<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: ISE: get endpoint last auth date based on mac address in Network Access Control</title>
    <link>https://community.cisco.com/t5/network-access-control/ise-get-endpoint-last-auth-date-based-on-mac-address/m-p/5250030#M594353</link>
    <description>&lt;P&gt;&lt;A href="https://cs.co/ise-berg#dataconnect" target="_blank" rel="noopener"&gt;https://cs.co/ise-berg#dataconnect&lt;/A&gt;&lt;/P&gt;
&lt;P&gt;Or send syslog somewhere and report/API to that syslog collector/SIEM.&lt;/P&gt;</description>
    <pubDate>Tue, 21 Jan 2025 09:54:45 GMT</pubDate>
    <dc:creator>ahollifield</dc:creator>
    <dc:date>2025-01-21T09:54:45Z</dc:date>
    <item>
      <title>ISE: get endpoint last auth date based on mac address</title>
      <link>https://community.cisco.com/t5/network-access-control/ise-get-endpoint-last-auth-date-based-on-mac-address/m-p/5250022#M594351</link>
      <description>&lt;P&gt;Hello,&amp;nbsp;&lt;/P&gt;&lt;P&gt;I need to get the last successful authentication date of an endpoint based on its mac address from ISE.&amp;nbsp;&lt;SPAN&gt;This will have to be automated down the road so using the GUI Reports is not an option.&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;After testing the API I realized it's not possible to get historical data, just active session info.&lt;/P&gt;&lt;P&gt;Would this be something I could do with data-connect? The idea is to dynamically provide a list of mac addresses to some kind of python script and obtain the last authentication date for each mac address.&lt;/P&gt;&lt;P&gt;BR,&lt;/P&gt;&lt;P&gt;Konstantinos&lt;/P&gt;</description>
      <pubDate>Tue, 21 Jan 2025 09:34:40 GMT</pubDate>
      <guid>https://community.cisco.com/t5/network-access-control/ise-get-endpoint-last-auth-date-based-on-mac-address/m-p/5250022#M594351</guid>
      <dc:creator>syllkons1</dc:creator>
      <dc:date>2025-01-21T09:34:40Z</dc:date>
    </item>
    <item>
      <title>Re: ISE: get endpoint last auth date based on mac address</title>
      <link>https://community.cisco.com/t5/network-access-control/ise-get-endpoint-last-auth-date-based-on-mac-address/m-p/5250030#M594353</link>
      <description>&lt;P&gt;&lt;A href="https://cs.co/ise-berg#dataconnect" target="_blank" rel="noopener"&gt;https://cs.co/ise-berg#dataconnect&lt;/A&gt;&lt;/P&gt;
&lt;P&gt;Or send syslog somewhere and report/API to that syslog collector/SIEM.&lt;/P&gt;</description>
      <pubDate>Tue, 21 Jan 2025 09:54:45 GMT</pubDate>
      <guid>https://community.cisco.com/t5/network-access-control/ise-get-endpoint-last-auth-date-based-on-mac-address/m-p/5250030#M594353</guid>
      <dc:creator>ahollifield</dc:creator>
      <dc:date>2025-01-21T09:54:45Z</dc:date>
    </item>
    <item>
      <title>Re: ISE: get endpoint last auth date based on mac address</title>
      <link>https://community.cisco.com/t5/network-access-control/ise-get-endpoint-last-auth-date-based-on-mac-address/m-p/5250320#M594367</link>
      <description>&lt;P&gt;Yes, Data Connect is the fastest and easiest method by querying &lt;A href="https://developer.cisco.com/docs/dataconnect/database-views/#endpoints_data" target="_self"&gt;ENDPOINTS_DATA&lt;/A&gt; or &lt;A href="https://developer.cisco.com/docs/dataconnect/database-views/#radius_accounting" target="_self"&gt;RADIUS_ACCOUNTING&lt;/A&gt; tables.&lt;/P&gt;
&lt;P&gt;&lt;A href="https://github.com/1homas/ISE_Python_Scripts" target="_blank"&gt;https://github.com/1homas/ISE_Python_Scripts&lt;/A&gt; :&lt;BR /&gt;- &lt;A class="Link--primary" title="iseql.py" href="https://github.com/1homas/ISE_Python_Scripts/blob/main/iseql.py" aria-label="iseql.py, (File)" target="_blank"&gt;iseql.py&lt;/A&gt; &lt;BR /&gt;- &lt;A class="Link--primary" title="isedc.py" href="https://github.com/1homas/ISE_Python_Scripts/blob/main/isedc.py" aria-label="isedc.py, (File)" target="_blank"&gt;isedc.py&lt;/A&gt; | &lt;A href="https://github.com/1homas/ISE_Python_Scripts?tab=readme-ov-file#iseqlpy" target="_self"&gt;Docs&lt;/A&gt;&lt;BR /&gt;- data/&lt;A class="Link--primary" title="SQL" href="https://github.com/1homas/ISE_Python_Scripts/tree/main/data/SQL" aria-label="SQL, (Directory)" target="_blank"&gt;SQL&lt;/A&gt; : contains many example SQL queries&lt;/P&gt;</description>
      <pubDate>Tue, 21 Jan 2025 17:03:21 GMT</pubDate>
      <guid>https://community.cisco.com/t5/network-access-control/ise-get-endpoint-last-auth-date-based-on-mac-address/m-p/5250320#M594367</guid>
      <dc:creator>thomas</dc:creator>
      <dc:date>2025-01-21T17:03:21Z</dc:date>
    </item>
    <item>
      <title>Re: ISE: get endpoint last auth date based on mac address</title>
      <link>https://community.cisco.com/t5/network-access-control/ise-get-endpoint-last-auth-date-based-on-mac-address/m-p/5290063#M596303</link>
      <description>&lt;P&gt;Hey&amp;nbsp;&lt;a href="https://community.cisco.com/t5/user/viewprofilepage/user-id/26555"&gt;@thomas&lt;/a&gt;&amp;nbsp;, thank you for the effort you have put into this, I have gone over your github and youtube videos and everything is really helpful.&amp;nbsp;&lt;/P&gt;&lt;P&gt;That being said, I am looking for something very specific i.e. the last time an endpoint was seen on ISE - using MAB in my scenario.&lt;/P&gt;&lt;P&gt;For this I have been querying ENDPOINTS_DATA for field UPDATE_TIME but I am not sure if that's the correct field to be looking at. Do you know if that's the one? I have checked other tables as well but I can't seem to find this information anywhere else.&lt;/P&gt;</description>
      <pubDate>Mon, 12 May 2025 20:12:15 GMT</pubDate>
      <guid>https://community.cisco.com/t5/network-access-control/ise-get-endpoint-last-auth-date-based-on-mac-address/m-p/5290063#M596303</guid>
      <dc:creator>syllkons1</dc:creator>
      <dc:date>2025-05-12T20:12:15Z</dc:date>
    </item>
  </channel>
</rss>

