Splunk + Cisco ISE: Syslog Integration and RADIUS Dashboard

Cisco ISE is generating a continuous stream of authentication, authorization, and posture data — every 802.1X login, every guest registration, every failed auth attempt. Out of the box, that data lives in ISE’s internal MnT database where it’s searchable but limited. Sending it to Splunk unlocks full SIEM capabilities: long-term retention, correlation with other security data, custom dashboards, and automated alerting.

This guide covers the complete integration from ISE syslog configuration through Splunk field extractions, SPL queries, and a live RADIUS operations dashboard.

Architecture Overview

ISE MnT Node
    │
    │ Syslog (UDP 514 / TCP 6514 TLS)
    ▼
Splunk Heavy Forwarder
    │
    │ Parsed + indexed events
    ▼
Splunk Indexer
    │
    │ SPL queries
    ▼
Splunk Search Head (Dashboard)

ISE’s Monitoring and Troubleshooting (MnT) node is the log aggregator — all PSNs send their authentication events to the MnT, which then forwards to external syslog targets. Configure the syslog target on the MnT, not on individual PSNs.

Step 1 — Configure ISE Syslog Targets

1. Administration > System > Logging > Remote Logging Targets
2. Click Add
3. Configure:
   • Name: Splunk-HF (or your Splunk forwarder name)
   • Target Type: UDP Syslog or TCP Syslog
   • Host: your Splunk Heavy Forwarder IP or hostname
   • Port: 514 (UDP/TCP) or 6514 (TLS)
   • Facility Code: Local6 (or any facility not used by other systems)
   • Maximum Length: 8192 (increase from default 1024 — ISE messages can be long)
4. Save

Configure Log Categories

This step controls what ISE sends. Less is more — focus on actionable data:

1. Administration > System > Logging > Logging Categories
2. For each category below, click it and add your Splunk target:

Avoid sending Debug categories to Splunk in production. They generate 10–50x more events than INFO-level categories and will blow up your Splunk license.

Step 2 — Configure Splunk to Receive ISE Syslog

Option A — Splunk Add-on for Cisco ISE (Recommended)

Download from Splunkbase: search Cisco ISE — install the official Cisco add-on.

Install on:

• Indexer/Heavy Forwarder: for field extractions at index time
• Search Head: for dashboard panels and saved searches

The add-on automatically configures:

• sourcetype = cisco:ise recognition
• Field extractions for all standard ISE log formats
• CIM mapping for Splunk Enterprise Security compatibility

Create the Syslog Input

In Splunk Web: Settings > Data Inputs > UDP (or TCP):

• Port: 514
• Source type: cisco:ise (if using the add-on) or syslog
• Index: create a dedicated cisco_ise index for retention management

Or add to inputs.conf on the Heavy Forwarder:

1[udp://514]
2connection_host = ip
3sourcetype = cisco:ise
4index = cisco_ise

Option B — Custom props.conf Extractions

If not using the add-on, add to $SPLUNK_HOME/etc/system/local/props.conf:

 1[cisco:ise]
 2SHOULD_LINEMERGE = false
 3TIME_PREFIX = ^
 4TIME_FORMAT = %Y-%m-%d %H:%M:%S.%3N
 5MAX_TIMESTAMP_LOOKAHEAD = 30
 6KV_MODE = none
 7REPORT-ise_kv = ise_extract_kv
 8
 9[source::udp:514]
10sourcetype = cisco:ise

And transforms.conf:

1[ise_extract_kv]
2REGEX = ([A-Za-z0-9_\-]+)=([^,\n]+)
3FORMAT = $1::$2
4MV_ADD = true

Step 3 — Verify Data and Field Extractions

Run this search in Splunk after a few minutes:

index=cisco_ise sourcetype=cisco:ise
| head 20

Confirm events are flowing. Then check field extractions:

index=cisco_ise sourcetype=cisco:ise
| head 5
| table _time, user, calling_station_id, nas_ip_address, cisco_ise_category, failure_reason

Key fields to verify are extracted:

Step 4 — Key SPL Queries

Authentication Volume Over Time

index=cisco_ise sourcetype=cisco:ise cisco_ise_category=CISE_AAA_Audit
| timechart span=5m count by auth_result

Failed Authentication Rate by Reason

index=cisco_ise sourcetype=cisco:ise cisco_ise_category=CISE_Failed_Attempts
| stats count by failure_reason
| sort -count
| head 20

Top Failing Endpoints (by MAC)

index=cisco_ise sourcetype=cisco:ise cisco_ise_category=CISE_Failed_Attempts
| stats count by calling_station_id, user, failure_reason
| sort -count
| head 25

Authentication Volume by Network Device

index=cisco_ise sourcetype=cisco:ise cisco_ise_category=CISE_AAA_Audit
| stats count by nas_identifier, auth_result
| eval success_rate = round(count / sum(count) * 100, 1)
| sort -count

Policy Utilization — Which Rules Are Matching

index=cisco_ise sourcetype=cisco:ise cisco_ise_category=CISE_AAA_Audit
| stats count by auth_policy, auth_rule, authorization_profile
| sort -count

Guest Authentication Activity

index=cisco_ise sourcetype=cisco:ise cisco_ise_category=CISE_Guest_and_WebAuth
| timechart span=1h count by auth_result

Posture Compliance State Transitions

index=cisco_ise sourcetype=cisco:ise cisco_ise_category=CISE_Posture_and_Client_Provisioning
| stats count by posture_status, user
| sort -count

Admin Activity Audit

index=cisco_ise sourcetype=cisco:ise cisco_ise_category=CISE_Administrative_and_Operational_Audit
| table _time, admin_name, operation_type, object_name, object_type
| sort -_time

Step 5 — Build the ISE Operations Dashboard

In Splunk Web: Dashboards > Create New Dashboard — name it ISE Operations Center.

Add these panels:

Panel 1 — Auth Volume (Line Chart)

index=cisco_ise sourcetype=cisco:ise cisco_ise_category=CISE_AAA_Audit
| timechart span=15m count by auth_result

Type: Line Chart | Time range: Last 24 hours | Auto-refresh: 5 min

Panel 2 — Failure Rate (Single Value)

index=cisco_ise sourcetype=cisco:ise cisco_ise_category=CISE_Failed_Attempts earliest=-1h
| stats count as failures
| appendcols [search index=cisco_ise cisco_ise_category=CISE_AAA_Audit earliest=-1h | stats count as total]
| eval failure_rate = round(failures/total*100, 1) . "%"
| table failure_rate

Type: Single Value | Threshold: green < 5%, yellow < 15%, red > 15%

Panel 3 — Top Failure Reasons (Bar Chart)

index=cisco_ise sourcetype=cisco:ise cisco_ise_category=CISE_Failed_Attempts earliest=-4h
| stats count by failure_reason
| sort -count | head 10

Panel 4 — Top Failing Endpoints (Table)

index=cisco_ise sourcetype=cisco:ise cisco_ise_category=CISE_Failed_Attempts earliest=-4h
| stats count, values(failure_reason) as reasons by calling_station_id, user
| sort -count | head 15

Panel 5 — Real-Time Failed Auth Feed (Table, auto-refresh 1 min)

index=cisco_ise sourcetype=cisco:ise cisco_ise_category=CISE_Failed_Attempts
| table _time, user, calling_station_id, nas_identifier, failure_reason
| sort -_time | head 50

Step 6 — Configure Alerts

Alert: Brute Force Detection

index=cisco_ise sourcetype=cisco:ise cisco_ise_category=CISE_Failed_Attempts
| stats count by user, calling_station_id
| where count > 10

Trigger: every 5 minutes, if results > 0. Send email or Slack notification.

Alert: Admin Account Usage After Hours

index=cisco_ise sourcetype=cisco:ise cisco_ise_category=CISE_Administrative_and_Operational_Audit
| eval hour=strftime(_time, "%H")
| where (hour < 7 OR hour > 19)
| table _time, admin_name, operation_type, object_name

Alert: Posture Non-Compliance Spike

index=cisco_ise sourcetype=cisco:ise cisco_ise_category=CISE_Posture_and_Client_Provisioning posture_status=NonCompliant
| timechart span=15m count
| where count > 20

Troubleshooting

No events in Splunk after configuring ISE syslog target

• Confirm the ISE MnT node can reach the Splunk forwarder on the configured port (test with tcpdump port 514 on the Splunk server)
• Verify the syslog target is assigned to at least one log category in ISE
• Check ISE’s Administration > System > Logging > Debug Log Configuration — enable Logging at INFO level

Events appearing but fields not extracted

• Confirm the add-on is installed on the indexer, not just the search head
• Restart Splunk after installing the add-on
• Run | metadata type=sourcetypes index=cisco_ise to verify the sourcetype is cisco:ise

Duplicate events in Splunk

• ISE MnT sends each event once — duplicates usually mean you have multiple syslog targets pointing to Splunk, or the Heavy Forwarder is forwarding to the indexer AND the indexer is also listening directly

Related ISE Content

• Cisco ISE Active Directory Integration — understand the identity data that flows through ISE into Splunk
• RADIUS Load Balancing for Cisco ISE — in multi-PSN deployments, all PSNs forward to the MnT — ensure your syslog target is on the MnT node
• Cisco ISE Posture Assessment — the posture compliance data queried in the SPL examples above