ISE logs

[erameh]

Hello team,

Please i need few clarfications on the 2 points below related to ISE

1. Where are account creation logs accessible? Ex: I create an Admin user in ISE. I want to go back to the logs and check when I created this user. Would this be via CLI?
2. If I export ISE logs externally, to a SIEM for example, can I re-import that data later to run the built-in ISE reports?

Thanks

[Timothy Abbott · Accepted solution]

Eliane,

You can run the Change Configuration Audit report to learn when an admin account was created in the system and be who.  Unfortunately, you can't import logs into the system but you shouldn't need to.  If you are logging externally, ISE still keeps those logs.

Regards,

-Tim