https://community.cisco.com/t5/network-security/cisco-ips-sdee-logs/m-p/2753994#M44656 <P>Hi,</P><P>We have a cisco IPS module in ASA which supports SDEE. I would like to know if we can get the logs for configuration changes, user account creations etc using SDEE. Splunk is used to get the SDEE events and we are receiving only the intrusions and vulnerabilities. Cisco IPS manager express is showing the user creation logs but it doesn't come in splunk. Any help would be really appreciated.&nbsp;</P><P>&nbsp;</P><P>Regards</P><P>Sajin</P><P>&nbsp;</P> Sun, 10 Mar 2019 13:26:09 GMT SAJIN KAYANOTH PARAMBU 2019-03-10T13:26:09Z https://community.cisco.com/t5/network-security/cisco-ips-sdee-logs/m-p/2753994#M44656 <P>Hi,</P><P>We have a cisco IPS module in ASA which supports SDEE. I would like to know if we can get the logs for configuration changes, user account creations etc using SDEE. Splunk is used to get the SDEE events and we are receiving only the intrusions and vulnerabilities. Cisco IPS manager express is showing the user creation logs but it doesn't come in splunk. Any help would be really appreciated.&nbsp;</P><P>&nbsp;</P><P>Regards</P><P>Sajin</P><P>&nbsp;</P> Sun, 10 Mar 2019 13:26:09 GMT https://community.cisco.com/t5/network-security/cisco-ips-sdee-logs/m-p/2753994#M44656 SAJIN KAYANOTH PARAMBU 2019-03-10T13:26:09Z https://community.cisco.com/t5/network-security/cisco-ips-sdee-logs/m-p/2753995#M44658 <P>SDEE is designed to notify *only* about IDS/IPS events. Administrative accounting can be done via syslog and/or AAA.</P> Mon, 17 Aug 2015 03:05:45 GMT https://community.cisco.com/t5/network-security/cisco-ips-sdee-logs/m-p/2753995#M44658 m.kafka 2015-08-17T03:05:45Z