USM Anywhere™

Cisco ACS

When you configure Cisco ACS to send log data to USM Anywhere, you can use the Cisco ACS plugin to translate raw log data into normalized events for analysis. The table below provides some basic information for the plugin:

Plugin Information
Device Details
Vendor Cisco
Device Type Access Control Server
Connection Type syslog

Integrating Cisco ACS

Before you configure the Cisco ACS integration, you must have the IP Address of the USM Anywhere Sensor.

To configure Cisco ACS to send log data to USM Anywhere

  1. Go to System Administration > Configuration > Log Configuration > Remote Log Targets.
  2. On the Remote Log Targets page, click Create.
  3. Fill out the required fields

    1. Assign a name to the external syslog server, which in this case refers to USM Anywhere.
    2. Enter the IP address of the USM Anywhere Sensor.
    3. Select the target type, TCP Syslog or UDP Syslog.
    4. Enter the port number, 601 for TCP or 514 for UDP. See the Syslog Server Sensor App in USM Anywhere for more details.
    5. Enter the maximum length for the log messages. The default value is 1024.
    6. Click Submit.

  4. Verify that the remote log target you created appears in the list.
  5. Go to System Administration > Configuration > Log Configuration > Logging Categories > Global.
  6. Select the logging category you want to use to send logs to USM Anywhere, and then click Edit.
  7. Select the Remote Syslog Target tab.
  8. Move the remote log target created in step 3, "loglogic" in the example below, to Selected Targets.

  9. Click Submit.

Plugin Enablement

The Cisco ACS plugin automatically processes all messages when the raw message contains "CSCOacs_".

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. The USM Anywhere reports use these fields, and you can also reference them when creating custom reports. In addition to reporting, the USM Anywhere correlation rules make use of these fields.

  • authentication_mode
  • authentication_type
  • customfield_0
  • customfield_1
  • customfield_10
  • customfield_11
  • customfield_12
  • customfield_13
  • customfield_2
  • customfield_3
  • customfield_4
  • customfield_5
  • customfield_6
  • customfield_7
  • customfield_8
  • customfield_9
  • customheader_0
  • customheader_1
  • customheader_10
  • customheader_11
  • customheader_12
  • customheader_13
  • customheader_2
  • customheader_3
  • customheader_4
  • customheader_5
  • customheader_6
  • customheader_7
  • customheader_8
  • customheader_9
  • destination_address
  • destination_port
  • destination_service_name
  • event_action
  • event_description
  • event_name
  • event_outcome
  • event_severity
  • rep_device_address
  • rep_device_hostname
  • rep_device_version
  • session
  • source_address
  • source_port
  • source_username
  • timestamp_occured
  • transport_protocol

Network Device Groups

  • NAS-port-id
  • Service-Type
  • Calling-Station-ID
  • Response
  • SelectedAccessType
  • Port
  • Called-station-id
  • AdministratorClientIP
  • AdminIPAddress
  • AdminName
  • ConfigVersionId
  • RequestLatency
  • Type


For troubleshooting, see the vendor documentation.