Are Apex licenses required if Phantom or MSFT issues the request for CoA to ISE?

[ccowan]

I have a customer that wants to use Phantom or MSFT for posture and ISE for basic NAC and CoA if directed by Phantom or MSFT.  Will this still require an APEX license or will a plus license w PXGrid suffice?

Thanks

[Greg Gibbs]

AFAIK, Phantom mainly uses the REST API to communicate with ISE. There is some pxGrid capability available in the Splunk Add-On for ISE (as per Identity Services Engine and Splunk pxGrid Configuration Guide), but these would likely be utilised for different use cases.

For these functions, the Base and Plus (REST API, pxGrid, and ANC) licenses should suffice.

If the customer wants to leverage MS SCCM integration to check Compliance of Windows endpoints, this would leverage the MDM/DDM integration. For that, the Apex license would be required.

Cheers,

Greg