cancel
Showing results for 
Search instead for 
Did you mean: 
cancel

ISE Quarantine Alerts

obaid.noor2
Beginner
Beginner

Hi,

   We are using Cisco ISE for device profiling (corporate machines, printers, phones, video conferencing units). I would like to know if there is a mechanism for ISE to generate and send an alert if a device is moved to Quarantine?

 

Thanks,

Obaid

1 ACCEPTED SOLUTION

Accepted Solutions

Greg Gibbs
Cisco Employee
Cisco Employee

A new feature in ISE 3.1 allows you to create alarms when a particular Authorization Profile is applied to a session. See the Release Notes for more information.

With ISE versions prior to 3.1, you would need to leverage an external syslog/SIEM solution (like Splunk) that could generate an alarm based on values in the Authentication syslog events.

View solution in original post

2 REPLIES 2

Greg Gibbs
Cisco Employee
Cisco Employee

A new feature in ISE 3.1 allows you to create alarms when a particular Authorization Profile is applied to a session. See the Release Notes for more information.

With ISE versions prior to 3.1, you would need to leverage an external syslog/SIEM solution (like Splunk) that could generate an alarm based on values in the Authentication syslog events.

obaid.noor2
Beginner
Beginner

Thanks Greg. This helps

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: