topic Re: ISE Posture check in Network Access Control

ISE Posture check

babalao — Mon, 15 Jul 2024 16:16:22 GMT

Hello,

We are implementing ISE posture check.

I did not find how to check the following, please if it possible with ISE let me know:

1- Check if the antimalware software ran a succsesful scan it the past x days.

2- check if the PC is not conected to an OPEN WIFI network.

thank you

Re: ISE Posture check

ahollifield — Mon, 15 Jul 2024 17:57:03 GMT

Depends on the antimalware software. https://community.cisco.com/t5/security-knowledge-base/ise-posture-prescriptive-deployment-guide/ta-p/3680273
https://www.cisco.com/c/en/us/td/docs/security/ise/ac_compliance_module/cisco-anyconnect-ise-posture-windows-support-charts-for-compliance-module-v4-3-4114-8192.html
This is handled via the endpoint itself, not ISE. Best to use GPO, MDM, or Cisco Secure Client NAM to control this.

Re: ISE Posture check

babalao — Mon, 15 Jul 2024 18:43:14 GMT

Hello,

I do not see anything about a antimalware SCAN on this docs.

I mean if I can check based on a scan not malware definitions (date,latest).

Thank you.

Re: ISE Posture check

ahollifield — Mon, 15 Jul 2024 19:04:55 GMT

I see what you are asking now. I'm not aware of a way to check for most recent scan.

Re: ISE Posture check

babalao — Wed, 17 Jul 2024 17:33:10 GMT

Ok, I guess it is not possible with ISE.

Thanks.

Re: ISE Posture check

Marcelo Morais — Sat, 20 Jul 2024 05:09:54 GMT

Hi @babalao ,

please check the Posture Condition Script Support (ISE 3.2+).

Administrator can run a script as a "Posture Condition" (at Policy > Policy Elements > Conditions > Posture > Script) to check against Windows, macOS and Linux OS (PowerShell, SHELL and SHELL respectively).

For Antimalware Scan ...

Check if you can "monitor" your Antimalware update via PowerShell/Shell script, checking the Antimalware log files, for ex: C:\ProgramData\<Antimalware>\Updatelog.txt.

Try to use a script like this (if possible):

Select-String -Path C:\ProgramData\<Antimalware>\Updatelog.txt -Pattern Updated

For "Open WiFi" ...

Check if you are able to use the following command in a PowerShell/Shell script:

PS> Get-NetIPConfiguration

Hope this helps !!!