How is posture reassessment triggered

[SMD28316]

I am trying to understand what triggers posture reassessment, in my lab I tested refreshing GPO with gpupdate /force command and the anyconnect system scan restarted, this was reproduced on some computers but not all, I wonder what triggers this and how can I control it .

[marce1000]

 - FYI : https://www.cisco.com/c/en/us/td/docs/security/ise/2-2/admin_guide/b_ise_admin_guide_22/b_ise_admin_guide_22_chapter_010111.html#task_32E33C6631054F32983F532D4A2383CE

 M.

[Mike.Cifelli · Accepted solution]

-Also, take a look at this to see general reasons that trigger the discovery process: https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/215419-ise-session-management-and-posture.html#anc16

ISE posture module designed to monitor a limited amount of events on the endpoint to trigger a discovery process. List of events which trigger discovery:

• Initial ISE posture module installation.
• User login.
• Power events.
• Interface status change.
• OS resume after sleep.
• Default Gateway (DG) change. 

• New dot1x authentication, PC unlock, IP address change are not detected by the ISE posture module.

[thomas]

Consider watching

Security Compliance using ISE Posture
16:52 Posture Deployment Options
18:20 Posture Flow
19:45 Demo: AnyConnect Posture with Windows 10
34:02 Demo: AnyConnect Stealth
37:29 Demo: AnyConnect Temporal
42:04 Agentless Posture Flow
43:44 Demo: Agentless Posture

or watch the Posture Configuration Series