I work for Cisco partner - one our customer is very interesting in integration ISE and QRadar - both products is now used in his network. He would like to use his CIEM system (or QRadar) to be able to initialize blocking or quarantining some host (with security risk behaviour). I check the ISE REST API and it seems to me it could be quite easy to put the endpoint ID (MAC address) to some Endpoint Group (like Security Incident) and setup general authorization exception, which set apropriate result for the endpoint (SGT, VLAN DACL..).
But I will need also to initialize some endpoint reauthentication - or CoA ??. Is it possible to initialize this by ISE REST API - in case not, is there any other way how to manage this?
Thank you
