Skip to main content

Cisco Wireless LAN Controller

Cisco Wireless LAN Controller (WLC) is used to manage and ensure seamless and secure wireless communication within organizations.

Cisco Wireless LAN Controller (WLC)

This pack includes Cortex XSIAM content.

Message Logging Configuration

You need to configure Cisco WLC to forward Syslog messages.

  • Product documentation for configuring message logging either from the GUI and CLI - Link.

Open your Cisco WLC GUI, and follow these instructions:

  1. Go to Management → Logs → Config. The Syslog Configuration page appears.
  2. In the Syslog Server IP Address field, enter the IPv4/IPv6 address of the server to which to send the syslog messages and click Add.
  3. Optional, to set the severity level for filtering syslog messages to the syslog servers, choose one of the options under Syslog Level.
  4. Optional, to set the facility for outgoing syslog messages to the syslog servers, choose one of the options under Syslog Facility.
  5. Click Apply.
  6. Optional, to set the severity level for logging messages to the controller buffer and console, choose one of the options from either the Buffered Log Level and Console Log Level dropdown lists.
  7. Select the File Info checkbox if you want the message logs to include information about the source file. The default value is enabled.
  8. Select the Trace Info checkbox if you want the message logs to include traceback information. The default is disabled.
  9. Click Apply.
  10. Click Save Configuration.

Timestamp Ingestion

The following timestamp formats are currently supported for ingestion from Cisco WLC Syslog Messages in UTC time:

  • MMM dd hh:mm:ss.nnn
  • MMM dd hh:mm:ss.nnn TZ
  • yyyy MMM dd hh:mm:ss.nnn
  • yyyy MMM dd hh:mm:ss.nnn TZ

In order to configure one of the above formats, follow these instructions:

  1. Open your Cisco WLC CLI terminal, and type enable to enter Privileged EXEC mode.
  2. Enter Global Configuration Mode by either typing configure terminal or conf t.
  3. To configure the timezone in UTC format, type:
config time timezone enable 0 0
  1. For adding a year and milliseconds to your syslog messages, type:
config service timestamps log datetime year msec
  1. Revert back to Privileged EXEC mode by typing end.
  2. Save your changes by either typing
write memory
copy running-config startup-config 

And wait for system confirmation.

Collect Events from Vendor

In order to use the collector, use the Broker VM option.

Broker VM

To create or configure the Broker VM, use the information described here.

You can configure the specific vendor and product for this instance.

  1. Navigate to SettingsConfigurationData BrokerBroker VMs.
  2. Go to the Apps column under the Brokers tab and add the Syslog Collector app for the relevant broker instance. If the app already exists, hover over it and click Configure.
  3. Click Add New for adding a new syslog data source.
  4. When configuring the new syslog data source, set the following values:
    | Parameter | Value
    | :--- | :---
    | Vendor | Enter cisco.
    | Product | Enter wlc.




Cortex XSIAM


CertificationRead more
Supported ByCortex
CreatedOctober 31, 2023
Last ReleaseOctober 31, 2023

Content packs are licensed by the Publisher identified above and subject to the Publisher’s own licensing terms. Palo Alto Networks is not liable for and does not warrant or support any content pack produced by a third-party Publisher, whether or not such packs are designated as “Palo Alto Networks-certified” or otherwise. For more information, see the Marketplace documentation.