Cisco ISE AMP for endpoints Integration

[dijeshkeloth]

Hi,

The cisco ISE 2.7 is integrated to amp for endpoints. I would like to block endpoints that are compromised. I can see compromised endpoints in ISE with severity level as painful. Is there anyway to block these endpoints in ISE?

Thanks,

[dijeshkeloth]

Is there anyway to do automatic quarantine rather than manual in cisco ISE?

Thanks,

[Marvin Rhoads · Accepted solution]

Yes. The feature is known as Threat-Centric NAC or TC-NAC. It requires Apex licensing but is otherwise relatively easy to setup. Please see the following section of the admin guide:

https://www.cisco.com/c/en/us/td/docs/security/ise/2-7/admin_guide/b_ise_27_admin_guide/b_ISE_admin_27_threat_containment.html

There are some other resources in the following as well:

https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/200550-Configure-ISE-2-1-Threat-Centric-NAC-TC.html

https://www.youtube.com/watch?v=VhfAM7KXOl0

[dijeshkeloth]

Thanks for your resources. It does not quarantine any compromised endpoint automatically. It needs to be done manually. Is there anyway to do automatic quarantine with ISE policy?

[Marvin Rhoads · Accepted solution]

If you combine Rapid Threat Containment (RTC) with Adaptive Network Control (ANC) it can automatically quarantine the endpoint in ISE upon receipt of an AMP event.

Here's an example:

https://github.com/chrivand/cisco_rapid_threat_containment