Cisco ISE Miner

Reply
Highlighted
L3 Networker

Cisco ISE Miner

I noticed that a new Cisco ISE miner has been released with the latest Minemeld 0.9.28. Can someone give a little bit explanation how does this miner works ? is this miner pulling SGTs from Cisco ISE ? if yes, then what does it do with the tags ? Thanks

Highlighted
L3 Networker

Also see the commit message for more info:

  https://github.com/PaloAltoNetworks/minemeld-core/commit/db8ba28b29107c72d1f3f56232aac018ba1a8974

Connect nodes with prototype ers_sgt to sgt_dag, for example:

nodes:
  ers_sgt-1477772195510:
    inputs: []
    output: true
    prototype: ciscoise.ers_sgt
  sgt_dag-1477848600338:
    inputs:
    - ers_sgt-1477772195510
    node_type: output
    output: false
    prototype: ciscoise.sgt_dag

You need a device list file with the PAN-OS API configuration:

minemeld@minemeld:/opt/minemeld/local/config$ cat sgt_dag-1477848600338_device_list.yml
- hostname: 192.168.1.101
  api_username: admin
  api_password: admin

- hostname: 192.168.1.102
  api_username: admin
  api_password: admin

Then you can create DAGs with match criteria using the registered-ips.

admin@PA-200-2> show object registered-ip all

registered IP                             Tags
----------------------------------------  -----------------

192.168.1.1 
                                         "mmld_ise_sgt_Guests"
                                         "mmld_pushed"

192.168.1.2 
                                         "mmld_ise_sgt_Quarantined_Systems"
                                         "mmld_pushed"

172.25.1.1 
                                         "mmld_ise_sgt_Contractors"
                                         "mmld_pushed"

10.0.0.1 
                                         "mmld_ise_sgt_BYOD"
                                         "mmld_ise_sgt_Developers"
                                         "mmld_ise_sgt_Employees"
                                         "mmld_pushed"

Total: 4 registered addresses
*: received from user-id agent  #: persistent
Highlighted
L0 Member

Has this been validated with the current version of ISE 2.3? I have tried using the ciscoise.ers_sgt prototype with correct ISE ERS credentials and I keep getting a 401 response back, even though I can validate ISE API access with POSTMAN.

Highlighted
L2 Linker

Is there a document to follow? How to use minmeld to featch info from CiSCO ISE?? please share it.

 

with regards,

ram

Highlighted
L5 Sessionator

Hi @RamBalaji,

 

you might want to give the https://github.com/PaloAltoNetworks/ciscoise-miner extension a look.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!