Cisco ISE condition Log -- possible?

[Jason_newbie]

Hi There.

is there a way to have Cisco ISE do condition log ?

for example,  if the login user is "john-doe", do not log any authentication/authorization event?

we have some security tools keep login to every device, which create a lot of unnecessary logs.

[Mohammed al Baqari]

Hi,

You can't do conditional debug on ISE. For this, you will need to have to
have security logging rules on a SIEM/Logging collector.

***** please remember to rate useful posts

[martin.fischer · Accepted solution]

Hi @Jason_newbie 

If I understand your question correctly, you want to filter authentication messages which appear in the ISE RADIUS Live Log Viewer, right? You can do that with a collection filter.

Go to Administration > System > Logging > Collection Filters then add a filter with attribute User Name and the respective filter type.

[Jason_newbie]

Thanks, this is exactly what I need.