topic Re: ISE Quarantine Alerts in Network Access Control

ISE Quarantine Alerts

obaid.noor2 — Fri, 15 Oct 2021 00:49:52 GMT

Hi,

We are using Cisco ISE for device profiling (corporate machines, printers, phones, video conferencing units). I would like to know if there is a mechanism for ISE to generate and send an alert if a device is moved to Quarantine?

Thanks,

Obaid

Re: ISE Quarantine Alerts

Greg Gibbs — Fri, 15 Oct 2021 02:49:14 GMT

A new feature in ISE 3.1 allows you to create alarms when a particular Authorization Profile is applied to a session. See the Release Notes for more information.

With ISE versions prior to 3.1, you would need to leverage an external syslog/SIEM solution (like Splunk) that could generate an alarm based on values in the Authentication syslog events.

Re: ISE Quarantine Alerts

obaid.noor2 — Fri, 15 Oct 2021 02:59:30 GMT

Thanks Greg. This helps