cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
Announcements
Choose one of the topics below to view our ISE Resources to help you on your journey with ISE

This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.

313
Views
2
Helpful
6
Replies
Cisco Employee

How do I clear the anomalous behavior flag from endpoints after resolving the anomalous behavior without deleting the endpoint?

Hi team, as the question title stated, how do I clear this flag without resorting to endpoint deletion.

Regards,

Sudhir

Everyone's tags (2)
1 ACCEPTED SOLUTION

Accepted Solutions
Highlighted
Advocate

Re: How do I clear the anomalous behavior flag from endpoints after resolving the anomalous behavior without deleting the endpoint?

Yes, but highly recommend you have Cisco account team send request to Kevin Gagnon (kegagnon) to submit customer name and business impact to assist with feature prioritization.

View solution in original post

6 REPLIES 6
Highlighted
Cisco Employee

Re: How do I clear the anomalous behavior flag from endpoints after resolving the anomalous behavior without deleting the endpoint?

looking at this guide it seems like the only way to clear is to remove the endpoint

Configure Anomalous Endpoint Detection and Enforcement on ISE 2.2 - Cisco

will ask the SME

Highlighted
Cisco Employee

Re: How do I clear the anomalous behavior flag from endpoints after resolving the anomalous behavior without deleting the endpoint?

Thanks for the assistance, Jason.

Cheers,

Sudhir

Highlighted
Advocate

Re: How do I clear the anomalous behavior flag from endpoints after resolving the anomalous behavior without deleting the endpoint?

Correct.  Currently Delete endpoint is only option.  You could also export/delete/import via file or API to re-add endpoint so some of the key endpoint attributes like ID group, Guest values, Portal User, MDM, and custom attributes are recovered.  Profiling info will be dynamically relearned.

Highlighted
Cisco Employee

Re: How do I clear the anomalous behavior flag from endpoints after resolving the anomalous behavior without deleting the endpoint?

Is there an existing enhancement request to provide a clearing function other than deletion for this? If not, we will open one.

Highlighted
Advocate

Re: How do I clear the anomalous behavior flag from endpoints after resolving the anomalous behavior without deleting the endpoint?

Yes, but highly recommend you have Cisco account team send request to Kevin Gagnon (kegagnon) to submit customer name and business impact to assist with feature prioritization.

View solution in original post

Highlighted
Cisco Employee

Re: How do I clear the anomalous behavior flag from endpoints after resolving the anomalous behavior without deleting the endpoint?

Alright, will do. Thanks!


Cheers,

Sudhir