Up
Previous Next

Sheriff CSM™

Cisco ACS

When you configure Cisco ACS to send log data to Sheriff CSM, you can use the Cisco ACS plugin to translate raw log data into normalized events for analysis. The table below provides some basic information for the plugin:

Plugin Information

Device	Details
Vendor	Cisco
Device Type	Access Control Server
Connection Type	syslog
Data Source Name	cisco-acs
Data Source ID	1594

Integrating Cisco ACS

Before you configure the Cisco ACS integration, you must have the IP Address of the Sheriff CSM Sensor (Deputy).

To configure Cisco ACS to send log data to Sheriff CSM

1. Go to System Administration > Configuration > Log Configuration > Remote Log Targets.

2. On the Remote Log Targets page, click Create.

3. Fill out the required fields

   1. Assign a name to the external syslog server, which in this case refers to Sheriff CSM.
   2. Enter the IP address of the Sheriff CSM Sensor.
   3. Select the target type, TCP Syslog or UDP Syslog.
   4. Enter the port number, 514 for TCP or UDP.
   5. Enter the maximum length for the log messages. The default value is 1024.
   6. Click Submit.

      

4. Verify that the remote log target you created appears in the list.

5. Go to System Administration > Configuration > Log Configuration > Logging Categories > Global.

6. Select the logging category you want to use to send logs to Sheriff CSM, and then click Edit.

7. Select the Remote Syslog Target tab.

8. Move the remote log target created in step 3, "loglogic" in the example below, to Selected Targets

   

9. Click Submit.

Plugin Enablement

For plugin enablement information, see Enable Plugins.

Troubleshooting

For troubleshooting, see the vendor documentation.

https://www.cisco.com/c/en/us/td/docs/net_mgmt/cisco_secure_access_control_system/5-8/user/guide/acsuserguide/admin_config.html#66559