ISE 1.1.3 - Notification when ISE creates New Endpoint Entries

[David Pease]

Good Morning,

I am interested in learning how to have notifications sent out to a preset list of recipients when ISE 1.1.3 creates a new endpoint entry.  The ability to know when a foreign device has been connected is imperative for our mission.

I have looked throughout the entirety of the ISE Settings, but I have yet to find where to enable the functionality to allow for this.

Can someone please point me to the correct menu/setting for this?

Thank You,

David

[Venkatesh Attuluri]

Check this link  its regarding

Creating, Assigning, Disabling, and Deleting Alarm Rules

http://www.cisco.com/en/US/docs/security/ise/1.0/user_guide/ise10_mnt.html#wp1053713

[David Pease]

Thank you for the response.

I read through the documentation that you linked me to, and it appears that i *should* be able to create the rules I require. I have tried many different sets of criteria, and I always receive the same Error Message:

"

type Status report

message Request not processed - Possible XSS input

description The request sent by the client was syntactically incorrect (Request not processed - Possible XSS input).

"

From the error, it looks like my criteria set is incorrect, but I have tried numerous different sets, all receive the same error.  According to the "Rules" section, under "Unknown NAD" the only Required Fields are "Category" and "Nad Count".   I have satisfied both of these fields numerous ways, all with the same output of the above error message.

Any Idea what could be causing this?

[Ravi Singh]

I think this is CSCtx03427 bug. This issue has been osbsdrved when the configured alarm name contain "onChange". Rename the alert name to something that does not contain "onChange"

[David Pease]

I was able to create the Alarm Rule, but isn't the "Unknown NAD" referring to a Network Access Device, ie Switch, Hub, ect?

I am trying to get notification when ANY new endpoint is created, not just a switch/hub/ect.