I would not enable Anomaly Enforcement until I knew exactly that these are not false positives. I have never used this feature and quite frankly, I don't see it being very useful, since ISE doesn't give us any nerd knobs to tune the logic of what is considered to be "anomalous". It's not flexible. When I see counters increasing, I always try to find the reason WHY. And so far I have never had that "ah ha" moment where I realise there is a problem in the network. In my experience so far, ISE doesn't tell you anything useful - it will say that a profile changed from Windows 10 to Windows 10. Yeah right - thanks.
The only time I have seen anomaly detection catch a real anomaly, was with one brand of desk phone, that for some stupid reason, executed DHCP twice during boot up. First time around, it boots up as a Linux OS, and then once it's semi-booted up, another IP stack initialises, and presents itself as an MSFT (Microsoft) - but this is expected normal for this vendor product.
Have you looked into any of your own anomalies so far, and if so, what have you found?
