topic Re: ISE Identity groups logging in Network Access Control

ISE Identity groups logging

alyautdinov — Fri, 09 Feb 2018 13:31:18 GMT

Hello Team

We need to see when some mac-address is adding or removing in special identity group in ISE. In which logging categories can we see this? And how it is look like?

Re: ISE Identity groups logging

Craig Hyps — Mon, 12 Feb 2018 14:06:00 GMT

Depending on how change made, you may see in Configuration Audit report...

You can also see Identity Group reported in Authentication log. However, the auth log does not flag if change from previous.

Re: ISE Identity groups logging

alyautdinov — Mon, 12 Feb 2018 14:35:15 GMT

In report we don't see the name of the group. The point is to monitor the state of special group. We want see adding or removing mac-address to this group.

Re: ISE Identity groups logging

Craig Hyps — Mon, 12 Feb 2018 14:55:15 GMT

In example, group name is shown. Group is also shown in passed auth log. We do not alarm on endpoints entering/leaving a specified group. I recommend submitting enhancement request to your Cisco account team, or using an external logger with rule that can track members of groups and correlate changes.

Re: ISE Identity groups logging

alyautdinov — Wed, 14 Feb 2018 09:09:31 GMT

Can you promt us which product can do that? How can we track this? By syslog or snmp or API?

Can we do this with Splunk?

Re: ISE Identity groups logging

Jason Kunst — Wed, 14 Feb 2018 12:53:53 GMT

ISE can do syslog to splunk which has an ISE plug in

Please check their documents

Re: ISE Identity groups logging

pmet — Wed, 07 Nov 2018 15:28:41 GMT

Hi Jason ,

Do you know which Logging Category & at which Severity , produce this specific information of log ? I mean the name of the identity group .

Thanks

Makis