Important note: This app is only contains dashboards and reports. No data is collected by this app. For Cisco ISE data collection, install and configure the separate Splunk Add-on for Cisco ISE
Cisco Identity Services Engine (ISE) is a security policy management and control platform. It automates and simplifies access control and security compliance for wired, wireless, and VPN connectivity.
The Splunk App for Cisco ISE includes sample dashboards and reports for profiling, authentication, system statistics, alarms, and location awareness. A separate Splunk Add-on for Cisco ISE needs to be installed to collect data from Cisco ISE systems.
This version of the Splunk App for Cisco ISE only contains dashboards and reports. No data collection is performed. In order to collect data from a Cisco ISE system, install the separate Splunk Add-on for Cisco ISE.
This is a community-supported app.
Access questions and answers at answers.splunk.com/app/questions/1589.html
For general Splunk Enterprise support, see the Splunk Support Programs page:
If you have specific questions about the separate Splunk Add-on for Cisco ISE, log a case using the Splunk Support Portal at www.splunk.com/index.php/submit_issue
Install and configure the Splunk Add-on for Cisco ISE.
Because this add-on runs on Splunk Enterprise, all of the Splunk Enterprise system requirements apply.
Note: ensure the “Upgrade app” checkbox is checked.
Updates for App Inspect
This version of the Splunk App for Cisco ISE only contains dashboards and reports. No data collection is performed. In order to collect data from a Cisco ISE system, install the separate Splunk Add-on for Cisco ISE https://apps.splunk.com/app/1915/.
See the documentation tab here or the readme.md file within the package for more information.
Added "No Location" for data that does not have location field.
Extractions added for Cisco ACS
- Registered & NonRegistered Devices may not show up in ISE Profiler Dashboard Panels
- AV Posture Details may no appear up under Posture- Installed AV Chart
- No Details for “NonCompliant” Posture Status
- Unknown device details not displayed
- Authentication Details for Wireless may not display results
- Failed Guest Attempt Dashboard
Added drill downs, updated eventgen, fixed CIM tags.
Split the app into TA (parses the syslog messages with no visualizations) and SA (separate visualizations). Over 20 dashboards have been added.
Splunk AppInspect evaluates Splunk apps against a set of Splunk-defined criteria to assess the validity and security of an app package and components.
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 50GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps and add-ons from Splunk, our partners and our community. Find an app or add-on for most any data source and user need, or simply create your own with help from our developer portal.