Collect Cisco ISE logs

This document describes how you can collect Cisco Identify Services Engine (ISE) logs by using a Google Security Operations forwarder.

For more information, see Data ingestion to Google Security Operations .

An ingestion label identifies the parser which normalizes raw log data to structured UDM format. The information in this document applies to the parser with the CISCO_ISE ingestion label.

Configure Cisco ISE

1. Sign in to Cisco ISE console using administrator credentials.
2. In the Cisco ISE console, select Administration > System > Logging > Remote logging targets.
3. In the Remote logging targetswindow, click Add. The New logging targetwindow appears.

4. In the Logging targetsection, specify values for the following fields:

   Field

   Description

   Name

   Name of the Google Security Operations forwarder.

   Description

   Description of the Google Security Operations forwarder.

   Type

   Type of the remote log target, such as syslog.

   IP address

   IP address of the Google Security Operations forwarder.

   Target type

   Select TCP syslog or UDP syslog.

   Port

   Use a high port, such as 10514.

   Facility code

   You can specify one of the following values:

   • LOCAL0 (code = 16)
   • LOCAL1 (code = 17)
   • LOCAL2 (code = 18)
   • LOCAL3 (code = 19)
   • LOCAL4 (code = 20)
   • LOCAL5 (code = 21)
   • LOCAL6 (code = 22; default)
   • LOCAL7 (code = 23)

   Maximum length

   The recommended value is 1024.

5. Click Submit. The Remote log targetswindow appears with the new Google Security Operations forwarder configuration.

6. In the Cisco ISE console, select Administration > System > Logging > Logging categories.

7. In the Logging categorieswindow, select the categories for which you want to set the remote syslog target and add the remote syslog target.

   The following are the sample categories: AAA audits, AAA diagnostics, accounting, administrative and operational audit, posture and client provisioning audit, posture and client provisioning diagnostics, profiler, system diagnostics, and system statistics.

Configure Google Security Operations forwarder and syslog to ingest Cisco Secure ACS logs

1. Go to SIEM Settings > Forwarders.
2. Click Add new forwarder.
3. In the Forwarder Namefield, enter a unique name for the forwarder.
4. Click Submit. The forwarder is added and the Add collector configurationwindow appears.
5. In the Collector namefield, type a name.
6. Select Cisco ISEas the Log type.
7. Select Syslogas the Collector type.
8. Configure the following mandatory input parameters:
   • Protocol: specify the protocol.
   • Address: specify the target IP address or hostname where the collector resides and addresses to the syslog data.
   • Port: specify the target port where the collector resides and listens for syslog data.
9. Click Submit.

For more information about Google Security Operations forwarders, see Google Security Operations forwarders documentation . For information about requirements for each forwarder type, see Forwarder configuration by type . If you encounter issues when you create forwarders, contact Google Security Operations support .

Field mapping reference

This parser extracts Cisco ISE logs from syslog messages, normalizes the data into UDM format, and enriches the event with additional context. It handles various ISE log categories, including authentication successes and failures, administrative audits, system statistics, and more, mapping relevant fields to the UDM schema and adding specific labels for detailed analysis.

UDM Mapping Table

Need more help? Get answers from Community members and Google SecOps professionals.