Cisco ISE Miner

Reply
L3 Networker

Cisco ISE Miner

I noticed that a new Cisco ISE miner has been released with the latest Minemeld 0.9.28. Can someone give a little bit explanation how does this miner works ? is this miner pulling SGTs from Cisco ISE ? if yes, then what does it do with the tags ? Thanks

L3 Networker

Re: Cisco ISE Miner

Also see the commit message for more info:

  https://github.com/PaloAltoNetworks/minemeld-core/commit/db8ba28b29107c72d1f3f56232aac018ba1a8974

Connect nodes with prototype ers_sgt to sgt_dag, for example:

nodes:
  ers_sgt-1477772195510:
    inputs: []
    output: true
    prototype: ciscoise.ers_sgt
  sgt_dag-1477848600338:
    inputs:
    - ers_sgt-1477772195510
    node_type: output
    output: false
    prototype: ciscoise.sgt_dag

You need a device list file with the PAN-OS API configuration:

minemeld@minemeld:/opt/minemeld/local/config$ cat sgt_dag-1477848600338_device_list.yml
- hostname: 192.168.1.101
  api_username: admin
  api_password: admin

- hostname: 192.168.1.102
  api_username: admin
  api_password: admin

Then you can create DAGs with match criteria using the registered-ips.

admin@PA-200-2> show object registered-ip all

registered IP                             Tags
----------------------------------------  -----------------

192.168.1.1 
                                         "mmld_ise_sgt_Guests"
                                         "mmld_pushed"

192.168.1.2 
                                         "mmld_ise_sgt_Quarantined_Systems"
                                         "mmld_pushed"

172.25.1.1 
                                         "mmld_ise_sgt_Contractors"
                                         "mmld_pushed"

10.0.0.1 
                                         "mmld_ise_sgt_BYOD"
                                         "mmld_ise_sgt_Developers"
                                         "mmld_ise_sgt_Employees"
                                         "mmld_pushed"

Total: 4 registered addresses
*: received from user-id agent  #: persistent
L0 Member

Re: Cisco ISE Miner

Has this been validated with the current version of ISE 2.3? I have tried using the ciscoise.ers_sgt prototype with correct ISE ERS credentials and I keep getting a 401 response back, even though I can validate ISE API access with POSTMAN.

L2 Linker

Re: Cisco ISE Miner

Is there a document to follow? How to use minmeld to featch info from CiSCO ISE?? please share it.

 

with regards,

ram

L5 Sessionator

Re: Cisco ISE Miner

Hi @RamBalaji,

 

you might want to give the https://github.com/PaloAltoNetworks/ciscoise-miner extension a look.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!