Integration Log

When something Endpoint Manager sends to Cisco ISE does not work, the Integration Log is where the reason is. It records the outbound calls that failed, per Context, with enough detail to fix the cause rather than open a ticket about it.

Successful calls are not recorded, and neither are ordinary conditions that merely look like failures, such as a device that is offline and therefore has no session to read.

Where it is

The log is part of the admin console and is scoped to one Cisco ISE Context. There are two ways in:

• The Integration Log tab on the Context overview.
• A link on the Cisco ISE API Status card, which reads View Integration Log, recent failed API calls.

The two views are the same log. The status card answers whether the API works right now; the log answers what failed recently and why.

It is an administrator surface. It is not exposed in the Self-Service portal.

What is recorded

Each entry describes one outbound call.

Operations

List endpoint groups, Get endpoint group, Create endpoint group, List endpoints, Get endpoint, Add endpoint, Update endpoint, Delete endpoint, Session lookup, CoA reauth, Bulk update, API status check, TLS check.

Connectivity checks are included on purpose. Adjusting a firewall rule and watching each attempt arrive is a legitimate way to use this log.

Triggers

Trigger	Meaning
Admin action	Someone in the admin console did something that reached Cisco ISE
Sync job	A background task, such as the periodic attribute verification
System	Follow-on work the platform did by itself, such as the Change of Authorization after a key change

Reasons

Reason	Usually means
Not authorized	Cisco ISE rejected the API credentials
Forbidden	The credentials were accepted but the account may not use that API
Not found	The path did not exist on the Cisco ISE node
Unreachable	The connection was refused or dropped before Cisco ISE answered
Timeout	Cisco ISE did not respond in time
TLS error	The certificate could not be validated, or the handshake failed
Error	Anything else

Unreachable and TLS error are kept apart deliberately. A connection dropped before the handshake finishes is reported as unreachable, not as a certificate problem, so you are not sent to inspect a certificate that was never presented.

Reading the list

A summary strip gives the number of failures in the selected range, the most common reason, and when the last one happened.

Columns: time, operation, reason, HTTP method and status, the message, and who or what triggered it.

Filters: free text search across URL, message and administrator; a time range of one hour, 24 hours, seven days, 30 days, everything, or a custom window; reason chips carrying their own counts; and additional filters for a specific operation or HTTP status.

Reading an entry

Expanding a row gives you the whole call.

The message is the part to read first. It is written to be acted on:

Situation	What the entry tells you to check
Rejected credentials	The API username and password, and that ERS and Open API access are enabled for that account in Cisco ISE
Permission denied	The account’s Cisco ISE role. The Monitoring API needs MnT Admin or Super Admin
Path not found	That the Base URL is right and the API is enabled on that node
Name not resolvable	The hostname in the Base URL, and DNS
Timed out	Whether Cisco ISE is up, and whether something is dropping traffic to that address and port
Certificate rejected	Whether the certificate is trusted, in date, and issued for the hostname you are calling

The request is shown as it was sent, with the method and the URL. The response is shown as Cisco ISE returned it, or, when the call never got that far, an explicit statement that no HTTP response was received because the failure happened at the connection level.

A side panel repeats the reason, the HTTP status, who triggered it, the trigger type and the full timestamp.

Reproducing the call

An entry offers a View curl action: a ready to run command that reproduces exactly the request the platform sent, so you or your network team or Cisco support can run it from somewhere else and see whether the result is the same.

It is a view and copy action. There is no file to download. Credentials appear as placeholders for you to substitute, never the real ones, and the address in the command is your own configured Cisco ISE address.

Very large requests, such as a bulk update covering hundreds of endpoints, are stored in shortened form and do not offer the command, because it would no longer reproduce the original call.

Retention

Entries are kept for 30 days and then removed automatically.

Getting failures out of the platform

Integration failures are available as a webhook event on a Cisco ISE Context, alongside the configuration audit event, so they can be pushed into a monitoring or ticketing system rather than watched by hand. See Capabilities.

How it differs from the Audit Log

They answer different questions and both are per Context.

	Audit Log	Integration Log
Records	What people and the platform did	Which outbound calls to Cisco ISE failed
Includes successes	Yes	No
Answers	Who changed this, and when	Why did this not reach Cisco ISE

An action can appear in both: the audit log shows that someone tried to add an endpoint, and the integration log shows why Cisco ISE refused it. See Audit Log.