Hi, I am struggling with the configuration pxGrid on Splunk for Rapid Threat Containment with ISE. I just installed a new instance of Splunk Enterprise 8.2.6 with Cisco ISE add-on module 4.1.0. Per documentation, I should see a Setup action for the ISE add-on. But I don’t. Any ideas on what I missed? I installed Splunk on both Ubuntu and RedHat Linux, went through everything related to certificates and got stuck when certificates need to be moved to the correct directory. I have /opt/splunk/etc/apps/Splunk_TA_cisco-ise/ but no /opt/splunk/etc/apps/Splunk_TA_cisco-ise/bin/certs/. I am missing the bin and certs directory. Do you know what could be causing this?
Maybe we have a step-by-step guide on how to do this integration for current versions of Splunk? It must be some minor bug I'm making. I'm testing it on the trial version of Splunk, but if I understand correctly the trial version has only a time limit, not a functional limit.
I would be grateful for any advice
... View more