Cisco ISE Authentication Policy Changed Outside Change Window

Siddhant Mishra@Siddhant

•updated yesterday•0•0•0

Detects modification of ISE configuration governing who may join the network and under what conditions. A policy change is the most efficient way to grant durable unauthorised access: rather than defeating the control repeatedly, the attacker rewrites it once. Onboarding: CISCO-ISE is ingested via Syslog (KV) (Bloo extractor 196). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=configuration where sourcename='CISCO-ISE' and action='CONFIGURATION_CHANGED' | groupby user, config, srcip, policy