Help me with the search command for usescases

[yashwanth_g_pra]

Hi All,

I would like to find a way out for the below Cisco ISE use-case scenarios . It would be great if you can help me with the search queries,

• New devices connecting to the wired network
• Legacy known devices (e.g. printers) connecting from a different network port
• Known devices connecting from two different network ports at the same time
• Monitor logins by device type to understand unusual or rare device type authentications
• Baseline successful and unsuccessful logins to identify anomalies

These use-cases are for Cisco ISE Devices.
Thanks in advance.

[DalJeanis]

The first thing you are going to have to do is start developing a list of known devices and what IP and port they connect from.

This might be as simple as creating a query that looks at all connection events and periodically running the query to populate a summary index with the device, the IP and the port. That data will provide your baseline for the last two questions, and provide the specific answers and comparisons for the prior ones.

Then, you take that summary data and use it to test your various use cases.

For all the devices connected during the most recent period, had they been connected in the prior week/month? If not, then flag that maybe they are new.

For all the devices connected during the most recent period, had they been connected to that same port in the prior week? If not, then flag that maybe this is a new port.

For all the devices connected during the most recent period, were they connected on two different ports? Is so, then flag that maybe they were connected at the same time.

[yashwanth_g_pra]

Can you help me with the search queries ?

[niketn]

@yashwanth.g.prakash, you might have to provide sample data for scenarios mentioned above. Have you checked out the Splunk App for Cisco ISE: https://splunkbase.splunk.com/app/1589/