ise-incident-response

Automating Cisco ISE endpoint investigation and quarantine requires gathering authentication history, posture status, and profile data, then moving the device to a quarantine VLAN after human authorization. This Skill streamlines that process by retrieving data via ISE MCP scripts and executing the isolation actions.

Yes, creating ServiceNow security incidents is supported during the endpoint quarantine process. The Skill documents the incident by generating detailed ServiceNow records and logging GAIT audit trails simultaneously when an authorized quarantine action is executed.

Risk assessment for a suspicious device in Cisco ISE requires authentication history, posture status, and endpoint profiling data. The Skill collects and compiles these specific data points into a summary to aid human decision-making before authorizing quarantine.

Yes, endpoint quarantine in ISE requires explicit human authorization before execution. The Skill facilitates risk assessment by compiling endpoint data, but only moves the device to a quarantine VLAN after a security analyst provides approval.

Integrating ISE and ServiceNow for incident response requires access to ISE_MCP_SCRIPT, SERVICENOW_MCP_SCRIPT, and GAIT_MCP_SCRIPT. These dependencies are necessary for data retrieval, manipulation, and audit trail generation during the endpoint investigation workflow.

Using an automated workflow for network endpoint security incidents streamlines the isolation of compromised devices and ensures consistent documentation. It enables rapid data collection from ISE and automatic creation of ServiceNow incidents, reducing manual effort and response time.