Quarantine Endpoint

This workflow quarantines an endpoint in Cisco Identity Services Engine (ISE) by applying an Adaptive Network Control (ANC) policy. Supported observable: mac_address

GitHub

---

Change Log

See the Important Notes page for more information about updating workflows

---

Requirements

• The following system atomics are used by this workflow:
  • ISE - ERS - ANC Policy - Apply to Endpoint
• The following atomic actions must be imported before you can import this workflow:
  • None
• The targets and account keys listed at the bottom of the page
• Cisco Identity Services Engine (ISE)

---

Workflow Steps

1. Make sure the observable type provided is supported
2. Apply the ANC policy to the endpoint

---

Configuration

• Set the ANC Policy Name local variable to the name of the ANC policy to apply
• If you want to change the name of this workflow in the pivot menu, change its display name

---

Targets

Note: If your Cisco ISE deployment is on-premises and not accessible from the internet, you will need a SecureX orchestration remote to use ISE with orchestration.

Target Group: Default TargetGroup

---

Account Keys

---