cisco ise 2.4 command auth report question

[baker82]

hello,

i would like to know if Cisco ISE can send live reporting of all command auths on the devices that is being managed with ISE. 

I have attempted to use the Admin > Settings > Alarm Settings > Alarm Notifications but im not sure which alarm would provide this tacacs-command auth. 

I was able to use the reporting feature to send these to my local repository but I am needing the report to be detailed via email.

thanks in advance :)

[Arne Bier]

By design, if you use TACACS+ for device admin, then the TACACS+ Accounting can contain the commands that are executed. It would be one accounting record per command authorized.  You can also see that in the SYSLOGs.  Not sure if you want this kind of data sent to you as individual emails (if I understood your initial comments).

If you choose to use Radius for device admin, then you don't get the command accounting.  You will get Radius Accounting that contains bytes in/out, but not the commands itself.  TACACS is the way forward!

[Mohammed al Baqari]

You can't generate an alarm for command change in ISE. You can do this from
syslog server by generating an alarm if syslog message matched.

[ldanny · Accepted solution]

ISE will send a notification email when report is complete but not the detailed report itself.

I suggest contacting the sales team for feature enhancement or provide feedback option within ISE GUI (Click on the gear icon in the upper right corner).

You could try using FTP/SFTP to schedule transfers from repository to email.

[baker82]

thank you for all the help.

Ill see if i can automate this with a script to pull from repository, convert to text file, then send email. I was really hoping to have a real-time report sent via email but im thinking this might meet the teams requirements. 

Michael