Recopila registros de Cisco ISE

Se admite en los siguientes sistemas operativos:

En este documento, se explica cómo transferir registros de Cisco ISE a Google Security Operations con Bindplane.

El analizador extrae campos de los registros con formato CSV y de syslog de Cisco ISE. Utiliza grok o kv para analizar el mensaje de registro y, luego, asigna estos valores al Modelo de datos unificados (UDM). También establece valores de metadatos predeterminados para el origen y el tipo del evento.

Antes de comenzar

Asegúrate de cumplir con los siguientes requisitos previos:

  • Una instancia de Google SecOps
  • Windows Server 2016 o versiones posteriores, o host de Linux con systemd
  • Si se ejecuta detrás de un proxy, asegúrate de que los puertos de firewall estén abiertos según los requisitos del agente de Bindplane.
  • Acceso con privilegios al portal de administración de Cisco ISE

Obtén el archivo de autenticación de transferencia de Google SecOps

  1. Accede a la consola de Google SecOps.
  2. Ve a Configuración de SIEM > Agentes de recopilación.
  3. Descarga el archivo de autenticación de transferencia. Guarda el archivo de forma segura en el sistema en el que se instalará BindPlane.

Obtén el ID de cliente de Google SecOps

  1. Accede a la consola de Google SecOps.
  2. Ve a Configuración de SIEM > Perfil.
  3. Copia y guarda el ID de cliente de la sección Detalles de la organización.

Instala el agente de BindPlane

Instala el agente de Bindplane en tu sistema operativo Windows o Linux según las siguientes instrucciones.

Instalación en Windows

  1. Abre el símbolo del sistema o PowerShell como administrador.

  2. Ejecuta el comando siguiente:

    msiexec /i "https://github.com/observIQ/bindplane-agent/releases/latest/download/observiq-otel-collector.msi" /quiet

  3. Espera a que se complete la instalación.

  4. Ejecute el siguiente comando para verificar la instalación:

    sc query observiq-otel-collector

El servicio debe mostrarse como RUNNING.

Instalación en Linux

  1. Abre una terminal con privilegios de administrador o sudo.

  2. Ejecuta el comando siguiente:

    sudo sh -c "$(curl -fsSlL https://github.com/observiq/bindplane-agent/releases/latest/download/install_unix.sh)" install_unix.sh

  3. Espera a que se complete la instalación.

  4. Ejecute el siguiente comando para verificar la instalación:

    sudo systemctl status observiq-otel-collector

El servicio debería mostrarse como activo (en ejecución).

Recursos de instalación adicionales

Para obtener más opciones de instalación y solucionar problemas, consulta la guía de instalación del agente de Bindplane.

Configura el agente de BindPlane para transferir Syslog y enviarlo a Google SecOps

Ubica el archivo de configuración

  • Linux:

    sudo nano /etc/bindplane-agent/config.yaml

  • Windows:

    notepad "C:\Program Files\observIQ OpenTelemetry Collector\config.yaml"

Edita el archivo de configuración

  • Reemplaza todo el contenido de config.yaml con la siguiente configuración:

    receivers:
    udplog:
        listen_address: "0.0.0.0:514"

exporters:
    chronicle/chronicle_w_labels:
        compression: gzip
        creds_file_path: '/path/to/ingestion-authentication-file.json'
        customer_id: 'YOUR_CUSTOMER_ID'
        endpoint: malachiteingestion-pa.googleapis.com
        log_type: 'CISCO_ISE'
        raw_log_field: body
        ingestion_labels:

service:
    pipelines:
        logs/source0__chronicle_w_labels-0:
            receivers:
                - udplog
            exporters:
                - chronicle/chronicle_w_labels

Parámetros de configuración

  • Reemplaza los marcadores de posición que se indican más abajo:

    • Configuración del receptor:

      • udplog: Usa udplog para el registro del sistema UDP o tcplog para el registro del sistema TCP.
      • 0.0.0.0: Dirección IP en la que se realizará la escucha (0.0.0.0 para escuchar en todas las interfaces)
      • 514: Número de puerto en el que se debe escuchar (puerto syslog estándar)

    • Configuración del exportador:

      • creds_file_path: Ruta de acceso completa al archivo de autenticación de la transferencia:
        • Linux: /etc/bindplane-agent/ingestion-auth.json
        • Windows: C:\Program Files\observIQ OpenTelemetry Collector\ingestion-auth.json
      • YOUR_CUSTOMER_ID: ID de cliente de la sección Obtén el ID de cliente
      • endpoint: URL del extremo regional:
        • EE.UU.: malachiteingestion-pa.googleapis.com
        • Europa: europe-malachiteingestion-pa.googleapis.com
        • Asia: asia-southeast1-malachiteingestion-pa.googleapis.com
        • Consulta Extremos regionales para obtener la lista completa.
      • log_type: Tipo de registro tal como aparece en Chronicle (CISCO_ISE)

Guarda el archivo de configuración

  • Después de editarlo, guarda el archivo:
    • Linux: Presiona Ctrl+O, luego Enter y, después, Ctrl+X.
    • Windows: Haz clic en Archivo > Guardar

Reinicia el agente de Bindplane para aplicar los cambios

  • Para reiniciar el agente de Bindplane en Linux, ejecuta el siguiente comando:

    sudo systemctl restart observiq-otel-collector

    1. Verifica que el servicio esté en ejecución:

        sudo systemctl status observiq-otel-collector

    2. Revisa los registros en busca de errores:

        sudo journalctl -u observiq-otel-collector -f

  • Para reiniciar el agente de Bindplane en Windows, elige una de las siguientes opciones:

    • Símbolo del sistema o PowerShell como administrador:

      net stop observiq-otel-collector && net start observiq-otel-collector

    • Consola de Services:

      1. Presiona Win+R, escribe services.msc y presiona Intro.
      2. Busca observIQ OpenTelemetry Collector.

      3. Haz clic con el botón derecho y selecciona Reiniciar.

      4. Verifica que el servicio esté en ejecución:

        sc query observiq-otel-collector

      5. Revisa los registros en busca de errores:

        type "C:\Program Files\observIQ OpenTelemetry Collector\log\collector.log"

Configura el reenvío de Syslog en Cisco ISE

  1. Accede al portal de Administración de Cisco ISE.
  2. Ve a Administración > Sistema > Registro > Destinos de registro remoto.
  3. Haz clic en Agregar para crear un nuevo destino de registro remoto.
  4. Proporciona los siguientes detalles de configuración:
    • Nombre: Ingresa un nombre descriptivo (por ejemplo, Google-SecOps-Bindplane).
    • Descripción: Ingresa una descripción (opcional).
    • Dirección IP: Ingresa la dirección IP del host del agente de Bindplane.
    • Puerto: Ingresa 514.
    • Código de la instalación: Selecciona LOCAL6 (o la instalación que prefieras).
    • Longitud máxima: Ingresa 8192 (o el valor máximo admitido).
    • Include Alarms in Syslog Messages: Marca esta opción si quieres incluir alarmas.
  5. Haz clic en Guardar.
  6. Ve a Administración > Sistema > Registro > Categorías de registro.
  7. Selecciona cada categoría de registro que quieras reenviar y haz clic en Editar:
    • Auditoría de AAA
    • AAA Diagnostics
    • Contabilidad
    • Auditoría del administrador
    • Auditoría de aprovisionamiento de clientes y postura
    • Profiler
    • Diagnóstico del sistema
  8. En la sección Destinos, mueve el destino de registro remoto Google-SecOps-Bindplane de Disponible a Seleccionado.
  9. Haz clic en Guardar.
  10. Para verificar que se envíen los mensajes de syslog, consulta los registros del agente de Bindplane.

Tabla de asignación de UDM

Campo de registro Asignación de UDM Observación
AAA_Event security_result.detection_fields
AAA_Security_Result.detection_fields aaa_service
ac-user-agent network.http.user_agent
Acct-Authentic security_result.detection_fields
Acct-Delay-Time security_result.detection_fields
Acct-Input-Octets security_result.detection_fields
Acct-Input-Packets security_result.detection_fields
Acct-Output-Octets security_result.detection_fields
Acct-Output-Packets security_result.detection_fields
Acct-Session-Id sec_result.detection_fields, additional.fields
Acct-Session-Time security_result.detection_fields
Acct-Status-Type security_result.detection_fields
Acct-Terminate-Cause security_result.detection_fields
AcctReply-Status security_result.detection_fields
AcctRequest-Flags security_result.detection_fields
ACS_CiscoSecure_Defined_ACL security_result.detection_fields
AcsSessionID sec_result.detection_fields, additional.fields
Acción security_result.action_details
action_details security_result.action_details
ActiveSessionCount security_result.detection_fields
ad_identifier about.hostname
ad_join_point principal.administrative_domain
ad_operating_system principal.platform
AD-Account-Name principal.user.userid, target.hostname
Dominio de AD principal.group.group_display_name
AD-Domain-Controller target.administrative_domain
AD-Error-Details security_result.description
AD-Forest target.resource.attribute.labels
AD-Groups-Names principal.user.group_identifiers
AD-Host-Candidate-Identities sec_result.detection_fields
AD-IP-Address target.ip, target.asset.ip
AD-Log-Id sec_result.detection_fields
AD-Site target.location.name
AD-Srv-Query security_result.detection_fields
AD-Srv-Record security_result.detection_fields
AD-User-Candidate-Identities principal.user.attribute.labels
AD-User-DNS-Domain network.dns_domain
AD-User-Join-Point target.hostname, target.asset.hostname
AD-User-NetBios-Name principal.user.attribute.labels
AD-User-Qualified-Name principal.user.email_addresses
AD-User-Resolved-DNs principal.user.attribute.labels
AD-User-Resolved-Identities sec_result.detection_fields, principal.user.userid
AD-User-Resolved-Identities
AD-User-SamAccount-Name principal.user.attribute.labels
Administrador principal.user.userid
AdminInterface principal.user.attribute.labels
AdminIPAddress principal.ip
AdminName principal.user.userid
affected-dn target.resource.nametarget.resource.attribute.labels, target.resource.resource_type target.resource.resource_type => "USER"
Airespace-Wlan-Id additional.fields
allowEasyWiredSession sec_result.detection_fields, additional.fields
AMInstalled security_result.detection_fields
assetDeviceType principal.resource.name
assetIncidentScore security_result.detection_fields
Audit_session_id sec_result.detection_fields
AuditSessionId sec_result.detection_fields
Authen-Reply-Status security_result.detection_fields
AuthenticationIdentityStore sec_result.detection_fields, additional.fields
AuthenticationMethod security_result.detection_fields
AuthenticationResult security_result.action
AuthenticationStatus security_result.action, security_result.action_details
Author-Reply-Status additional.fields
AuthorizationFailureReason security_result.detection_fields
AuthorizationPolicyMatchedRule security_result.rule_name
av-pair-severity security_result.detection_fields
BYODRegistration sec_result.detection_fields
CacheUpdateTime security_result.detection_fields
Called-Station-ID security_result.detection_fields, target.ip, target.mac
Calling-Station-ID security_result.detection_fields, principal.ip, principal.mac
cdpCacheAddressType security_result.detection_fields
cdpCacheVersion security_result.detection_fields
cdpUndefined28 security_result.detection_fields
change-set additional.fields
Chargeable-User-Identity principal.user.attribute.labels
cisco-av-pair additional.fields, security_result.detection_fields
CiscoIOS security_result.detection_fields
Clase sec_result.detection_fields
client_type additional.fields
client-iif-id security_result.detection_fields
ClientLatency security_result.detection_fields, additional.fields
CmdSet target.process.command_line
coa-push security_result.detection_fields
CoAClientInstanceDestinationIPAddress target.ip, target.asset.ip
coaReason security_result.detection_fields
coaSourceComponent security_result.detection_fields
coaType security_result.detection_fields
Componente security_result.detection_fields
ConfigChangeData security_result.detection_fields
ConfigVersionId sec_result.detection_fields, additional.fields
connect-progress security_result.detection_fields
ConnectionStatus sec_result.detection_fields
ConnectionStatus=Failed security_result.action ="BLOCK"
Constructeurs principal.asset.hardware.manufacturer
counters_kvp event.idm.read_only_udm.target.asset.attribute.labels
CPMSessionID security_result.detection_fields, additional.fields, network.session_id
CreateTime event.idm.read_only_udm.principal.asset.attribute.creation_time
cts_security_group_tag security_result.detection_fields
cts-pac-opaque security_result.detection_fields
fecha y hora metadata.event_timestamp
days_to_expiry security_result.detection_fields
DeltaRadiusRequestCount security_result.detection_fields
DeltaTacacsRequestCount security_result.detection_fields
Descripción security_result.detection_fields
DestinationIPAddress target.ip, target.asset.ip
DestinationIPAddress target.ip, target.asset.ip
DestinationPort target.port
DetailedInfo sec_result.description
Device_IP_Address principal.ip, principal.asset.ip
device-mac principal.mac
device-platform principal.platform
device-platform-version principal.platform_version
device-public-mac principal.mac
device-type principal.asset.hardware.model
device-uid principal.resource.product_object_id
device-uid-global principal.asset.product_object_id
DeviceIPAddress principal.ip, target.ip, intermediary.ip
DevicePort principal.port, target.port, intermediary.port
DeviceRegistrationStatus sec_result.detection_fields
dhcp-class-identifier security_result.detection_fields
dhcp-parameter-request-list additional.fields
Domaines additional.fields
DoReplicate security_result.detection_fields
DTLSSupport security_result.detection_fields
EAP-Key-Name additional.fields
EapTunnel additional.fields
EmailAddress principal.user.email_addresses
EnableFlag additional.fields
EnableSingleConnect security_result.detection_fields
End-of-LLDPDU security_result.detection_fields
endpoint_id principal.mac, principal.asset.mac
EndpointCertainityMetric sec_result.detection_fields
EndpointIdentityGroup principal.group.group_display_name
EndpointIPAddress principal.asset.ip
EndPointMACAddress principal.mac, principal.asset.mac
EndPointMatchedProfile security_result.about.labels, additional.fields
EndpointNADAddress sec_result.detection_fields
EndpointOUI sec_result.detection_fields
EndpointPolicy principal.asset.platform_software.platform_version, security_result.detection_fields
EndPointPolicyID security_result.detection_fields
EndPointProfilerServer target.hostname
EndpointProperty sec_result.detection_fields
EndPointSource target.resource.attribute.labels
EndpointSourceEvent sec_result.detection_fields
EndpointUserAgent network.http.user_agent
EndPointVersion security_result.detection_fields
epid security_result.detection_fields
Mensaje de error additional.fields
evento additional.fields
extended_key_usage_oid additional.fields
external_groups additional.fields
FailureFlag security_result.detection_fields
FailureReason sec_result.detection_fields, additional.fields
FeedService security_result.detection_fields
FirstCollection event.idm.read_only_udm.principal.asset.first_discover_time
foreign_ip intermediary.ip
FQSubjectName security_result.detection_fields
Framed-MTU additional.fields
Framed-Protocol sec_result.detection_fields
FramedIPAddress security_result.detection_fields
group_name principal.group.group_display_name
Header-Flags security_result.detection_fields
HostIdentityGroup additional.fields
IdentityAccessRestricted security_result.detection_fields
IdentityGroup principal.group.group_display_name
IdentityGroupID principal.group.product_object_id
IdentityPolicyMatchedRule sec_result.about.labels, additional.fields
IdentitySelectionMatchedRule sec_result.detection_fields
Idle-Timeout security_result.detection_fields
idletime security_result.detection_fields
IMEI target.asset.product_object_id
inacl_rule security_result.detection_fields
intermediary_hostname intermediary.hostname
ionTimeStamp security_result.detection_fields
ios-version principal.asset.software.version
ip_inacl_rule security_result.detection_fields
ip_source_ip principal.ip, principal.asset.ip
IpAddress principal.ip, principal.asset.ip
IPSEC additional.fields
ise_port principal.port, intermediary.port
ISELocalAddress intermediary.ip, principal.ip
ISEModuleName sec_result.detection_fields
ISEPolicySetName target.resource.name
ISEServiceName sec_result.detection_fields
IsMachineAuthentication security_result.detection_fields
IsMachineIdentity security_result.detection_fields
IsRegistered security_result.detection_fields
Emisor about.labels
IsThirdPartyDeviceFlow sec_result.detection_fields, additional.fields
key_usage additional.fields
LastActivity event.idm.read_only_udm.principal.asset.last_discover_time
LastNmapScanTime sec_result.detection_fields
LicenseType additional.fields
lldpManAddress security_result.detection_fields
lldpPortDescription security_result.detection_fields
lldpPortId security_result.detection_fields
lldpSystemCapabilitiesMap security_result.detection_fields
lldpSystemDescription security_result.detection_fields
lldpTimeToLive security_result.detection_fields
lldpUndefined127 security_result.detection_fields
localport principal.port
Ubicación principal.location.country_or_region, target.location.country_or_region, security_result.detection_fields
log-id metadata.product_log_id
logstash.ingest.host intermediary.hostname
logstash.ingest.timestamp metadata.ingested_timestamp
logstash.irm_environment additional.fields
logstash.irm_region additional.fields
logstash.irm_site additional.fields
logstash.process.host intermediary.hostname
logstash.process.timestamp metadata.collected_timestamp
MAC principal.mac
mac_UserName principal.mac
MacAddress principal.mac
MajorVersion security_result.detection_fields
Fabricante target.asset.hardware.manufacturer
MatchedPolicy security_result.detection_fields
MatchedPolicyID security_result.rule_id
MDMFailureReason sec_result.detection_fields
MDMServerName metadata.product_name
mDNS security_result.detection_fields
MENSAJE security_result.description
MFCInfoEndpointType principal.asset.asset_type, principal.asset.attribute.labels
MinorVersion security_result.detection_fields
MisconfiguredClientFixReason security_result.detection_fields
Modelo target.asset.hardware.model
Model_Name principal.asset.attribute.labels
msg_class metadata.description
msg_sev security_result.severity, sec_result.severity_details
msg_text metadata.description, security_result.severity, sec_result.severity_details,security_result.action
msg_text security_result.action
Dirección de NAD principal.ip
NADAddress intermediary.ip
Nombre principal.group.group_identifiers
nas_ip_address principal.nat_ip
NAS-Identifier principal.labels
NAS-IP-Address principal.nat_ip, principal.ip
NAS-Port principal.port, principal.labels
nas-update security_result.detection_fields
NASIdentifier security_result.detection_fields, principal.labels
NASPort principal.nat_port si es válido; de lo contrario, a security_result.detection_fields, principal.labels
NASPortId security_result.detection_fields, principal.labels
NASPortType security_result.detection_fields, principal.labels
Nombre del dispositivo de red target.hostname, target.asset.hostname
network_adapter target.resource.name
network_application_protocol_result network.application_protocol
NetworkDeviceGroups sec_result.detection_fields
NetworkDeviceGroups_IPSEC additional.fields
NetworkDeviceProfileId principal.asset.asset_id
NetworkDeviceProfileName principal.asset.attribute.labels
NmapScanCount security_result.detection_fields
ntp_server_1 target.ip, target.asset.ip
ntp_server_2 target.ip, target.asset.ip
ntp_server_3 target.ip, target.asset.ip
ObjectInternalID security_result.detection_fields
ObjectName security_result.about.labels
ObjectType security_result.labout.abels, additional.fields
operating-system-result target.asset.platform_software.platform_version target.platform = WINDOWS
OperatingSystem target.asset.platform_software.platform_version
OperationMessageText sec_result.detection_fields
OperationMessageText about.labels
OUI security_result.detection_fields
almohadilla security_result.detection_fields
PeerAddress target.mac, target.asset.mac
PeerName target.hostname, target.asset.hostname
PhoneNumber principal.user.phone_numbers
platform-version principal.platform_version
PolicyVersion security_result.detection_fields
Puerto principal.port, target.port
Portal_Name additional.fields
PortalName target.url
PortalUser principal.user.userid
PortalUser_GuestSponsor principal.user.attribute.labels
PortalUser_GuestType principal.user.attribute.labels
PostureApplicable security_result.detection_fields
PostureAssessmentStatus sec_result.detection_fields, additional.fields
PostureExpiry sec_result.detection_fields
PostureStatus sec_result.detection_fields
principal_hostname principal.hostname
principal_ip principal.ip, principal.asset.ip
profile-name security_result.detection_fields
ProfilerServer sec_result.detection_fields
Protocolo security_result.detection_fields
r_ip_or_host observer.ip, observer.hostname, intermediary.hostname, intermediary.ip
r_seg_num metadata.product_log_id
RadiusFlowType security_result.about.labels, additional.fields
RadiusPacketType security_result.detection_fields
received_b network.received_bytes
RegisterStatus security_result.rule_name
RegistrationTimeStamp sec_result.detection_fields
RemoteAddress principal.ip, principal.asset.ip
RequestLatency sec_result.detection_fields, additional.fields
RequestResponseTypes security_result.detection_fields
ResponseTime sec_result.detection_fields
SelectedAccessService sec_result.detection_fields, additional.fields
SelectedAuthenticationIdentityStores security_result.detection_fields
SelectedAuthorizationProfiles sec_result.detection_fields, additional.fields
SelectedShellProfile additional.fields
sent_b network.sent_bytes
sequence_num metadata.product_log_id
Sequence-Number security_result.detection_fields
serial_number about.labels, network.tls.server.certificate.serial
server_label principal.asset.attribute.labels
Service-Type sec_result.detection_fields, additional.fields
session-id network.session_id
Session-Timeout network.session_duration
shell_role principal.user.attribute.roles.name
ShutdownReason security_result.detection_fields
SkipProfiling security_result.detection_fields
software_version principal.asset.platform_software.platform_version
Fuente principal.ip, principal.hostname
source_ip src.ip
source_port src.port
SSID additional.fields
start_time security_result.first_discovered_time
StaticAssignment security_result.detection_fields
StaticGroupAssignment sec_result.detection_fields
Paso additional.fields
StepData about.hostname, additional.fields
StepLatency additional.fields
stop_time security_result.last_discovered_time
Asunto about.labels
subject_alt_name about.labels
subscriber_command security_result.detection_fields
syslog_host principal.ip, principal.asset.ip
SysStatsCpuCount target.asset.hardware.cpu_number_cores
SysStatsProcessMemoryMB target.asset.hardware.ram
SysStatsUtilizationDiskIO target.asset.attribute.labels
SysStatsUtilizationDiskSpace target.asset.attribute.labels
SysStatsUtilizationLoadAvg target.asset.attribute.labels
SystemDomain principal.asset.network_domain
SystemName principal.hostname, principal.hostname
SystemUser principal.user.userid
SystemUserDomain principal.administrative_domain
target_email target.user.email_addresses
target_group_identifiers target.user.group_identifiers
target_hostname target.hostname
target_ip target.ip, target.asset.ip
target_port target.port
target_user target.user.userid
target.resource.resource_type DISPOSITIVO
task_id additional.fields
TaskId security_result.detection_fields
Template_Name additional.fields
Termination-Action security_result.detection_fields
threshold_value additional.fields
TimeToProfile sec_result.detection_fields
TLSCipher network.tls.cipher
TLSVersion network.tls.version
total_certainty_factor sec_result.detection_fields
TotalAuthenLatency security_result.detection_fields, additional.fields
TotalFailedTime sec_result.detection_fields
Tunnel-Client-Endpoint sec_result.detection_fields
Tipo additional.fields
undefined-151 additional.fields
UniqueConnectionIdentifier sec_result.detection_fields
UpdateTime sec_result.detection_fields
url-redirect target.url
url-redirect-acl security_result.detection_fields
UseCase sec_result.detection_fields
used_space_value additional.fields
Usuario principal.user.userid
usuario principal.user.userid
user_display_name principal.user.user_display_name
User-AD-Last-Fetch-Time principal.user.attribute.labels
User-Agent network.http.user_agent, network.http.parsed_user_agent
User-Fetch-Email sec_result.detection_fields
User-Fetch-Last-Name principal.user.last_name
User-Fetch-LocalityName sec_result.detection_fields
User-Fetch-StateOrProvinceName sec_result.detection_fields
User-Name target.user.userid
UserAccountControl principal.user.attribute.labels
UserAgreementStatus security_result.detection_fields
UserName target.user.userid
UserType principal.user.attribute.labels
UseSingleConnect security_result.detection_fields
vlan-id security_result.detection_fields
principal.resource.resource_type Se asigna de forma estática a DEVICE.

¿Necesitas más ayuda? Obtén respuestas de miembros de la comunidad y profesionales de Google SecOps.