cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.

1110
Views
25
Helpful
2
Replies
obaid.noor2
Beginner

ISE Quarantine Alerts

Hi,

   We are using Cisco ISE for device profiling (corporate machines, printers, phones, video conferencing units). I would like to know if there is a mechanism for ISE to generate and send an alert if a device is moved to Quarantine?

 

Thanks,

Obaid

1 ACCEPTED SOLUTION

Accepted Solutions
Greg Gibbs
Cisco Employee

A new feature in ISE 3.1 allows you to create alarms when a particular Authorization Profile is applied to a session. See the Release Notes for more information.

With ISE versions prior to 3.1, you would need to leverage an external syslog/SIEM solution (like Splunk) that could generate an alarm based on values in the Authentication syslog events.

View solution in original post

2 REPLIES 2
Greg Gibbs
Cisco Employee

A new feature in ISE 3.1 allows you to create alarms when a particular Authorization Profile is applied to a session. See the Release Notes for more information.

With ISE versions prior to 3.1, you would need to leverage an external syslog/SIEM solution (like Splunk) that could generate an alarm based on values in the Authentication syslog events.

obaid.noor2
Beginner

Thanks Greg. This helps

Create
Recognize Your Peers
Content for Community-Ad

ISE Webinars


Miss a previous ISE webinar?
Never miss one again!

CiscoISE on YouTube