Cisco Identity Services Engine

Transcription

1 164 CISCO Cisco Identity Services Engine Configuration overview The Cisco Identity Services Engine (ISE) DSM for QRadar accepts syslog events from Cisco ISE appliances with log sources configured to use the UDP Multiline protocol. QRadar supports syslog events forwarded by Cisco ISE versions 1.1. Before you configure your Cisco ISE appliance, you should consider which logging categories you want to configure on your Cisco ISE to forward to QRadar. Each logging category must be configured with a syslog severity and included as a remote target to allow Cisco ISE to forward the event to QRadar. The log source you configure in QRadar receives the event forwarded from Cisco ISE and uses a regular expression to assemble the multiline syslog event in to an event readable by QRadar. To integrate Cisco ISE events with QRadar, you must perform the following tasks: 1 Configure a log source in QRadar for your Cisco ISE appliance forwarding events to QRadar. 2 Create a remote logging target for QRadar on your Cisco ISE appliance. 3 Configure the logging categories on your Cisco ISE appliance. Supported event logging categories The Cisco ISE DSM for QRadar is capable of receiving syslog events from the following event logging categories. Table 20-1 Supported Cisco ISE event logging categories Event logging category AAA audit Failed attempts Passed authentication AAA diagnostics Administrator authentication and authorization Authentication flow diagnostics Identity store diagnostics Policy diagnostics Radius diagnostics Guest Accounting Radius accounting Administrative and operational audit Posture and client provisioning audit Posture and client provisioning diagnostics Profiler

2 Cisco Identity Services Engine 165 Table 20-1 Supported Cisco ISE event logging categories (continued) Event logging category System diagnostics Distributed management Internal operations diagnostics System statistics Configuring a Cisco ISE log source in QRadar Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 Step 8 Step 9 Step 10 To collect syslog events, you must configure a log source for Cisco ISE in QRadar to use the UDP Multiline Syslog protocol. You must configure a log source for each individual Cisco ISE appliance that forwards events to QRadar. However, all Cisco ISE appliances can forward their events to the same listen port on QRadar that you configure Procedure Log in to QRadar. Click the Admin tab. In the navigation menu, click Data Sources. Click the Log Sources icon. Click Add. In the Log Source Name field, type a name for your log source. In the Log Source Description field, type a description for your log source. From the Log Source Type list box, select Cisco Identity Services Engine. From the Protocol Configuration list box, select UDP Multiline Syslog. Configure the following values: Table 20-2 Cisco ISE log source parameters Parameter Log Source Identifier Description Type the IP address, host name, or name to identify the log source or appliance providing UDP Multiline Syslog events to QRadar.

3 166 CISCO Table 20-2 Cisco ISE log source parameters (continued) Parameter Listen Port Message ID Pattern Description Type 517 as the port number used by QRadar to accept incoming UDP Multiline Syslog events. The valid port range is 1 to To edit a saved configuration to use a new port number: 1 In the Listen Port field, type the new port number for receiving UDP Multiline Syslog events. 2 Click Save. 3 On the Admin tab, select Advanced > Deploy Full Configuration. After the full deploy completes, QRadar is capable of receiving events on the updated listen port. Note: When you click Deploy Full Configuration, QRadar restarts all services, resulting in a gap in data collection for events and flows until the deployment completes. Type the following regular expression (regex) required to filter the event payload messages. CISE_\S+ (\d{10}) Step 11 Step 12 Click Save. On the Admin tab, click Deploy Changes. Creating a remote logging target in Cisco ISE Step 1 What to do next You are now ready to configure your Cisco ISE appliance with a remote logging target. To forward syslog events to QRadar, you must configure your Cisco ISE appliance with a remote logging target. Procedure Log in to your Cisco ISE Administration Interface. Step 2 From the navigation menu, select Administration > System > Logging > Remote Logging Targets. Step 3 Click Add. Step 4 In the Name field, type a name for the remote target system. Step 5 In the Description field, type a description. Step 6 In the IP Address field, type a the IP address of the QRadar Console or Event Collector. Step 7 In the Port field, type 517 or use the port value you specific in your Cisco ISE log source for QRadar. Step 8 From the Facility Code list box, select the syslog facility to use for logging events.

4 Cisco Identity Services Engine 167 Step 9 Step 10 In the Maximum Length field, type 1024 as the maximum packet length allowed for the UDP syslog message. Click Submit. The remote logging target is created for QRadar. What to do next You are now ready to configure the logging categories forwarded by Cisco ISE to QRadar. Configuring Cisco ISE logging categories To define which events are forwarded by your Cisco ISE appliance, you must configure each logging category with a syslog severity and the remote logging target your configured for QRadar. For a list of pre-defined event logging categories for Cisco ISE, see Supported event logging categories. Procedure Step 1 From the navigation menu, select Administration > System > Logging > Logging Categories. Step 2 Select a logging category, and click Edit. Step 3 From the Log Severity list box, select a severity for the logging category. Step 4 In the Target field, add your remote logging target for QRadar to the Select box. Step 5 Click Save. Step 6 Repeat this process for each logging category you want to forward to QRadar. The configuration is complete. Events forwarded by Cisco ISE are displayed on the Log Activity tab in QRadar.

5 SUPPORTED DSMS Table 67-1 Supported DSMs Table 67-1 provides information on the DSMs supported for IBM Security QRadar. IBM Security QRadar integrates with many manufacturers and vendors of security products. Our list of supported DSMs and documentation is constantly increasing. If your device or appliance is not listed in this document, contact your sales representative. Manufacturer DSM Version Cisco Identity Services Engine Events Accepted v1.1 UDP Multiline Syslog Protocol QRadar Recorded Events Option in QRadar All device events Cisco Identity Services Engine Auto Discovered Includes Identity For More Information No Yes * These devices are auto discovered as Cisco IOS devices. ** These devices are auto discovered as a Juniper JunOS Platform devices. *** PCAP Syslog Combination protocol is only available on the Juniper Networks SRX Series appliance.

6 646 SUPPORTED DSMS