pxGrid and automatic quarantine

[dgaikwad]

Hello There,

We are setting up a lab, integrating QRadar and Cisco ISE with pxGrid.
With this configuration we would be able to quarantine the endpoints from QRadar, which would be a manual way of doing it.
I was going over some APIs to see if this could be automated, if there is a possibility.

But, there is not much of information. So, the question is that, is this something that could be achieved with customization?
Or is this something that is not at all supported when it comes to pxGrid?

[Jason Kunst · Accepted solution]

The vendor can choose how they want to implement the ANC action, adaptive network control.

You can write your own script using the pxgrid api for this if you like. I would recommend checking out the opportunities in devnet

https://developer.cisco.com/site/pxgrid/

Specifically the security track has examples
https://developer.cisco.com/site/security/

[hslai]

Jason Kunst is correct on this. You might be also interested in Advanced Security Integration, Tips & Tricks - BRKSEC-3557, which demonstrated some example.