3rd party agent integration for USB memory insertion event capture

[cdursun]

Hi All,

One of my military customers is asking for an integration with their DLP agent. At the end of the day the scenario is; ISE to block the network connection of a previously authorized user's PC at the time any USB device/memory inserted.

Is there any such function/feature with ISE to implement this?

Regards

Cafer Dursun

[Jason Kunst · Accepted solution]

ISE posture module system scan already supports this

https://www.google.com/search?q=ise%20usb%20check%20posture

https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/200508-Configure-ISE-2-1-and-AnyConnect-4-3-Pos.html

If they would like direct integration with their special agent then they could possibly write their own custom checks using existing mechanisms such as register service file checks

Otherwise please reach out to ISE product management team if you need any further integration

[cdursun]

Thank you for sharing the google search link.... I think it is not the exact scenario, I will get some details and check, if that fits them.

Thank you

[Jason Kunst]

There are several discussions in google Search

The 2nd link is how it works with our posture module, or you can look into the other options

if they want custom special integration that won’t fit this then likely you will need to ask the ise the ISE product manager kegagnon