- Superuser access to the Custom Integrations configuration in runZero.
- API user with access to the Cisco ISE Monitoring Node API.
- Base URL of your Cisco ISE instance (e.g.,
https://ise.company.com). - Base64-encoded API credentials (
username:password).
-
Verify API access:
- Log in to your Cisco ISE Monitoring Node.
- Navigate to Administration > System > Admin Access > Admin Groups and ensure API users are granted access to the
Session/ActiveListAPI. - Test access to:
https://<ISE-HOST>/admin/API/mnt/Session/ActiveList
using Basic Auth in a REST client (e.g., Postman).
-
Base64 encode credentials:
- Encode
username:passwordusing Base64. You can use a terminal:echo -n 'username:password' | base64
- Encode
-
Modify the script if needed:
- Update the
CISCO_ISE_HOSTconstant to point to your ISE Monitoring Node URL. - You may adjust parsing logic to capture additional session fields from the XML.
- Update the
-
Create a Credential for the Custom Integration:
- Go to runZero Credentials.
- Select
Custom Integration Script Secrets. - Input the Base64-encoded string in the
access_secretfield. - Use a placeholder like
fooforaccess_key(unused).
-
Create the Custom Integration:
- Go to runZero Custom Integrations.
- Add a name (e.g.,
cisco-ise) and icon for the integration. - Toggle Enable custom integration script and paste in the script.
- Click
Validate, thenSave.
-
Schedule the Integration Task:
- Go to runZero Ingest.
- Select the credential and custom integration you created.
- Set a schedule for recurring updates.
- Choose the Explorer instance to run the integration.
- Click
Save.
- The integration will retrieve active sessions from Cisco ISE.
- Device IP and MAC addresses will be mapped to runZero assets.
- You can find enriched assets using the runZero search query: custom_integration:cisco_ise
- The integration extracts fields like
device_ip_address,calling_station_id(MAC), anduser_name(hostname). - If
device_ip_addressis missing, it falls back toframed_ip_address. - All ISE session IDs and NAS information are stored as
customAttributes. - You can customize the
build_assets()function to include more session fields if needed.