Configuring pxGrid on Splunk for Rapid Threat Containment with ISE

In this video, we’re going to configure pxGrid on Splunk. Once that’s completed, you’ll be able to quarantine endpoints from Splunk using ISE. This requires a bit more setup that your usual pxGrid configuration so I’ll include the commands I used in this post so one may copy and paste for the Linux portion of this. Whether or not you’re using CA-signed certs for pxGrid or self-signed in your ISE environment, this configuration should work for both.

1.45 - Setting up and walkthrough of the Cisco Security Suite App in Splunk

In this video, we’re going to set up the Cisco Security Suite app within Splunk and walk through some of the cool things that we can do from the dashboard. One thing to note though is that this app was last updated in 2016 so there’s definitely some massaging that needs to be done to make it compatible with certain current add-ons.