Documentation Center
AlienVault® USM Appliance™

Cisco ACS

When you configure Cisco ACS to send log data to USM Appliance, you can use the Cisco ACS plugin to translate the raw log data into normalized events for analysis.

Device Details
Vendor Cisco
Device Type Access Control Server
Connection Type syslog
Data Source Name cisco-acs
Data Source ID 1594

Integrating Cisco ACS

Before you configure the Cisco ACS integration, you must have the IP Address of the USM Appliance Sensor.

To configure Cisco ACS to send log data to USM Appliance

  1. Go to System Administration > Configuration > Log Configuration > Remote Log Targets.
  2. On the Remote Log Targets page, click Create.
  3. Fill out the required fields

    1. Assign a name to the external syslog server, which in this case refers to USM Appliance.
    2. Enter the IP address of the USM Appliance Sensor.
    3. Select the target type, TCP Syslog or UDP Syslog.
    4. Enter the port number, 514 for TCP or UDP.
    5. Enter the maximum length for the log messages. The default value is 1024.
    6. Click Submit.

  4. Verify that the remote log target you created appears in the list.
  5. Go to System Administration > Configuration > Log Configuration > Logging Categories > Global.
  6. Select the logging category you want to use to send logs to USM Appliance, and then click Edit.
  7. Select the Remote Syslog Target tab.
  8. Move the remote log target created in step 3, "loglogic" in the example below, to Selected Targets.

  9. Click Submit.

Plugin Enablement

For plugin enablement information, see Enable Plugins.

Troubleshooting

For troubleshooting, see the vendor documentation.

https://www.cisco.com/c/en/us/td/docs/net_mgmt/cisco_secure_access_control_system/5-8/user/guide/acsuserguide/admin_config.html#66559