Integrate Cisco ISE

You can integrate Cisco ISE with Sophos Central so that it sends alerts to Sophos.

This integration uses a log collector hosted on a virtual machine (VM). Together they're called an integration appliance. The appliance receives third-party data and sends it to the Sophos Data Lake.

Key steps

The key steps in an integration are as follows:

• Add an integration for this product. In this step, you create an image of the appliance.
• Download and deploy the image on your VM. This becomes your appliance.
• Configure Cisco ISE to send data to the appliance.

Requirements

Appliances have system and network access requirements. To check that you meet them, see Appliance requirements.

Add an integration

To add the integration, do as follows:

1. In Sophos Central, go to Threat Analysis Center > Integrations > Marketplace.

2. Click Cisco ISE.

   The Cisco ISE page opens. You can add integrations here and see a list of any you've already added.

3. In Data Ingest (Security Alerts), click Add Configuration.

   Note

   If this is the first integration you've added, we'll ask for details about your internal domains and IPs. See Provide your domain and IP details.

   Integration setup steps appears.

Configure the appliance

In Integration setup steps, you can configure a new appliance or use an existing one.

We assume here that you configure a new appliance. To do this, create an image as follows:

1. Enter an integration name and description.
2. Click Create new appliance.
3. Enter a name and description for the appliance.
4. Select the virtual platform. Currently we support VMware ESXi 6.7 Update 3 or later and Microsoft Hyper-V 6.0.6001.18016 (Windows Server 2016) or later.

5. Specify the IP settings for the Internet-facing network ports. This sets up the management interface for the appliance.

   • Select DHCP to assign the IP address automatically.

     Note

     If you select DHCP, you must reserve the IP address.

   • Select Manual to specify network settings.

6. Select the Syslog IP version and enter the Syslog IP address.

   You'll need this syslog IP address later, when you configure Cisco ISE to send data to your appliance.

7. Select a Protocol.

   You must use the same protocol when you configure Firepower to send data to your appliance.

8. Click Save.

   We create the integration and it appears in your list.

   In the integration details, you can see the port number for the appliance. You'll need this later when you configure Firepower to send data to it.

   It might take a few minutes for the appliance image to be ready.

Deploy the appliance

Use the image to deploy the appliance as follows:

1. In the list of integrations, in Actions, click the download action for your platform, for example Download OVA for ESXi.
2. When the image download finishes, deploy it on your VM. See Deploy appliances.

Configure Cisco ISE

You must configure Cisco ISE to send data to Sophos using syslog.

To forward syslog events, configure your Cisco ISE appliance with a remote logging target, as follows:

1. Log in to your Cisco ISE Administration Interface.
2. Go to Administration > System > Logging and select Remote Logging Targets.

3. Click Add, then do as follows:

   1. Enter a name and description for the remote target system.
   2. Enter the IP Address and Port that you specified in Sophos Central earlier.
   3. From the Facility Code list, select the syslog facility to use for logging events.
   4. In Maximum Length, you must enter 8192. This sets the maximum packet length for a syslog message.
   5. Clear the Include Alarms For this Target checkbox.

   

4. Click Submit.

5. Go to Logging Categories.

   For each category, make sure the Targets column contains your previously configured Sophos logging target.

   

Cisco ISE log data is now sent to the Sophos Data Lake.