Cisco ISE Response Integration

Overview

The Cisco ISE integration is a containment (response) integration that is called from playbook action blocks. It lets you contain a suspicious or malicious endpoint on the network by quarantining it, removing it from quarantine, or terminating its active session.

Setting Up the Integration

Add a Cisco ISE asset from the Integrations / Assets screen and fill in the following fields.

Quarantine and Unquarantine talk to a separate External RESTful Services (ERS) API port on the same host. This defaults to 9060 and does not need to be set for most environments; if your Cisco ISE deployment runs ERS on a non-default port, contact Logsign support to have it configured.

Prerequisites on the Cisco ISE Side

Before using the integration, make sure the following are enabled on Cisco ISE:

• External RESTful Services (ERS) API and Monitoring (MnT) API access.
• Adaptive Network Control (ANC), which is used by the Quarantine and Unquarantine actions. At least one ANC policy must exist on Cisco ISE (Work Centers > TrustSec > Policy > Network Device Authorization, or Administration > System > Settings > ANC, depending on your ISE version). The integration lists these policies live and lets you pick one when you run Quarantine.
• An authorized API user that can perform these operations.

Note: older Cisco ISE integrations quarantined endpoints through the legacy Endpoint Protection Service (EPS) API. EPS was removed in ISE 2.1 and later, and current ISE versions (including 3.3) reject it outright. Quarantine and Unquarantine now use ANC over the ERS API instead; no EPS configuration is required or used.

Testing the Connection

When you save the asset, a connection test runs automatically. Because Quarantine/Unquarantine and Terminate-Session use two different Cisco ISE APIs, the test checks both independently and reports each one's status:

• MnT API: used by Terminate-Session. Confirms the Host/Port/Username/Password can reach the Monitoring API.
• ERS API: used by Quarantine/Unquarantine. Confirms ERS is reachable and the user can read ANC policies.

If either check fails, the test result names which API failed and why, for example: Cisco ISE: MnT API (terminate-session): authentication failed (HTTP 401); ERS API (quarantine/unquarantine): OK.

Available Methods and the Address Field

The integration provides three action methods. Important: the "Address" field expects a different type of value depending on the method you select, and Quarantine has two additional required fields.

Terminate-Session

This method locates the active session of an endpoint by its MAC address and terminates it.

• The Address field must contain a valid MAC address, for example AQ:6A:E5:E1:6S:2K.
• This method does not support IP addresses.
• If an IP address is entered, Cisco ISE cannot find a matching session and the action fails (shown as CANT_COMPLETE).
• If the endpoint has no active session on Cisco ISE at all, the action fails with "no active session found for the given endpoint" rather than a generic error.

Quarantine

This method places an endpoint into quarantine on Cisco ISE using Adaptive Network Control (ANC).

• You can enter either a MAC address or an IP address in the Address field. The system automatically detects whether the value is a MAC or an IP and uses the correct operation.
• You must also select an ANC Policy from a dropdown. This list is populated live from the ANC policies configured on your Cisco ISE. Create the policy on Cisco ISE first if the one you need is not in the list.
• You must set an Expire Time for the quarantine: 30 Minutes, 1 Hour, 3 Hours, 6 Hours, 12 Hours, 1 Day, 1 Week, 1 Month, or Permanent. When the expiry is reached, Logsign automatically runs Unquarantine on the same endpoint to lift the restriction. Pick Permanent only if you intend to remove it manually.
• If the value is neither a valid MAC nor a valid IP, the action returns an error indicating that the IP or MAC parameter is missing.

Unquarantine

This method removes an endpoint from quarantine (clears the ANC assignment). It accepts the Address field exactly like the Quarantine method, so you can enter either a MAC address or an IP address. It does not require an ANC Policy or Expire Time.

Frequently Asked Questions

What should I enter in the Address field?

If you selected Terminate-Session, enter a MAC address. IP addresses are not accepted for this method. If you selected Quarantine or Unquarantine, enter a MAC address or an IP address; the system detects which one you provided.

What happens if I enter an IP address for Terminate-Session?

The session is looked up by MAC address, so Cisco ISE cannot find the session and the action fails with a CANT_COMPLETE result. Always use a MAC address for Terminate-Session.

For Quarantine, both MAC and IP are accepted. Which should I use?

Both are valid. We recommend using the value that most reliably identifies the endpoint in your environment, which is usually the MAC address. If your environment tracks endpoints by IP, an IP address works as well.

Where does the ANC Policy list come from, and what if it's empty?

Logsign reads the list directly from Cisco ISE's ANC policy configuration (ERS API) each time you open the dropdown. If it's empty, no ANC policies exist yet on Cisco ISE. Create one there (Work Centers > TrustSec > Policy, or Administration > System > Settings > ANC depending on your ISE version) and it will appear in the dropdown.

Do I need to configure anything for the legacy EPS API?

No. Quarantine and Unquarantine use ANC over the ERS API. EPS is not used and does not need to be enabled. This matters mainly on ISE 3.3 and later, where EPS requests are rejected.

Common Result Messages