How can Stealthwatch mitigate threats after ISE integration?

[Support ACME]

Hello,

I want to know what additional mitigation action can Stealthwatch do once I have integrated the ISE.

I know I can manually enforce the Adaptive Network Control Policy from the Stealthwatch web console and use the TrustSec Tags as search attributes from this document.

But I really want to confirm if the ANC policy can be automatically enforced once some alarms / anomalies has been detected. I knew similar question has been answered in this post 2 years ago, but what about the recent version of Stealthwatch??

The newest Console User's Guide still say the Java console can work with ASA and routers to bring out automatic mitigation, 

it would be really strange the newer Cisco FTD is not included and the ISE mitigation is manual only. 

Thank you.

[brford · Accepted solution]

Regarding wanting to know "if the [Stealthwatch] ANC policy can be automatically enforced once some alarms / anomalies has been detected.".  No. 

Stealthwatch requires that a user select and apply an ANC policy.  There is no 'automatic' enforcement in Stealthwatch.  

[Support ACME]

Thanks for the response and the confirmation.

I kind of know the SMC Desktop client is fading out, I guess you may take the automatic mitigation and FTD support parts as feature request.

Thank you again.

[sureshot]

@Support ACME

If you still looking into this, Then there is an Update:

Now the response can be automated using below feature "Cisco Stealthwatch Response Management", on Web UI starting from 7.3 version.

More details:
https://www.youtube.com/watch?v=m0yKmFGhUpk
https://blogs.cisco.com/security/automated-response-with-cisco-stealthwatch