TC-NAC with AMP

[tetsato]

Hi Experts,

I configured TC-NAC with AMP following by the link below and ISE shows AMP threat detection correctly.

http://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/200550-Configure-ISE-2-1-Threat-Centric-NAC-TC.html

Now my questions are:

Can ISE quarantine PC which AMP detected a threat automatically??

Can ISE see AMP's vulnerable software events??

Thanks,

Tetsuya

[hslai]

At present, there is no usable/actionable threat attributes from AMP to trigger re-auth automatically.

Regarding the vulnerable software events, do you mean the event type "vulnerable application detected"? I found a screenshot with that type of events so it seems included.

[hslai]

On AMP events, I received the following from our teams

These are the types of IoC published by AMP including “vulnerable application detected”. TC_NAC receive this list dynamically from AMP via API.

[tetsato]

Hi

Thank you very much for the info.

I tested with ISE 2.1.0.474 and connected to AMP cloud.

It looks ISE can receive AMP malware detection events but not “vulnerable application detected” event.

Can you please confirm??