User id integration cisco ISE

[mhmameen]

hi i did User id integration cisco ISE using syslog field identifier as article http://k12itdir.blogspot.com/2016/02/paloalto-user-id-from-cisco-ise-nodes.html?m=1 and its working fine . Problem its just send user name without domain and since i have another integration with Active Directory i got domain\username . My request how to have user from ISE to be same like Active Directory domain\username 

[kiwi]

Hi @mhmameen ,

I haven't tested this myself but I came across this Cisco community post saying there's a known problem sending domain\username format in ISE and some users provided different regexes for username detection:

https://community.cisco.com/t5/network-security/ise-send-bad-information-for-palo-alto-user-id-agent...

Hope this helps,

-Kim.

[TomYoung]

Hi @mhmameen ,

If you add the Default Domain Name to your User-ID Monitored Server you have configured for ISE, it should prepend all usernames with domain\.

Thanks,

Tom