Cisco ISE Miner

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Cisco ISE Miner

L3 Networker

I noticed that a new Cisco ISE miner has been released with the latest Minemeld 0.9.28. Can someone give a little bit explanation how does this miner works ? is this miner pulling SGTs from Cisco ISE ? if yes, then what does it do with the tags ? Thanks

4 REPLIES 4

L3 Networker
Also see the commit message for more info:

  https://github.com/PaloAltoNetworks/minemeld-core/commit/db8ba28b29107c72d1f3f56232aac018ba1a8974

Connect nodes with prototype ers_sgt to sgt_dag, for example:

nodes:
  ers_sgt-1477772195510:
    inputs: []
    output: true
    prototype: ciscoise.ers_sgt
  sgt_dag-1477848600338:
    inputs:
    - ers_sgt-1477772195510
    node_type: output
    output: false
    prototype: ciscoise.sgt_dag

You need a device list file with the PAN-OS API configuration:

minemeld@minemeld:/opt/minemeld/local/config$ cat sgt_dag-1477848600338_device_list.yml
- hostname: 192.168.1.101
  api_username: admin
  api_password: admin

- hostname: 192.168.1.102
  api_username: admin
  api_password: admin

Then you can create DAGs with match criteria using the registered-ips.

admin@PA-200-2> show object registered-ip all

registered IP                             Tags
----------------------------------------  -----------------

192.168.1.1 
                                         "mmld_ise_sgt_Guests"
                                         "mmld_pushed"

192.168.1.2 
                                         "mmld_ise_sgt_Quarantined_Systems"
                                         "mmld_pushed"

172.25.1.1 
                                         "mmld_ise_sgt_Contractors"
                                         "mmld_pushed"

10.0.0.1 
                                         "mmld_ise_sgt_BYOD"
                                         "mmld_ise_sgt_Developers"
                                         "mmld_ise_sgt_Employees"
                                         "mmld_pushed"

Total: 4 registered addresses
*: received from user-id agent  #: persistent

Has this been validated with the current version of ISE 2.3? I have tried using the ciscoise.ers_sgt prototype with correct ISE ERS credentials and I keep getting a 401 response back, even though I can validate ISE API access with POSTMAN.

Is there a document to follow? How to use minmeld to featch info from CiSCO ISE?? please share it.

 

with regards,

ram

Hi @RamBalaji,

 

you might want to give the https://github.com/PaloAltoNetworks/ciscoise-miner extension a look.

  • 6764 Views
  • 4 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!