Enabling AI Endpoint Analytics in ISE

Introduction

IT organizations face the ongoing challenge of protecting endpoints and IoT devices. These devices are frequently connected to the network and little is known about them, making it difficult to secure them and assign the appropriate level of network access. Achieving visibility is the crucial first step in securing any endpoint, and this relies on the ability to accurately identify and classify various types of IT and IoT devices.

Cisco AI Endpoint Analytics offers a solution that detects and classifies endpoints and IoT devices by assigning multiple labels, such as Endpoint Type, Hardware Model, Manufacturer, and OS Type, a process known as Multi-Factor Classification (MFC). This multifaceted categorization greatly aids in enforcing access policies through Cisco ISE by enabling more precise policy applications based on diverse device attributes.

Leveraging AI and machine learning, Endpoint Smart Grouping significantly reduces the number of unknown endpoints on the network by providing AI-driven endpoint groupings, automated custom profiling rules, and suggested endpoint labels, enhancing overall network security and management.

Enabling AI Endpoint Analytics

Note: If you are running ISE in evaluation mode, this will not work. You will need to link ISE to a Smart License account before proceeding.

If you have not registered to Smart Licensing, navigate to Administration>System>Licensing and register your VM/appliance.

After doing so, navigate to Work Centers>Profiler>Settings>Profiler Settings.

Check the boxes next to the following:

Custom Attribute for Profiling Enforcement
Publish Endpoint Attributes to AI Endpoint Analytics
Consume Endpoint Profiles from AI Endpoint Analytics

Then click Save.

Navigate to Work Centers>Profiler>Settings>Cisco AI Analytics.

Click the Configure button.

Check the box next to the End User License Agreement.

If you have never run Cisco AI Analytics, keep the radio button at New Configuration. If otherwise, choose Recover from a config file, and you will be prompted to upload a previous config file to link this ISE instance to your previous AI Endpoint Analytics instance.

Click the Enable button.

If the connection to the AI Endpoint Analytics cloud is successful, you should receive the following success message.

After enabling AI Endpoint Analytics, click the Download configuration file link and keep that file in a safe place.

Navigate to Context Visibility>Endpoints>Endpoint Classification.

You should see the AI Proposals window. You can click the pop-out window to see more information.

Below is an example of the pop-up with various AI Proposals. These are recommendations made by the AI Endpoint Analytics cloud based on the attributes seen in your environment. In turn, AI Endpoint Analytics will make recommendations on profiling rules and profiles, saving you much-needed time on building custom profiles.

To view a proposal, click the View Proposal link.

You will find information about the MFC-Endpoint Type, MFC-Hardware Manufacturer, MFC-Hardware Model, and MFC-Operating System in the AI proposal.

You will get the number of endpoints affected if you accept this proposal.

Click the Endpoints tab to see the specific endpoints.

After reviewing the endpoints, click the Profile Rule and Attributes tab again.

Scrolling down in the AI proposal, you can see the specific attributes being accepted for this proposal. As you can see from the below screenshot, some of these rules can be rather complex with a lot of regex.

Click the Accept Profiling Rule button to accept the proposal.