stealthwatch CTA to ISE integration

[marklevi]

There is a simple guide to integrate ISE with CTA when using WSA, but it is dependent on logging into a CTA cloud account. This account does not seem to be present when using CTA with SW.

How do I set CTA endpoint flags in ISE when using SW?

[brford · Accepted solution]

Hello Mark,

With the Stealthwatch 6.9.2 release once you have properly configured the Cognitive feature at the SMC and Flow Collector you will see the 'Cognitive Dashboard' and SMC widget and can reach the Cognitive portal.  The authentication happens based on your login to the SMC.

When using Cognitive as a Stealthwatch feature there is no further ISE configuration required.  Identity data is collected and passed to Cognitive via Stealthwatch.

Hope this helps.

Brian

[marklevi]

So we will be able to use our SMC credentials to log into the CTA scansafe portal to create a CTA account for ISE to use?

I understand how the ISE data gets into SW, but how does the CTA data get into ISE for Adaptive network controls?

[marklevi]

So with SW integration, no user has an account in CTA, the SMC has an account.

Your SMC admins login to the CTA portal as the SMC with a SSO from the SMC dashboard.