soar
Cisco ISE
Splunk SOAR Cloud
Splunk Built
Overview
This app implements investigative and containment actions on a Cisco ISE device
Supported Actions Version 3.1.0
- test connectivity: Validate the asset configuration for connectivity. This action logs into the device using a REST API call to check the connection and credentials
- list endpoints: List the endpoints configured on the system
- get device info: Get information about a specific endpoint
- update device info: Update information or attributes for a specific endpoint
- list sessions: List the sessions currently available on the Monitoring node
- terminate session: Terminate sessions
- list resources: Lists all the resources configured on the system of a particular resource
- get resources: Get the information about resource if resource_id is provided. Fetch the list of resources match with the key-value filter
- delete resource: Delete a resource
- create resource: Create a resource
- update resource: Update a resource
- apply policy: Apply policy on selected Ip address or MAC address
- clear policy: Clear policy on selected Ip address or MAC address
- list policies: Lists all the ANC policies available
- add policy: Add a new ANC Policy
- delete policy: Delete a policy
Supported Actions Version 3.0.2
- test connectivity: Validate the asset configuration for connectivity. This action logs into the device using a REST API call to check the connection and credentials
- list endpoints: List the endpoints configured on the system
- get device info: Get information about a specific endpoint
- update device info: Update information or attributes for a specific endpoint
- list sessions: List the sessions currently available on the Monitoring node
- terminate session: Terminate sessions
- list resources: Lists all the resources configured on the system of a particular resource
- get resources: Get the information about resource if resource_id is provided. Fetch the list of resources match with the key-value filter
- delete resource: Delete a resource
- create resource: Create a resource
- update resource: Update a resource
- apply policy: Apply policy on selected Ip address or MAC address
- clear policy: Clear policy on selected Ip address or MAC address
- list policies: Lists all the ANC policies available
- add policy: Add a new ANC Policy
- delete policy: Delete a policy
Supported Actions Version 3.0.1
- test connectivity: Validate the asset configuration for connectivity. This action logs into the device using a REST API call to check the connection and credentials
- list endpoints: List the endpoints configured on the system
- get device info: Get information about a specific endpoint
- update device info: Update information or attributes for a specific endpoint
- list sessions: List the sessions currently available on the Monitoring node
- terminate session: Terminate sessions
- list resources: Lists all the resources configured on the system of a particular resource
- get resources: Get the information about resource if resource_id is provided. Fetch the list of resources match with the key-value filter
- delete resource: Delete a resource
- create resource: Create a resource
- update resource: Update a resource
- apply policy: Apply policy on selected Ip address or MAC address
- clear policy: Clear policy on selected Ip address or MAC address
- list policies: Lists all the ANC policies available
- add policy: Add a new ANC Policy
- delete policy: Delete a policy
Supported Actions Version 3.0.0
- test connectivity: Validate the asset configuration for connectivity. This action logs into the device using a REST API call to check the connection and credentials
- list endpoints: List the endpoints configured on the system
- get device info: Get information about a specific endpoint
- update device info: Update information or attributes for a specific endpoint
- list sessions: List the sessions currently available on the Monitoring node
- terminate session: Terminate sessions
- list resources: Lists all the resources configured on the system of a particular resource
- get resources: Get the information about resource if resource_id is provided. Fetch the list of resources match with the key-value filter
- delete resource: Delete a resource
- create resource: Create a resource
- update resource: Update a resource
- apply policy: Apply policy on selected Ip address or MAC address
- clear policy: Clear policy on selected Ip address or MAC address
- list policies: Lists all the ANC policies available
- add policy: Add a new ANC Policy
- delete policy: Delete a policy
Supported Actions Version 2.0.5
- test connectivity: Validate the asset configuration for connectivity. This action logs into the device using a REST API call to check the connection and credentials
- list endpoints: List the endpoints configured on the system
- get device info: Get information about a specific endpoint
- update device info: Update information or attributes for a specific endpoint
- list sessions: List the sessions currently available on the Monitoring node
- quarantine device: Quarantine the device
- unquarantine device: Unquarantine the device
- terminate session: Terminate sessions
- list resources: Lists all the resources configured on the system of a particular resource
- get resources: Get the information about resource if resource_id is provided. Fetch the list of resources match with the key-value filter
- delete resource: Delete a resource
- create resource: Create a resource
- update resource: Update a resource
- apply policy: Apply policy on selected Ip address or MAC address
- clear policy: Clear policy on selected Ip address or MAC address
Supported Actions Version 1.2.17
- test connectivity: Validate the asset configuration for connectivity. This action logs into the device using a REST API call to check the connection and credentials.
- list sessions: List the sessions currently available on the Monitoring node.
- quarantine device: Quarantine the device
- unquarantine device: Unquarantine the device
- terminate session: Terminate sessions
Release Notes
Version 3.1.0
June 13, 2024
- Fixed pagination logic for 'list resources' action [PAPP-33229]
Version 3.0.2
Dec. 22, 2023
- Updated requests and certifi dependencies in order to use platform packages [PAPP-30822,PAPP-31096]
Version 3.0.1
March 12, 2022
- Minor fix in app documentation
Version 3.0.0
March 4, 2022
- Added support for 'add policy', 'delete policy' and 'list policies' action. [PAPP-22978]
- Removed 'quarantine system' and 'unquarantine system' actions. [PAPP-23977]
- Changed asset configuration to support 'MnT Admin' and 'ERS Admin' admin groups in admin credentials. [PAPP-24134]
- Updated documentation for the app
Version 2.0.5
Dec. 22, 2021
Cisco ISE Release Notes - Published by Phantom December 21, 2021
Version 2.0.5 - Released December 21, 2021
- Compatibility changes for Python 3 support [PAPP-19196]
- Add new optional asset configuration parameters 'ers_user' and 'ers_password'
- Add new optional asset configuration parameter 'ha_device' for secondary node [PAPP-21216]
- Updated logo for the app
- Updated documentation for the app [PAPP-9112]
- Added support for the below mentioned actions:
- list resources [PAPP-8694]
- get resources [PAPP-8693]
- create resource [PAPP-8697]
- update resource [PAPP-8695]
- delete resource [PAPP-8696]
- apply policy
- clear policy
- list endpoints
- get device info
- update device info
Version 1.2.17
Sept. 21, 2021
Cisco ISE Release Notes - Published by Phantom February 07, 2018
Version 1.2.17 - Released February 07, 2018
- App action views and Logo updates