Cisco Cisco Identity Services Engine Software Manual Técnica

In order to enable debugs on ISE navigate to Administration > System > Logging > Debug Log
Configuration, select TC-NAC Node and change the Log Level of TC-NAC component to DEBUG

Logs to be checked - irf.log. You can tail it directly from ISE CLI:

ISE21-3ek/admin# show logging application irf.log tail

Threat Even is received from the AMP Cloud

2016-06-30 18:27:48,617 DEBUG [IRF-AMQP-Dispatcher-Notification-0][]