ise-incident-response

What problem does it solve?

This Skill streamlines the process of investigating potentially compromised network endpoints managed by Cisco ISE, enabling rapid isolation and documentation of security incidents.

Core Features & Use Cases

• Endpoint Investigation: Gathers detailed information on endpoints, including authentication history, posture status, and profiling.
• Risk Assessment: Compiles findings into a clear summary to aid human decision-making.
• Authorized Quarantine: Facilitates the quarantine of endpoints in ISE only after explicit human authorization.
• Incident Documentation: Creates detailed security incidents in ServiceNow and logs actions in GAIT.
• Use Case: When a security alert flags a suspicious device, this Skill can quickly pull all relevant data from ISE, present it to a security analyst, and, upon approval, move the device to a quarantine VLAN.

Quick Start

Use the ise-incident-response skill to investigate endpoint MAC address AA:BB:CC:DD:EE:FF.