact. ISE specifically, is compatible with most of the SIEMs available today, as stated by Cisco (http://www.cisco.com/en/US/prod/vpndevc/ecosystem.html).

In my particular case, I want to integrate ISE with ArcSight.

For ArcSight to correctly parse the syslog messages that ISE sends, you have to install/configure an ISE smartconnector.

What I'm missing though is how does ArcSight instructs ISE to take specific actions on users/devices that are involved in a network attack.

Please check: http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5712/ps11640/at_a_glance_c45-728401.pdf

SIEM/TD partners may utilize ISE as a conduit for taking mitigation actions within the Cisco network infrastructure. SIEM/TD platforms can instruct ISE to undertake quarantine or access-block actions on users and/or device based on ISE policies that have been defined for such actions. 

Thanks!

Octavian

[Naveen Kumar · Accepted solution]

There is no such docs available till now for ArcSight integration with ISE. I also found only these two links:

http://www.cisco.com/c/dam/en/us/products/collateral/security/identity-services-engine/at_a_glance_c45-728401.pdf

http://www.cisco.com/c/dam/en/us/solutions/enterprise-networks/context-aware-mobility-solution/profile_arcsight_c07-538803.pdf

[Octavian Szolga]

It seems you're right. Cisco will publish the details regarding ISE/SIEM integration late this summer.

[apaldhikar1]

Is there a document available for the integration of ArcSight SIEM with Cisco ISE which includes the milestones and the success criteria? I am not able to find anything specific.

[Octavian Szolga]

I don' think there will be any (personal opinion). Some Cisco moderator should answer this one.

If you ask me, all the effort is put into developing pxGrid. If you environment does not work with pxGrid, that's it. It will not work.