Cisco ISE Reporting

[liamnap]

hi all,

I'm trying to create a custom report in ISE. In effect I want to do an ALL, with some ORs.

Different reports offer different fields though, and in effect I'm trying to find a way to create a report from brand new or add a field/column to a report for filtering, this column would be User-Fetch-LocalityName, this is the one I found once but cannot find again - any advice?

Full report filtering:

Logged within last 12 hours
AND
Device Type is WLC OR Switches
AND
Location is Southampton OR London
AND
User-Fetch-LocalityName is blank OR London

Thank you for any helps.

Kind Regards,

Liam

[Marcelo Morais]

Hi @liamnap ,

 please try at Operations > Reports > Reports > Endpoints and Users > RADIUS Authentications > select Filter > Advanced Filter. 

Hope this helps !!!

[liamnap]

Thank you Marcelo, but this is exactly what I am trying, if you notice the column options I cannot produce a report filtering on both Location and User-Fetch, or perhaps your UI is different to mine somehow?

[Greg Gibbs · Accepted solution]

There is limited customisation supported by the built-in ISE reporting engine. We typically recommend sending Syslog to an external SIEM like Splunk and building custom reports and dashboards for collating and presenting the information required.

[DMel]

Just watched a webinar with details about the coming ISE v3.2 (in BETA as of this week it sounds like). One of the major features will be some additional reports, but also the ability to extract data direct for the MnT DB (read-only), so you could potentially make any report you want from that data.