Cisco Identity Services Engine (ISE)

OverviewResources

Once Cisco ISE is configured to deliver events to EventTracker Manager, alerts, dashboards, and reports can be configured into EventTracker.

Security

Alerts

Cisco ISE - A failure to establish an SSL session was detected: This alert is triggered when failure in establishing SSL connection is detected.
Cisco ISE - An SSH CLI user has attempted unsuccessfully to login: This alert is triggered when an SSH CLI user fails to login into ISE device.
Cisco ISE - Endpoint Authentication failed: This alert is triggered when an endpoint fails to authenticate itself to a network device in client environment.
Cisco ISE - Endpoint failed authentication of the same scenario several times and was rejected: This alert is triggered when an endpoint fails to authenticate itself multiple times and is rejected.
Cisco ISE - ERS request rejected due to unauthorized user: This alert is triggered when an External RESTful Services (ERS) request is rejected because an unauthorized user has tried to access it.
Cisco ISE - ERS request was rejected due to illegal request on a non-primary node: This alert is triggered when an External RESTful Services (ERS) request is rejected due to illegal request on a non-primary node.
Cisco ISE - ERS xml input is a suspect for XSS or Injection attack: This alert is triggered when an External RESTful Services (ERS) xml input is suspected for an XSS or Injection attack.
Cisco ISE - Potential ERS request suspicious of malicious attack detected: This alert is triggered when a potential External RESTful Services (ERS) request suspicious of malicious attack is detected.
Cisco ISE - RADIUS Accounting tunnel rejected: This alert is triggered when RADIUS accounting tunnel establishment for endpoints and users was rejected either on Cisco ISE or other network devices like routers/ switches.
Cisco ISE - Received Invalid or Bad HTTP request: This alert is triggered when a system detects an invalid or bad HTTP request (this could be an attempted security attack).
Cisco ISE - Rejected administrator session from unauthorized client IP address: This alert is triggered when there is an attempt to start an administration session from an unauthorized client IP address and was rejected.

Reports

Cisco ISE - Failed Attempts on Network Devices: This report provides a detailed summary of failed authentications on various networking devices in client environment. It contains, source IP address, source username, destination device address, port number, etc.

Operations

Alerts

Cisco ISE - An SSH CLI user has successfully logged in: This alert is triggered when an SSH CLI user successfully logs into ISE device.
Cisco ISE - Guest user account is created: This alert is triggered when a guest user account is created in Cisco ISE device.
Cisco ISE - ISE server password updated: This alert is triggered when an ISER server password gets updated/modified by a user.
Cisco ISE - Successfully added a device (endpoint): This alert is triggered when Cisco ISE allows and adds an endpoint to access the corporate network as defined by the policy.
Cisco ISE - Successfully deleted the device (endpoint): This alert is triggered when an endpoint is removed from the access list.
Cisco ISE - The federation link is down: This alert is triggered when federation link/connection is down between Cisco ISE devices.
Cisco ISE - User changed password successfully: This alert is triggered when an internal user changes password for accessing network devices using their user accounts.
Cisco ISE - TACACS+ Accounting request rejected: This alert is triggered when a TACACS+ accounting request is rejected by Cisco ISE.

Reports

Cisco ISE - Passed Authentications: This report contains a detailed summary of events that includes passed authentication in various networking devices in client environment. It contains, source IP address, source username, destination device address, port number, etc.
Cisco ISE - TLS Connection Failure: This report contains a detailed summary of failed TLS connections in Cisco ISE device. It contains, username, ISE local address/port and failure reason.
Cisco ISE - Federation link is down: This report contains a detailed summary of events where a federation link/connection between ISE devices is down. It contains the devices names, and cause of the link failure/down.

Compliance

Alerts

Netwrix Auditor - Failed configuration Activities: This report gives information about all the failed configuration activities detected in Netwrix Auditor. Report contains username, object name, domain name, etc.
Netwrix Auditor - Successful user login activities: This report gives information about all the user successful login activities detected in Netwrix Auditor. Report contains username, domain name, IP address, application name, etc.

Reports

Cisco ISE - Successfully blacklisted the device (endpoint): This alert is triggered when an endpoint is blacklisted/ blocked from network access.
Cisco ISE - Endpoint Compliance Status: This report contains a detailed summary of Endpoint Compliance Status by Cisco ISE. It contains the source IP address, posture status, user ID and other useful information.

Scope

The configuration details are consistent with EventTracker version 9.3x and later and Cisco ISE version 2.x.

Documentation:

To configure Cisco ISE to send logs to EventTracker, refer to the How-to Guide.

For more information please refer to the Integration guide.