ISE Posturing Remedations

[Daniel Lucas]

For the automatic AV and WSUS automatic remediation what specifically is the compliance module doing? I am assuming the compliance module enables some update service? Config guide isn't very detailed as far as what exactly happens:

"You can configure Windows clients to receive the latest WSUS updates from a locally administered or a Microsoft-managed WSUS server for compliance."

"You can create an antivirus remediation, which updates clients with up-to-date file definitions for compliance after remediation"

-Thanks

[howon · Accepted solution]

Compliance module includes support for all 3rd party agent s/w such as Anti-X applications and how to interface with them. So if one creates a posture policy to check AV DAT update, AnyConnect posture module knows how to invoke AV application on the endpoint to check the status and determine whether it is compliant or not. It also includes instructions on how to remediate by issuing command to the AV to get update without user intervention. It includes DB or lot more than just AV app, but wanted to provide as an example. As new applications are introduced and and updated, AnyConnect also needs to be updated to support new applications and that is why updated compliance module is required. Here is list of latest supported apps:

https://www.cisco.com/c/en/us/td/docs/security/ise/anyconnect_support_chart/Cisco_AnyConnect_ISE_Posture_Win_Support_Charts_for_Compliance_Module_4_3_562_6144.html