Cisco ISE

Realm Security integrates with Cisco Identity Services Engine (ISE) for monitoring of authentication, authorization, and administrative audit data.

Prerequisites

• Ensure you have access to your Cisco ISE Admin GUI, with permissions to configure Administration > System > Logging.
• Realm Collector is set up and running. See Realm Collector install guide for setting up a collector.

Important: Realm requires ISE's TCP Syslog target type for this integration — do not use UDP Syslog. TCP guarantees delivery and ordering, which the CISCO ISE source format in Realm depends on for reliable parsing. Logs sent via UDP Syslog are not supported and may be dropped or arrive out of order.

Setup Cisco ISE Source in Realm

1. Login to Realm console.
2. Go to Sources > Add and add a new Source.

   Name: Cisco ISE
   Description: Cisco ISE logs
   Format: Cisco ISE

3. If a collector is already set up, go to Collectors and select your collector. If not, go to Collectors > Add and give it a name and description.
4. Add a Cisco ISE stream to the Collector. Click Add Stream.

   Product Format: Cisco ISE
   Port: Select a unique port for this collector or use the Realm generated port. Source: Cisco ISE

5. Click Add Stream.
6. Take note of the port assigned to the Cisco ISE stream. You will need it when configuring the Remote Logging Target in ISE.

Setup Cisco ISE Remote Logging Target

For full background, see Cisco's Configure External Syslog Server on ISE guide. The steps below configure the target the way Realm requires — TCP Syslog, not the UDP option shown as the default example in Cisco's guide.

Configure the Remote Logging Target

1. In the Cisco ISE GUI, click the Menu icon and go to Administration > System > Logging > Remote Logging Targets, then click Add.
2. Configure the target:
   • Name: e.g. Realm_Security_Collector — used for descriptive purposes only.
   • Target Type: TCP Syslog. Do not select UDP Syslog — Realm's Cisco ISE source format requires the reliability and ordering guarantees TCP provides.
   • Status: Enabled.
   • Description: optional.
   • Host / IP Address: the IP address or FQDN of your Realm Security Collector.
   • Port: the port number you noted when creating the Cisco ISE stream in Realm (not ISE's default UDP port 514 — that default applies only to the UDP option, which you are not using).
   • Facility Code: choose any Local facility (e.g. LOCAL6); this does not need to match anything on the Realm side.
   • Maximum Message Length: 8192 — the maximum ISE allows. Set this to avoid truncated messages; the ISE default (1024) is more likely to cut off longer log entries.
   • Comply to RFC 3164: leave this checked. This is the default and expected setting — it prevents ISE from escaping delimiter characters, and Realm's parser expects this default behavior.
3. Click Save. ISE will display a warning about creating an unsecure (TCP/UDP) connection; click Yes to proceed. (If your environment requires TLS-encrypted delivery, use the Secure Syslog target type instead and let Realm Security support know — this requires additional certificate configuration not covered here.)

Map the Target to Logging Categories

Creating the Remote Logging Target does not, by itself, send anything — you also need to map it to the categories of events you want forwarded.

1. Go to Administration > System > Logging > Logging Categories.
2. Open each relevant category and add your new target (e.g. Realm_Security_Collector) to the Selected list.
3. Repeat for any additional categories relevant to your monitoring needs — see Cisco's guide for the full category list (AAA Diagnostics, Profiler, Posture and Client Provisioning, System Diagnostics, etc.).
4. Verify each category now lists your target under Selected.

Note: Logging categories generated only from PSN nodes (e.g. AAA Audit, Accounting, Profiler) will only forward events from nodes running the relevant service. Categories generated from all nodes (e.g. Administrative and Operational Audit, System Diagnostics, System Statistics) forward from every node in the deployment.

Verifying Delivery

Cisco's guide recommends taking a TCP dump directly on the Policy Service Node (PSN) handling authentications, filtered to your Realm Collector's IP address, to confirm ISE is actually sending syslog traffic:

1. In the Cisco ISE GUI, go to Operations > Troubleshoot > TCP Dump, then click Add.
2. Filter on ip host <Realm_Collector_IP_address>.
3. Run the capture from the PSN that handles the authentications you're testing.

You can also confirm ingestion from the Realm side by checking the Cisco ISE stream's activity in the Realm console once test events have been generated.

Support

For additional details, refer to Cisco's Configure External Syslog Server on ISE documentation.

If you encounter any issues or require assistance, contact Realm Security support.