dc coa-events :: Domus Digitalis

Synopsis

netapi ise dc coa-events [OPTIONS]

Description

Get Change of Authorization (CoA) events. Track when ISE pushed policy changes to endpoints (quarantine, reauth, profile changes).

Options

Option Default Description

Option	Default	Description
`--hours`, `-h`	`24`	Hours to look back
`--limit`, `-l`	`50`	Maximum records to return
`--mac`, `-m`	(none)	Filter by MAC address

--hours, -h

24

Hours to look back

--limit, -l

50

Maximum records to return

--mac, -m

(none)

Filter by MAC address

Usage

# Last 24 hours (default)
netapi ise dc coa-events

# Filter by MAC
netapi ise dc coa-events --mac 3C:EC:EF:43:50:42

# Last 48 hours
netapi ise dc coa-events --hours 48

Sample Output

CoA Events (last 24h)
──────────────────────────────────────────────────────────────────────────────
Time                 Status   MAC                User         Old Profile    New Profile     Trigger
──────────────────────────────────────────────────────────────────────────────
2026-01-23 10:43:21  Success  3C:EC:EF:43:50:42  jsmith       PermitAccess   Quarantine      AMP
2026-01-23 10:41:08  Success  70:15:FB:F8:47:EC  admin        Quarantine     PermitAccess    Manual

Use Cases

Track Quarantine Actions

# All CoA events with policy changes
netapi ise dc coa-events --hours 168

Investigate Endpoint

# What happened to this endpoint?
netapi ise dc coa-events --mac 3C:EC:EF:43:50:42 --hours 168

dc coa-events