Cisco ISE Role Escalation From Guest to Corporate Access

Siddhant Mishra@Siddhant

•updated yesterday•0•0•0

Detects an endpoint or identity moving from a guest role to a corporate one. Guest networks are deliberately segregated; a transition to corporate access means either a legitimate onboarding or an attacker who entered through the least-controlled door and found a way inward. Onboarding: CISCO-ISE is ingested via Syslog (KV) (Bloo extractor 196). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=iam where sourcename='CISCO-ISE' and action='PASSWORD_CHANGED' | groupby user, targetuser, role, srcip