ISE ERS filter endpoints by endpoint group

Michael Langerreiter — Mon, 11 Mar 2019 06:18:08 GMT

Hi All!

I am trying to retrieve all Endpoints in a particular EndpointGroup via the ISE ERS API. What I am trying is:

Request:

GET https://<ISE-ADMIN-NODE>:9060/ers/config/endpoint?size=10&sortdsc=name&filter=identityGroup.EQ.<GroupName>
ACCEPT: application/vnd.com.cisco.ise.identity.endpoint.1.0+xml

Response:

HTTP/1.1 400 Bad Request
<?xml version="1.0" encoding="utf-8" standalone="yes"?>
<ns2:ersResponse operation="GET-getAll-endpoint" xmlns:ns2="ers.ise.cisco.com">
  <link type="application/xml" href="https://<ISE-ADMIN-NODE>:9060/ers/config/endpoint?size=10&amp;sortdsc=name&amp;filter=identityGroup.EQ.<GroupName>" rel="related"/>
  <messages>
    <message code="Query string validation exception" type="ERROR"><title>The filter field 'identityGroup' is not supported</title></message>
  </messages>
</ns2:ersResponse>

I have alredy tried 'identityGroup', 'staticGroup', 'group' and 'endpointGroup' as the field-name in the filter.

Querying Users in a specific IdentityGroup works this way.

Does anyone know of a way to achieve what I am trying (probably I am missing something obvious)?

Thanks in advance,

Michael Langerreiter

Re: ISE ERS filter endpoints by endpoint group

sinkemlow — Wed, 19 Sep 2018 21:12:04 GMT

I realize this question is a few years old, but I had the same question. According to the documentation you can filter endpoints using these attributes:

Filter: [portalUser, staticProfileAssignment, profileId, profile, groupId, staticGroupAssignment, mac]

So by first getting the groupId of the endpoint group, you can do a EQ filter to get all endpoints that are in the group. The URL would look something like this:

https://isenode.yourdomain.com:9060/ers/config/endpoint?filter=groupId.EQ.47c84980-bb7b-11e8-b1e2-0eb4d50b5f28

topic Re: ISE ERS filter endpoints by endpoint group in Network Access Control

ISE ERS filter endpoints by endpoint group

Re: ISE ERS filter endpoints by endpoint group