This document is for Cisco Engineers, McAfee Engineers, partners and customers deploying McAfee Data Exchange Layer (DXL) Broker 4.0., McAfee ePolicy Orchestrator (ePO 5.9) with Cisco Platform Exchange Grid (pxGrid) using Cisco Identity Services Engine (ISE 2.3). This document illustrates the steps required to configure the use cases below. This document also includes the following use cases: n An Eicar Virus is detected on the endpoint, McAfee ePO generates an automated response where the McAfee DXL broker triggers an ISE pxGrid Adaptive Network Control (ANC) mitigation action, quarantining the endpoint in ISE. This is a basic use case and illustrates the integration between McAfee DXL broker and Cisco ISE pxGrid node. n The McAfee DXL broker python client receives ISE ANC “quarantined policy” notifications through Cisco pxGrid and McAfee ePO assigns a policy tag of “quarantined” to the endpoint when a violation in the ISE ANC policy occurs. Once this endpoint has been tagged by McAfee ePO, McAfee ePO can take manual action as defied by the McAfee ePO admin. This use case is more advanced and is optional. n The endpoint does not have the McAfee agent installed, ISE posture will detect this, and deem the endpoint non-compliant. A remediation link will be provided to the end-user via ePO to download and install the application. Once ISE detects that the McAfee ePO is installed, the endpoint is now compliant and granted full network access. This use case is more advanced and is optional n An employee-owned laptop goes through the organization’s on-boarding process to satisfy the organization’s BYOD initiative. The EPO admin can then install on the endpoint centrally or manually by the by the end- user. This use case is more advanced and is optional ... View more

This VOD provides a demonstration of the integration between ISE and CTA.  This illustrates a use-case of an end-user downloading malware, triggering a CTA incident, and ISE receiving these events and triggering Change of Authorization policy. ... View more

This document is intended for Cisco Engineers and customers integrating CTA (Cognitive Threat Analytics) with Cisco Identity Services Engine (ISE 2.2) using Cisco Web Security Appliance (WSA).  Supported WSA Async images are: WSA8.5.1 GD, WSA 8.0.8, WSA 7.7.5 and 9.1.1-074 and supported WSA hardware: WSA-S100V, WSA S160, and WSA 5300V and Virtual WSA.  ISE requires an APEX license for the ability to subscribe to CTA cloud instance. The readers should have some familiarity with ISE and WSA and it is assumed that all the licenses have been installed and the reader has accounts on the Cisco CTA cloud instance. CTA leverages WSA telemetry to identify security breaches or identity infected devices leveraging web traffic behavior analysis, machine learning and anomaly detection. These incidents are then reported to ISE using MITRE’s Trusted Automated eXchange of Indicator Information (TAXII) as the transport protocol and reported incidents are in Structured Threat Information eXpression (STIX) language format and integrates with ISE via the Incident Response Feed (IRF) CTA adapter. This provides visibility into the compromised endpoints in ISE.  The ISE admin can take Adaptive Network Control (ANC) mitigation actions to automatically quarantine these compromised endpoints by configuring ISE CTA Course of Action authorization policies limiting network access or assigned Security Group Tags (SGT) or manually quarantining the endpoint by assigning the compromised endpoint to an ISE ANC quarantine policy. ... View more

This document is for Cisco Engineers and customers deploying Cisco Stealthwatch 6.9 with Cisco Identity Service Engine (ISE 2.2 using Cisco platform Exchange Grid (pxGrid).   The reader should have some similarity with ISE and Cisco Stealthwatch and pxGrid. Cisco Stealthwatch 6.9 no longer requires syslog information for obtaining contextual information, instead pxGrid is used.  The Cisco Stealthwatch Management Console will register as a pxGrid client and subscribe the ISE pxGrid node Session Directory topic to obtain the contextual information. ISE 2.2 features an internal Certificate Authority (CA) for deploying pxGrid certificates. These pxGrid client certificates can be generated from ISE in either PEM or PKCS12 formats and imported into the Stealthwatch SSL Client store and ISE internal CA root certificate imported into the Stealthwatch CA store.  Additionally, certificates can be generated based on the Certificate Signing Requests (CSR).  These scenarios will be covered in this document. This document starts using the preferred method of using the ISE 2.2 Internal CA for deploying pxGrid and Stealthwatch 6.9 using PKCS12 certificate format and then covers an external CA server deployment. Self-signed certificate deployments and other ISE 2.2 internal CA configurations are covered under the Other Configurations Section. ... View more