cancel
Showing results for 
Search instead for 
Did you mean: 
cancel

Enable Notifications for End Users for Cisco ISE Rapid Threat Containment Solutions

234
Views
5
Helpful
0
Comments

 

This document provides details on the configuration of notification for the End Users who are contained by the configured policy in Cisco ISE as part of the Rapid Thread Contained. As part of ISE containment actions (Adaptive Network Control formerly known as Endpoint protection Services) an end user could be placed in to quarantine or un-quarantine states, as a result of these actions if user is pushed in to one of the above-mentioned states, by default the end users are not notified and the user has no idea why access is blocked to a resource which was working at a point in time. In this document, the Administrator would be able to configure a URL-Redirect to notify End Users

The configurations in this document is tested with ISE and FireSIGHT management System although the same configuration same be applied to other containment solutions, e.g. ISE with Stealthwatch, ISE with Splunk etc ..