Who made changes in Cisco ISE 3.0???

[Anthony O'Reilly]

Hi,

We are using Cisco ISE 3.0 for NAC and posturing.

There are a number of super admins on our ISE environment and some people used the ISE admin account ( I know, not best practice).

I just noticed that someone made a change to the ISE environment specifically around two dACLs.

Is there a way to find out in the logs who made changes in ISE?

[balaji.bandi · Accepted solution]

Generate a Audit report and check that is the only you can do, and check what IP address that user logged to start with.

Operations

    Reports

        Audit

              Change Configuration Audit