DataConnect Commands

#!/bin/bash
# morning-check.sh - Run daily before coffee

echo "═══════════════════════════════════════════════════════"
echo "  ISE Health Check - $(date '+%Y-%m-%d %H:%M')"
echo "═══════════════════════════════════════════════════════"

echo -e "\n📊 Overnight Stats (12h):"
netapi ise dc stats --hours 12

echo -e "\n❌ Recent Failures (4h):"
netapi ise dc failed --hours 4 --limit 10

echo -e "\n🔍 Unknown Devices:"
netapi ise dc --format json profiler | jq '.[] | select(.policy == "Unknown") | "\(.count) unknown endpoints"' -r

#!/bin/bash
# troubleshoot.sh <MAC> - Complete device investigation

MAC="${1:?Usage: troubleshoot.sh <MAC>}"

echo "═══════════════════════════════════════════════════════"
echo "  Investigating: $MAC"
echo "═══════════════════════════════════════════════════════"

# Step 1: Full session view (identity + profiler + session + auth history)
echo -e "\n📋 FULL SESSION VIEW:"
netapi ise dc session "$MAC" --hours 72

# Step 2: Check for failure patterns
echo -e "\n❌ FAILURE ANALYSIS:"
netapi ise dc --format json auth-history "$MAC" --hours 168 | jq '
  group_by(.status) |
  map({status: .[0].status, count: length}) |
  .[] | "\(.status): \(.count)"
' -r

# Step 3: Compare to similar devices
echo -e "\n🔄 SIMILAR DEVICES (same profiler policy):"
POLICY=$(netapi ise dc --format json endpoint "$MAC" | jq -r '.profiler_policy')
netapi ise dc endpoints --policy "$POLICY" --limit 5

#!/bin/bash
# security-scan.sh - Detect anomalies

echo "🔒 Security Scan - $(date)"

# 1. Brute force detection (>10 failures from same MAC in 1 hour)
echo -e "\n⚠️  Possible brute force (>10 failures/hour):"
netapi ise dc --format json failed --hours 1 | jq '
  group_by(.mac) |
  map(select(length > 10)) |
  map({mac: .[0].mac, failures: length, last_reason: .[-1].failure_reason})
'

# 2. New unknown devices
echo -e "\n🆕 New unknown devices (24h):"
netapi ise dc --format json endpoints --policy "Unknown" --limit 20 | jq '
  .[] | "\(.mac) | \(.ip // "no IP") | first seen: \(.first_seen)"
' -r

# 3. Failed certificate authentications (possible cert issues)
echo -e "\n🔐 Certificate auth failures:"
netapi ise dc --format json failed --hours 24 | jq '
  [.[] | select(.failure_reason | tostring | contains("24"))] |
  length as $count |
  "\($count) certificate-related failures"
' -r

#!/bin/bash
# inventory-report.sh - Weekly compliance report

echo "📊 Weekly Inventory Report - $(date '+%Y-%m-%d')"
echo "═══════════════════════════════════════════════════════"

# Device breakdown
echo -e "\n📱 Device Types:"
netapi ise dc device-types

echo -e "\n🏷️  Top 10 Profiler Policies:"
netapi ise dc --format json profiler | jq -r '
  sort_by(-.count) |
  .[0:10] |
  .[] |
  "\(.policy): \(.count)"
'

# Unknown/unmanaged devices (compliance risk)
echo -e "\n⚠️  Compliance Risks:"
UNKNOWN=$(netapi ise dc --format json profiler | jq '[.[] | select(.policy == "Unknown")] | .[0].count // 0')
echo "  Unknown devices: $UNKNOWN"

# Devices without recent auth (stale)
echo -e "\n💤 Stale endpoints (no auth in 7 days):"
netapi ise dc query "
SELECT COUNT(*) as stale_count
FROM ENDPOINTS_DATA
WHERE UPDATE_TIME < SYSDATE - 7
" 2>/dev/null

netapi ise dc query "
SELECT
  TO_CHAR(TIMESTAMP_TIMEZONE, 'YYYY-MM-DD HH24') as hour,
  COUNT(*) as total,
  SUM(CASE WHEN PASSED = 'Pass' THEN 1 ELSE 0 END) as passed,
  ROUND(SUM(CASE WHEN PASSED = 'Pass' THEN 1 ELSE 0 END) * 100.0 / COUNT(*), 1) as success_pct
FROM RADIUS_AUTHENTICATIONS
WHERE TIMESTAMP_TIMEZONE > SYSDATE - 1
GROUP BY TO_CHAR(TIMESTAMP_TIMEZONE, 'YYYY-MM-DD HH24')
ORDER BY hour
"

netapi ise dc query "
SELECT
  FAILURE_REASON,
  COUNT(*) as count,
  ROUND(COUNT(*) * 100.0 / SUM(COUNT(*)) OVER(), 1) as pct
FROM RADIUS_AUTHENTICATIONS
WHERE PASSED != 'Pass' AND TIMESTAMP_TIMEZONE > SYSDATE - 1
GROUP BY FAILURE_REASON
ORDER BY count DESC
FETCH FIRST 10 ROWS ONLY
"

netapi ise dc query "
SELECT
  p.ENDPOINT_PROFILE as device_type,
  COUNT(DISTINCT a.CALLING_STATION_ID) as unique_devices,
  ROUND(AVG(a.ACCT_SESSION_TIME)/3600, 1) as avg_session_hours,
  ROUND(MAX(a.ACCT_SESSION_TIME)/3600, 1) as max_session_hours
FROM RADIUS_ACCOUNTING a
JOIN PROFILED_ENDPOINTS_SUMMARY p ON a.CALLING_STATION_ID = p.ENDPOINT_ID
WHERE a.ACCT_STATUS_TYPE = 'Stop' AND a.TIMESTAMP_TIMEZONE > SYSDATE - 7
GROUP BY p.ENDPOINT_PROFILE
ORDER BY unique_devices DESC
FETCH FIRST 15 ROWS ONLY
"

netapi ise dc query "
SELECT
  NAS_IP_ADDRESS,
  COUNT(*) as total_auths,
  SUM(CASE WHEN PASSED = 'Pass' THEN 1 ELSE 0 END) as passed,
  SUM(CASE WHEN PASSED != 'Pass' THEN 1 ELSE 0 END) as failed,
  ROUND(SUM(CASE WHEN PASSED = 'Pass' THEN 1 ELSE 0 END) * 100.0 / COUNT(*), 1) as success_pct
FROM RADIUS_AUTHENTICATIONS
WHERE TIMESTAMP_TIMEZONE > SYSDATE - 1
GROUP BY NAS_IP_ADDRESS
HAVING COUNT(*) > 10
ORDER BY failed DESC
FETCH FIRST 20 ROWS ONLY
"

# Full endpoint inventory to CSV
netapi ise dc --format json endpoints --limit 5000 | jq -r '
  ["MAC","Hostname","IP","Policy","Last Seen"],
  (.[] | [.mac, .hostname, .ip, .policy, .last_seen]) | @csv
' > endpoints.csv

#!/bin/bash
# Push to Prometheus pushgateway
STATS=$(netapi ise dc --format json stats)
PASSED=$(echo "$STATS" | jq '.passed')
FAILED=$(echo "$STATS" | jq '.failed')

cat <<EOF | curl --data-binary @- http://pushgateway:9091/metrics/job/ise
ise_auth_passed_total $PASSED
ise_auth_failed_total $FAILED
EOF

#!/bin/bash
# Alert if failure rate > 20%
STATS=$(netapi ise dc --format json stats --hours 1)
RATE=$(echo "$STATS" | jq '.success_rate')

if (( $(echo "$RATE < 80" | bc -l) )); then
  curl -X POST "$SLACK_WEBHOOK" -d "{
    \"text\": \"⚠️ ISE Auth Success Rate: ${RATE}% (last hour)\"
  }"
fi