topic Re: 3rd party agent integration for USB memory insertion event capture in Network Access Control

3rd party agent integration for USB memory insertion event capture

cdursun — Mon, 25 Dec 2017 06:45:57 GMT

Hi All,

One of my military customers is asking for an integration with their DLP agent. At the end of the day the scenario is; ISE to block the network connection of a previously authorized user's PC at the time any USB device/memory inserted.

Is there any such function/feature with ISE to implement this?

Regards

Cafer Dursun

Re: 3rd party agent integration for USB memory insertion event capture

Jason Kunst — Mon, 25 Dec 2017 15:49:23 GMT

ISE posture module system scan already supports this

https://www.google.com/search?q=ise%20usb%20check%20posture

https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/200508-Configure-ISE-2-1-and-AnyConnect-4-3-Pos.html

If they would like direct integration with their special agent then they could possibly write their own custom checks using existing mechanisms such as register service file checks

Otherwise please reach out to ISE product management team if you need any further integration

Re: 3rd party agent integration for USB memory insertion event capture

cdursun — Mon, 25 Dec 2017 19:21:33 GMT

Thank you for sharing the google search link.... I think it is not the exact scenario, I will get some details and check, if that fits them.

Thank you

Re: 3rd party agent integration for USB memory insertion event capture

Jason Kunst — Mon, 25 Dec 2017 21:07:11 GMT

There are several discussions in google Search

The 2nd link is how it works with our posture module, or you can look into the other options

if they want custom special integration that won’t fit this then likely you will need to ask the ise the ISE product manager kegagnon