ISE 1.2 notifications

[ibrahim_hassan]

Dears ,

          is there anyway to send notifications about authentication failures to be sent by mail?

[Jatin Katyal · Accepted solution]

Going through the 1.2 config guide, I see there is an "excessive failed attempts" alarm that can be configured with a threshold  and includes filters and and gets emailed to the admin contacts defined there.

Cisco ISE alarms

http://www.cisco.com/en/US/docs/security/ise/1.2/user_guide/ise_mnt.html#wp1524784

Once the threshold is met, the Excessive Authentication  Attempts and Excessive Failed Attempts alarms are triggered. The numbers  displayed next to the Description column are the total number of  authentications that are authenticated or failed against Cisco ISE in  last 15 minutes.

Alarms are not triggered when you add users or endpoints to Cisco ISE.

Enabling and configuring alarms

http://www.cisco.com/en/US/docs/security/ise/1.2/user_guide/ise_mnt.html#wp1523173

~BR
Jatin Katyal

**Do rate helpful posts**