Cisco ISE Queries

[SHABEEB KUNHIPOCKER]

Hello Guys,

One of my customers has the below posture requirements.

1. Check if a particular AV is installed, if not send an email to service desk and block the PC's network access.

2. Check for missing patches (by integrating with Manage Engine) and send an email to service desk if any endpoint fails the check.

3. Check if a particular AV is running, if not send an email to service desk and block the PC's network access.

4. Check if a particular AV signature is not older than 7 days, if not send an email to service desk and block the PC's network access.

5. Check for non-domain PC and block the access if detected.

Kindly let me know whether these are possible. My major concerns are related to the email notification upon posture failure and the integration with Manage Engine to check for missing patches.

Thanks

Shabeeb

[ammahend]

Posture part should be simple, ise does support smtp integration with alarm based on authorization result, I haven’t configured it first hand but go through this link, shouldn’t be hard to figure out. 

https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine-software/217587-configure-alarms-based-on-authorization.html