Cisco ISE Miner

[bartoq]

I noticed that a new Cisco ISE miner has been released with the latest Minemeld 0.9.28. Can someone give a little bit explanation how does this miner works ? is this miner pulling SGTs from Cisco ISE ? if yes, then what does it do with the tags ? Thanks

[ksteves1]

Also see the commit message for more info:

  https://github.com/PaloAltoNetworks/minemeld-core/commit/db8ba28b29107c72d1f3f56232aac018ba1a8974

Connect nodes with prototype ers_sgt to sgt_dag, for example:

nodes:
  ers_sgt-1477772195510:
    inputs: []
    output: true
    prototype: ciscoise.ers_sgt
  sgt_dag-1477848600338:
    inputs:
    - ers_sgt-1477772195510
    node_type: output
    output: false
    prototype: ciscoise.sgt_dag

You need a device list file with the PAN-OS API configuration:

minemeld@minemeld:/opt/minemeld/local/config$ cat sgt_dag-1477848600338_device_list.yml
- hostname: 192.168.1.101
  api_username: admin
  api_password: admin

- hostname: 192.168.1.102
  api_username: admin
  api_password: admin

Then you can create DAGs with match criteria using the registered-ips.

admin@PA-200-2> show object registered-ip all

registered IP                             Tags
----------------------------------------  -----------------

192.168.1.1 
                                         "mmld_ise_sgt_Guests"
                                         "mmld_pushed"

192.168.1.2 
                                         "mmld_ise_sgt_Quarantined_Systems"
                                         "mmld_pushed"

172.25.1.1 
                                         "mmld_ise_sgt_Contractors"
                                         "mmld_pushed"

10.0.0.1 
                                         "mmld_ise_sgt_BYOD"
                                         "mmld_ise_sgt_Developers"
                                         "mmld_ise_sgt_Employees"
                                         "mmld_pushed"

Total: 4 registered addresses
*: received from user-id agent  #: persistent

[pinsall]

Has this been validated with the current version of ISE 2.3? I have tried using the ciscoise.ers_sgt prototype with correct ISE ERS credentials and I keep getting a 401 response back, even though I can validate ISE API access with POSTMAN.

[RamBalaji]

Is there a document to follow? How to use minmeld to featch info from CiSCO ISE?? please share it.

with regards,

ram

[xhoms]

Hi @RamBalaji,

you might want to give the https://github.com/PaloAltoNetworks/ciscoise-miner extension a look.