Enrich DHCP Logs, With ISE Cisco Logs. To see Switchports

Question

Hi there.So we Have a Alert rule, that alerts us when a Unknown and New Device, leases a DHCP Adress, to prevent unwanted Physical Access.Now We wanted to Enrich said DHCP log, by adding Information of our ISE/Switch Logs, so that when we get the Incident from the Alert rule, we also see what Switch and Switchport, this Unknown device is Hanging at.We are Pretty sure that should be Possible, but I haven’t figured out how yet.Cheers Mike Furrer

Prabesh.B · Accepted Answer

Hi Mike,You can create a Dyaminc table extracting the needed information fromISE/Switch Logs. Once you have the table you can use that table to enrich theDHCP log just like we can enrich with a CSV file. Youmight need to hit and trail to see if this works or not.Useful Links:https://docs.logpoint.com/docs/data-integration-guide/en/latest/Configuration/List%20and%20Tables.htmlhttps://docs.logpoint.com/docs/data-integration-guide/en/latest/Configuration/Enrichment%20Sources.html#adding-iptohost-as-an-enrichment-source

Anonymous · Answer

@Prabesh Bhattamaybe you can assist? :)

Reply

Sign up

Already a Partner or Customer? Login with your LogPoint Support credentials. Don‘t have a LogPoint Support account? Ask your local LogPoint Representative. Only visiting? Login with LinkedIn to gain read–access.

Login to the community

Already a Partner or Customer? Login with your LogPoint Support credentials. Don‘t have a LogPoint Support account? Ask your local LogPoint Representative. Only visiting? Login with LinkedIn to gain read–access.

Scanning file for viruses.

This file cannot be downloaded