07-04-2025 08:45 AM
I’m looking to create a dashboard within Cisco ISE or Cisco DNA Center that provides a real-time view of recent configuration activities. The goal is to capture and display changes made within the last 5 minutes.
Requirements:
Who performed the change (user identity)
Which device was changed (e.g., switch, router)
What changes were made (summary of configuration or command)
Timestamp of when the change occurred
Purpose:
To use the dashboard as an audit tool for tracking near real-time administrative or configuration changes across the network.
Request:
I’d appreciate any guidance, best practices, or examples on implementing this in Cisco ISE or DNAC. Information on APIs, logs, or custom dashboard capabilities would be especially helpful.
07-04-2025 10:54 AM - edited 07-04-2025 10:55 AM
If you need minute-by-minute resolution for this you will have to pull this from tacacs live logs & authorization/accounting. You can view this directly under Operations > Tacacs > Live logs, or you can pull the data from the MNT API: https://community.cisco.com/t5/security-knowledge-base/ise-monitoring-api-examples/ta-p/4800437#U4800437 https://developer.cisco.com/docs/identity-services-engine/3.0/introduction-to-monitoring-rest-apis/
EDIT: If you are sending logs to an external log system you can also probably use that system to make a dashboard for this.
07-04-2025 07:11 PM
Can use Operations > System 360 > Settings in the Cisco ISE interface.by using Elastic relies on Log Analytics for data processing and visualization... Can you help with this log analytics with elastic..
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide