Cisco ISE - Is it possible to suppress logs in monitor by failure reason code?

[cjkaufman@dmgov.org]

I have a situation where a bunch of users passwords expired in AD.  There are several machines that users are logged into with their old passwords, which is causing authentication failures (failure reason code 24408).  These log messages are occurring frequently, about 1-2 minutes for each machine, and with 10+ machines in this situation, it is flooding my Auth message log.

Is there a way to suppress logs in the Auth monitor by failure reason code for a certain duration, similar to what you can to with the RADIUS anomalous client suppression?

thx

[Jatin Katyal]

Not with the failure code however you can create collection filter on ISE based on

– User Name

– MAC Address

– Policy Set Name

– NAS IP Address

– Device IP Address

You can read more about it here.

Regards,

Jatin

[cjkaufman@dmgov.org]

I looked at that feature, but that doesn't help me any based on my problem described above.  Is there a solution to help with this?  Can the ISE team add the functionality to filter by failure code?