Question

Enrich DHCP Logs, With ISE Cisco Logs. To see Switchports

  • 26 September 2022
  • 2 replies
  • 59 views

Hi there.
So we Have a Alert rule, that alerts us when a Unknown and New Device, leases a DHCP Adress, to prevent unwanted Physical Access.
Now We wanted to Enrich said DHCP log, by adding Information of our ISE/Switch Logs, so that when we get the Incident from the Alert rule, we also see what Switch and Switchport, this Unknown device is Hanging at.
We are Pretty sure that should be Possible, but I haven’t figured out how yet.

Cheers Mike Furrer


2 replies

Userlevel 5
Badge +4

@Prabesh Bhatta maybe you can assist? :)

Hi Mike, 

You can create a Dyaminc table extracting the needed information from ISE/Switch Logs. Once you have the table you can use that table to enrich the DHCP log just like we can enrich with a CSV file. You might need to hit and trail to see if this works or not. 

Useful Links:

https://docs.logpoint.com/docs/data-integration-guide/en/latest/Configuration/List%20and%20Tables.html

https://docs.logpoint.com/docs/data-integration-guide/en/latest/Configuration/Enrichment%20Sources.html#adding-iptohost-as-an-enrichment-source

Reply