I noticed that a new Cisco ISE miner has been released with the latest Minemeld 0.9.28. Can someone give a little bit explanation how does this miner works ? is this miner pulling SGTs from Cisco ISE ? if yes, then what does it do with the tags ? Thanks
Also see the commit message for more info: https://github.com/PaloAltoNetworks/minemeld-core/commit/db8ba28b29107c72d1f3f56232aac018ba1a8974 Connect nodes with prototype ers_sgt to sgt_dag, for example: nodes: ers_sgt-1477772195510: inputs:  output: true prototype: ciscoise.ers_sgt sgt_dag-1477848600338: inputs: - ers_sgt-1477772195510 node_type: output output: false prototype: ciscoise.sgt_dag You need a device list file with the PAN-OS API configuration: minemeld@minemeld:/opt/minemeld/local/config$ cat sgt_dag-1477848600338_device_list.yml - hostname: 192.168.1.101 api_username: admin api_password: admin - hostname: 192.168.1.102 api_username: admin api_password: admin Then you can create DAGs with match criteria using the registered-ips. admin@PA-200-2> show object registered-ip all registered IP Tags ---------------------------------------- ----------------- 192.168.1.1 "mmld_ise_sgt_Guests" "mmld_pushed" 192.168.1.2 "mmld_ise_sgt_Quarantined_Systems" "mmld_pushed" 172.25.1.1 "mmld_ise_sgt_Contractors" "mmld_pushed" 10.0.0.1 "mmld_ise_sgt_BYOD" "mmld_ise_sgt_Developers" "mmld_ise_sgt_Employees" "mmld_pushed" Total: 4 registered addresses *: received from user-id agent #: persistent
Has this been validated with the current version of ISE 2.3? I have tried using the ciscoise.ers_sgt prototype with correct ISE ERS credentials and I keep getting a 401 response back, even though I can validate ISE API access with POSTMAN.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!