ISE - Network devices configuration change alerts

[AhmedALJAWAD44875]

Hi All 

   is there any way we can have Cisco ISE send alerts of a network device configs changes, I can see there is a report under device administration - TACACS Command accounting 

but can I get these reports as alerts " so it can trigger email notification "  and if I want them to a specific group of devices? 

Thank you in advance 

[balaji.bandi]

you can setup alarms

Administration > Settings > Alarm settings

[AhmedALJAWAD44875]

yes, but as far as I know the config change alarm in the alarm settings is just for the config change of the ISE itself? correct me if I'm wrong, please. 

[Damien Miller · Accepted solution]

That is correct, the configuration change alarm in ISE is for configuration changes made by an administrator to ISE itself through the GUI, not configuration changes taking place on network devices. 

If you want to do this you will need to configure an external syslog target and send the radius/tacacs logs to something like Splunk for processing and alerting. 

You can schedule the report you have looked at to export to a repository such as an external FTP server, but you can't send email alerts from ISE for changes taking place on network devices. 

[balaji.bandi]

that is for ISE, for another audit you need setup external logging to send the device to traps to your SIEM or NMS or Syslog for audit purposes.

you can use EEM Script to sent alert to syslog or email as soon as the config changes on end network device.

[vasuandvasu619]

Did you got solution? I too looking for same