Skip to content
Find out how we support MDR.

Integrate Cisco ISE

You must have the Identity integrations license pack to use this feature.

You can integrate Cisco ISE with Sophos Central so that it sends alerts to Sophos.

This integration uses a log collector hosted on a virtual machine (VM). Together they're called an appliance. The appliance receives third-party data and sends it to the Sophos Data Lake.


You can add multiple instances of Cisco ISE to the same appliance.

To do this, set up your Cisco ISE integration in Sophos Central, then configure one Cisco ISE instance to send logs to it. Then configure your other Cisco ISE instances to send logs to the same Sophos appliance.

You don't have to repeat the Sophos Central part of the setup.

The key steps are as follows:

  • Configure an integration for this product. This configures an image to use on a VM.
  • Download and deploy the image on your VM. This becomes your appliance.
  • Configure Cisco ISE to send data to the appliance.


Appliances have system and network access requirements. To check that you meet them, see Appliance requirements.

Configure an integration

To configure the integration, do as follows:

  1. In Sophos Central, go to Threat Analysis Center > Integrations > Marketplace.
  2. Click Cisco ISE.

    The Cisco ISE page opens. You can configure integrations here and see a list of any you've already configured.

  3. In Data Ingest (Security Alerts), click Add Configuration.


    If this is the first integration you've added, we'll ask for details about your internal domains and IPs. See My domains and IPs.

    Integration setup steps appears.

Configure the VM

In Integration setup steps you configure your VM as an appliance to receive data from Cisco ISE. You can use an existing VM, or create a new one.

To configure the VM, do as follows:

  1. Enter an integration name and description.
  2. Enter a name and description for the appliance.

    If you've already set up a Sophos appliance, you can choose it from a list.

  3. Select the virtual platform. Currently we support VMware ESXi 6.7 Update 3 or later and Microsoft Hyper-V 6.0.6001.18016 (Windows Server 2016) or later.

  4. Specify the IP settings for the Internet-facing network ports. This sets up the management interface for the VM.

    • Select DHCP to assign the IP address automatically.


      If you select DHCP, you must reserve the IP address.

    • Select Manual to specify network settings.

  5. Select the Syslog IP version and enter the Syslog IP address.

    You'll need this syslog IP address later, when you configure Cisco ISE to send data to your appliance.

  6. Select a Protocol.

    You must use the same protocol when you configure Firepower to send data to your appliance.

  7. Click Save.

    We create the integration and it appears in your list.

    In the integration details, you can see the port number for the appliance. You'll need this later when you configure Firepower to send data to it.

    It might take a few minutes for the VM image to be ready.

Deploy the VM


If you're using ESXi, the OVA file is verified with Sophos Central, so it can only be used once. If you have to deploy another VM, you must create an OVA file again in Sophos Central.

Use the VM image to deploy the VM. To do this, do as follows:

  1. In the list of integrations, in Actions, click the download action for your platform, for example Download OVA for ESXi.
  2. When the image download finishes, deploy it on your VM. See Deploy a VM for integrations.

Configure Cisco ISE

You must configure Cisco ISE to send data to Sophos using syslog.

To forward syslog events, configure your Cisco ISE appliance with a remote logging target, as follows:

  1. Log in to your Cisco ISE Administration Interface.
  2. Go to Administration > System > Logging and select Remote Logging Targets.
  3. Click Add, then do as follows:

    1. Enter a name and description for the remote target system.
    2. Enter the IP Address and Port that you specified in Sophos Central earlier.
    3. From the Facility Code list, select the syslog facility to use for logging events.
    4. In Maximum Length, you must enter 8192. This sets the maximum packet length for a syslog message.
    5. Clear the Include Alarms For this Target checkbox.

    Remote Logging Targets List.

  4. Click Submit.

  5. Go to Logging Categories.

    For each category, make sure the Targets column contains your previously configured Sophos logging target.

    Logging categories page.

Cisco ISE log data is now sent to the Sophos Data Lake.