ISE remote logging - incude AD group

[anvolkov]

hello,

do you know if it's possible to include AD group to the logs (when sending them to the remote target as an external syslog server)? we need to have not only Identity source information, but exactly the AD group to which the user belongs.

Thank you in advance!

[hslai · Accepted solution]

The info in authentication details reports would be there. If customers needing more than what in the reports, then please ask them to use LDAP search tools, such as Dsget user, to get that directly from AD.

[howon]

Not sure of the details on what is the end goal here, but you could craft the Authz policy rule name or the AuthZ profile name that resembles the AD group that the user is member of that gets assigned to the user/device. I have not personally tested out the syslog result for this purpose so suggest you test out to see if you get the proper string back.