Retrieve login success/failure logs from Cisco ISE API

[MartinSmuts92979]

Hi 

Is there an API call that can be used to retrieve logs for login failure/success via the CISCO ISE API?

I have tried to use the the FailureReasons API call but had no luck: https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/api_ref_guide/api_ref_book.pdf PAGE 3-4

I have seen that the Cisco ISE Portal can be used to view logs for TACACS and RADIUS, but I need to extract the logs via the API to create my own reporting views. 

Regards

Martin 

[paul · Accepted solution]

This coding is a bit beyond me at this point, but if you are looking to do something like this I would look at making my own pxGrid 2.0 client:

https://d1nmyq4gcgsfi5.cloudfront.net/fileMedia/ea02ce59-2668-441a-601d-0c6ca59d8bf4/CiscopxGrid20_je.pdf

https://github.com/cisco-pxgrid/pxgrid-rest-ws/wiki

Parsing this through a Syslog server is also the other method.

[MartinSmuts92979]

Thanks for the information, Paul. I will investigate these options and revert back if any of these worked. 

[Nidhi]

As Paul mentioned, the best adopted way is to use an external syslog server and parse the messages and automate the reports according to the requirement. 

Thanks,

Nidhi