Help Needed: Create Real-Time Change Monitoring Dashboard in Cisco ISE

[lijosamuel]

I’m looking to create a dashboard within Cisco ISE or Cisco DNA Center that provides a real-time view of recent configuration activities. The goal is to capture and display changes made within the last 5 minutes.

Requirements:

Who performed the change (user identity)

Which device was changed (e.g., switch, router)

What changes were made (summary of configuration or command)

Timestamp of when the change occurred

Purpose:

To use the dashboard as an audit tool for tracking near real-time administrative or configuration changes across the network.

Request:
I’d appreciate any guidance, best practices, or examples on implementing this in Cisco ISE or DNAC. Information on APIs, logs, or custom dashboard capabilities would be especially helpful.

[Torbjørn]

If you need minute-by-minute resolution for this you will have to pull this from tacacs live logs & authorization/accounting. You can view this directly under Operations > Tacacs > Live logs, or you can pull the data from the MNT API: https://community.cisco.com/t5/security-knowledge-base/ise-monitoring-api-examples/ta-p/4800437#U4800437 https://developer.cisco.com/docs/identity-services-engine/3.0/introduction-to-monitoring-rest-apis/ 

EDIT: If you are sending logs to an external log system you can also probably use that system to make a dashboard for this.