Stealthwatch Quarantine request failed to send to ISE

[phuhd2]

I'm deploying Cisco ISE 2.3.0 and Stealthwatch 6.9. My ISE and Stealthwatch are connected  via pxGrid. I can't find configuration guide for integrating Stealthwatch 6.9 and ISE 2.3. So that I followed of the " Deploying Cisco Stealthwatch 6.9 with Cisco Identity Services Engine (ISE) 2.2 using Cisco Platform Exchange Grid (pxGrid)" and used the External CA Server.

ISE and Stealthwatch are connected, but I can't do Quanrantine request.

Quarantine request failed to send to ISE: "Mitigation request was not sent because no active users were present on this host, or the active users came from an ISE installation not configured to this SMC"

How do I tshoot this Error?

[nir-r]

I have the same issue with Stealthwatch implementation 6.9 & 6.10

No users appear on SMC and for this reason quarantine doesn't work.

According to TAC there is a bug that should be solved with upcoming 6.9/6.10 updates (6.9.5, 6.10.3)

[phuhd2]

Hi nir-r,

Could you please show me the Bug link about that to me get more detail?

[hslai]

Please ensure you are following the "Testing" section (page 44 and on) of

Deploying Cisco Stealthwatch 6.9 with Cisco Identity Services Engine (ISE) 2.2 using Cisco Platform Exchange Grid (pxGri…

First of all, the endpoint needs authenticated to ISE successfully with an active session. Then, verify the StealthWatch receives the info and shows the entry's end time as current.

[phuhd2]

I didn't see any documents for Cisco ISE 2.3, so I followed "Deploying Cisco Stealthwatch 6.9 with Cisco Identity Services Engine (ISE) 2.2 using Cisco Platform Exchange Grid (pxGrid)".

The endpoint was authenticated to ISE successfully and on  client's status also "active" as the third picture above.

[hslai]

Page 45 of Deploying Cisco Stealthwatch 6.9 with Cisco Identity Services Engine (ISE) 2.2 using Cisco Platform Exchange Grid (pxGri… shows a "current" session. I am suspecting that yours have nothing current.

Try logging in as a different user.

[hslai]

Additionally, please ensure you have the latest patches installed on the StealthWatch 6.9.

[phuhd2]

I'm using Stealthwatch 6.9.2. I have just checked the latest patches and seen that Cisco stopped release 6.9 version. Now, only 6.10.2.

[hslai]

6.10.2 should work.

6.9.x appears available @ "Flexera/Download & License Center" and under "Archive Versions".

Back in March 2018, StealthWatch team advised me to use 6.9.3 or 6.10.1.

[phuhd2]

Thanks hslai, let me update the latest patches on version 6.9 and try again.