Use https://seceonhelp.freshdesk.com/support/login to access updated Knowledge Base Articles, Submit Technical Support Tickets and Review Status of submitted support tickets.

Configuring a remote logging target in Cisco ISE

Owned by Customer Success & Engineering (Unlicensed)
Last updated: Feb 13, 2023
2 min read

Overview

We are providing you with the steps to integrate your Logging target in Cisco ISE with Seceon SIEM so it can have Comprehensive visibility and Proactive Threat Detection in your Environment. There will be a log transfer between your firewall to APE(Analytics and Policy Engine) via CCE (Collection and Control Engine ).

Steps Of Configuration

To forward syslog events to Seceon’s CCE, you must configure your Cisco ISE appliance with a remote logging target.

  1. Log in to your Cisco ISE Administration Interface.

  2. From the navigation menu, select Administration > System > Logging > Remote Logging Targets.

  3. Click Add, and then configure the following parameters:

Option

Description

Name

Type a unique name for the remote target system.

Description

You can uniquely identify the target system for users

IP address

Type the IP address of the QRadar Console or Event Collector.

Port

Type 514 or use the port value that you specified in your Cisco ISE log source for “customer’s CCE IP”

Facility Code

From the Facility Code list, select the syslog facility to use for logging events.

Maximum Length

Type 1024 as the maximum packet length allowed for the UDP syslog message.

 

4.Click Submit.

Configure the logging categories that are forwarded by Cisco ISE to Seceon aiSIEM.

Verification Of Configuration

Verification can be done either from CCE Server or from UI.

Using UI

STEP 1: Log in to UI >> SYSTEM

STEP 2: >> LOGS AND FLOWS COLLECTION STATUS.

STEP 3: >>Inside SOURCE DEVICE IP, IP will reflect.

Using CCE Server

“sudo tcpdump -i any host 514 (for logs) and 9995 (for flows) and host <IP address> -AAA” command should be running on the CCE server to check whether or not we are getting logs.

Seceon Inc. All rights reserved. https://www.seceon.com