How to Get Data Out of ISE

Cisco Identity Services Engine (ISE) TME Thomas Howard covers some of the many ways to get data from ISE using different methods for different needs.
00:00 Intro & Agenda
02:17 Method Comparison
04:30 Comma Separated Values
05:51 Demo: CSV Import, Templates, Export
09:34 `application configure ise` and Context Visibility for Endpoints
12:04 Demo: `application configure ise`, [16]Get All Endpoints
14:18 syslogs
- RFC-5424 The Syslog Protocol: datatracker.ietf.org/doc/html...
15:19: Demo: syslogs, Remote Logging Targets, Logging Categories
21:16 ISE with Splunk integrations
- App: splunkbase.splunk.com/app/4740
- Documentation: splunk.github.io/splunk-conne...
21:52 ISE REST APIs : cs.co/ise-api
22:58 ISE REST APIs Introduction Webinar & Repository
23:48 devnetsandboxise.cisco.com Always-On Demo Instance
REST Username: readonly
REST Password: ISEisC00L
25:04 Demo: ISE REST APIs with curl and Python Scripts
- Terminal app: Warp @ warp.dev
- ISE ERS API Examples: community.cisco.com/t5/securi...
- ISE Monitoring API Examples: community.cisco.com/t5/securi...
- xq (XML Query): github.com/sibprogrammer/xq
- $ISE_PPAN/api/v1/patch
- $ISE_PMNT/admin/API/mnt/Session/ActiveCount
- $ISE_PMNT/admin/API/mnt/Session/ActiveList
- $ISE_PMNT/admin/API/mnt/Session/UserName/thomas
- ISE Python Scripts github.com/1homas/ISE_Python_...
- ise-get.py endpointgroup -f table --details --noid
- ise-get.py all -v --details -f yaml --save data/ise_config
39:28 Cisco Platform Exchange Grid (pxGrid) and Sync vs Async Events
41:23 Demo: Enable pxGrid in ISE with Username+Password Authentication
- Terminal app: Warp @ warp.dev
44:48 Demo: pxgrid-util : session-query-all, px-subscribe
- Cisco pxGrid: github.com/cisco-pxGrid
- pxgrid-util @github.com/cisco-pxgrid/pytho...
48:32 ISE Data Connect
- OpenAPI: cs.co/ise-api#!data-connect-o...
- Guides: cs.co/ise-dataconnect
52:07: Demo: ISE Data Connect SQL Queries
- iseql.py --help
- iseql.py "SELECT view_name FROM user_views ORDER BY view_name ASC"
- iseql.py "SELECT view_name FROM RADIUS_ACCOUNTING"
- iseql.py "SELECT status,username,is_admin,password_never_expires FROM network_access_users"
- iseql.py "select location, sum(passed_count) as passed, sum(failed_count) as failed, sum(passed_count) + sum(failed_count) as total, round(to_char(((sum(failed_count) / (sum(passed_count) + sum(failed_count))) * 100)), 2) as failed_percentage, round(to_char(sum(total_response_time)/(sum(passed_count) + sum(failed_count))), 2) as total_response_time, max(max_response_time) as max_response_time from radius_authentication_summary group by location"
Resources
- ISE Webinars: cs.co/ise-webinars
- ISE UA-cam Channel: cs.co/ise-videos
- ISE Resources: cs.co/ise-resources
- ISE Community: cs.co/ise-community
- ISE Encyclopedic Resource Guide: cs.co/ise-berg
- ISE NAD Capabilities: cs.co/nad-capabilities
- Does ISE Support My Network Device?: cs.co/ise-interop
- ISE Troubleshooting Tech Notes: cs.co/ise-troubleshooting
- ISE Licensing & Evaluations: cs.co/ise-licensing

[@christianp3161]

A lot of great information. Thanks

[@Shaq2k]

Thanks. Can you also create a video where you show how to output logs to elasticsearch / openobserve? Should be relatively easy since ISE already uses Elastic?