How do I clear the anomalous behavior flag from endpoints after resolving the anomalous behavior without deleting the endpoint?

[suddesai]

Hi team, as the question title stated, how do I clear this flag without resorting to endpoint deletion.

Regards,

Sudhir

[Jason Kunst]

looking at this guide it seems like the only way to clear is to remove the endpoint

Configure Anomalous Endpoint Detection and Enforcement on ISE 2.2 - Cisco

will ask the SME

[suddesai]

Thanks for the assistance, Jason.

Cheers,

Sudhir

[Craig Hyps]

Correct.  Currently Delete endpoint is only option.  You could also export/delete/import via file or API to re-add endpoint so some of the key endpoint attributes like ID group, Guest values, Portal User, MDM, and custom attributes are recovered.  Profiling info will be dynamically relearned.

[suddesai]

Is there an existing enhancement request to provide a clearing function other than deletion for this? If not, we will open one.

[Craig Hyps · Accepted solution]

Yes, but highly recommend you have Cisco account team send request to Kevin Gagnon (kegagnon) to submit customer name and business impact to assist with feature prioritization.

[suddesai]

Alright, will do. Thanks!

Cheers,

Sudhir