Cisco ISE Single Endpoint Authenticating as Multiple Identities

Siddhant Mishra@Siddhant

•updated yesterday•0•0•0

Detects one endpoint authenticating under several distinct user identities in a short period. A workstation normally carries one user at a time. Several identities from one endpoint suggests credential testing, a shared or kiosk device being misused, or an attacker working through harvested accounts from a single foothold. Onboarding: CISCO-ISE is ingested via Syslog (KV) (Bloo extractor 196). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=authentication where sourcename='CISCO-ISE' and action='LOGIN' | duration 1h | groupby srcip | select srcip, distinct_count(user) | having distinct_count_col1 > 4