Who made changes in Cisco ISE 3.0???

Anthony O'Reilly — Thu, 10 Mar 2022 07:27:57 GMT

Hi,

We are using Cisco ISE 3.0 for NAC and posturing.

There are a number of super admins on our ISE environment and some people used the ISE admin account ( I know, not best practice).

I just noticed that someone made a change to the ISE environment specifically around two dACLs.

Is there a way to find out in the logs who made changes in ISE?

Re: Who made changes in Cisco ISE 3.0???

balaji.bandi — Thu, 28 Oct 2021 16:56:51 GMT

Generate a Audit report and check that is the only you can do, and check what IP address that user logged to start with.

Operations

Reports

Audit

Change Configuration Audit