topic Re: ISE Remediation Automatic Install in Network Access Control

ISE Remediation Automatic Install

mnpattan — Wed, 11 Apr 2018 05:59:55 GMT

I’m working with a customer to explore the ISE remediation options. The customer’s requirement is for ISE to be able to install an agent (SCCM, ePO, MBAM, etc.) when the respective install posture condition fails. I see we have options to download the exe using the “File Remediation” and launch the exe using the “Launch Program Remediation”, but I do not see an option to have these executed in sequence within a requirement.

The customer is also looking for programs/scripts to be launched using a SYSTEM account, as the user accounts may not have the privileges.

I’m trying to find if anyone has been able to do something similar for any customers. Any pointers would be of great help.

Re: ISE Remediation Automatic Install

hslai — Sun, 15 Apr 2018 20:42:16 GMT

When a matched ISE posture policy rule has more than one requirements, they are run in sequence.

For example from our lab guide on Compliance, the AV install requirement will be checked before the AV definition as below.

Rule Name	ID Groups	OS	CM	Other Conditions		Requirements
Employee Windows AV installed and current	Any	Windows 7 (All)	3.x or earlier	demoAD:ExternalGroups EQUALS demo.local/HCC/Groups/Employees	P	ClamWin AV Installation Win7
Employee Windows AV installed and current	Any	Windows 7 (All)			P	ClamWin AV Current Win7
Guest Windows AV installed and current	Any	Windows All	3.x or earlier	Network Access:UseCase EQUALS Guest Flow	P	Any_AV_Installation_Win
Guest Windows AV installed and current	Any	Windows All		Network Access:UseCase EQUALS Guest Flow	P	Any_AV_Definition_Win