dc top-failures

Synopsis

netapi ise dc top-failures [OPTIONS]

Description

Get top failure reasons with counts and percentages. Quickly identify what’s breaking authentication - the first step in any troubleshooting workflow.

Options

Option Default Description

Option	Default	Description
`--hours`, `-h`	`24`	Hours to look back
`--limit`, `-l`	`20`	Maximum results to return

--hours, -h

24

Hours to look back

--limit, -l

20

Maximum results to return

Usage

# Top 20 failures (last 24h)
netapi ise dc top-failures

# Last hour - incident response
netapi ise dc top-failures --hours 1

# Top 5 only
netapi ise dc top-failures --limit 5

# JSON for scripting
netapi ise dc --format json top-failures

Sample Output

            Top Failures (last 24h)
┏━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━┳━━━━━━┓
┃ Failure Reason                                          ┃ Count ┃ %    ┃
┡━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━╇━━━━━━┩
│ 22056 Subject not found in the applicable identity...   │    45 │ 35%  │
│ 22028 Authentication failed and target type is...       │    28 │ 22%  │
│ 24408 EAP-TLS failed SSL/TLS handshake because of...   │    15 │ 12%  │
│ 12514 EAP-TLS failed SSL/TLS handshake because...      │    12 │ 9%   │
│ 22045 RADIUS packet contains duplicate RADIUS att...   │     8 │ 6%   │
└─────────────────────────────────────────────────────────┴───────┴──────┘

Common Failure Reasons

Code Meaning

Code	Meaning
`22056`	User not found in identity store (AD/LDAP)
`22028`	Authentication failed - password or unknown user
`24408`	Certificate issue - expired, revoked, or untrusted CA
`12514`	EAP-TLS handshake failure - often client cert issue
`22045`	Duplicate RADIUS attributes - usually supplicant bug

22056

User not found in identity store (AD/LDAP)

22028

Authentication failed - password or unknown user

24408

Certificate issue - expired, revoked, or untrusted CA

12514

EAP-TLS handshake failure - often client cert issue

22045

Duplicate RADIUS attributes - usually supplicant bug

Use Cases

Incident Response

# What broke in the last hour?
netapi ise dc top-failures --hours 1 --limit 5

Trend Analysis

# Compare today vs yesterday
echo "=== Today ==="
netapi ise dc top-failures --hours 24 --limit 5

echo "=== Yesterday ==="
netapi ise dc top-failures --hours 48 --limit 5

Export for Reporting

# CSV export
netapi ise dc --format json top-failures | jq -r '
  ["Reason","Count","Percent"],
  (.[] | [.failure_reason, .count, .pct]) | @csv
' > failure_report.csv