topic Re: Cisco ISE Reporting in Network Access Control

Cisco ISE Reporting

liamnap — Tue, 03 May 2022 16:25:52 GMT

hi all,

I'm trying to create a custom report in ISE. In effect I want to do an ALL, with some ORs.

Different reports offer different fields though, and in effect I'm trying to find a way to create a report from brand new or add a field/column to a report for filtering, this column would be User-Fetch-LocalityName, this is the one I found once but cannot find again - any advice?

Full report filtering:

Logged within last 12 hours
AND
Device Type is WLC OR Switches
AND
Location is Southampton OR London
AND
User-Fetch-LocalityName is blank OR London

Thank you for any helps.

Kind Regards,

Liam

Re: Cisco ISE Reporting

Marcelo Morais — Tue, 03 May 2022 22:43:45 GMT

Hi @liamnap ,

please try at Operations > Reports > Reports > Endpoints and Users > RADIUS Authentications > select Filter > Advanced Filter.

Hope this helps !!!

Re: Cisco ISE Reporting

liamnap — Sun, 08 May 2022 19:52:06 GMT

Thank you Marcelo, but this is exactly what I am trying, if you notice the column options I cannot produce a report filtering on both Location and User-Fetch, or perhaps your UI is different to mine somehow?

Re: Cisco ISE Reporting

Greg Gibbs — Sun, 08 May 2022 22:29:45 GMT

There is limited customisation supported by the built-in ISE reporting engine. We typically recommend sending Syslog to an external SIEM like Splunk and building custom reports and dashboards for collating and presenting the information required.

Re: Cisco ISE Reporting

DMel — Wed, 15 Jun 2022 15:22:43 GMT

Just watched a webinar with details about the coming ISE v3.2 (in BETA as of this week it sounds like). One of the major features will be some additional reports, but also the ability to extract data direct for the MnT DB (read-only), so you could potentially make any report you want from that data.