Cisco ISE v2.1.0

About the connector

Cisco Identity Services Engine (ISE) is a network administration product that enables the creation and enforcement of security and access policies for endpoint devices connected to the company's routers and switches. The purpose is to simplify identity management across diverse devices and applications.

This document provides information about the Cisco ISE connector, which facilitates automated interactions, with a Cisco ISE server using FortiSOAR™ playbooks. Add the Cisco ISE connector as a step in FortiSOAR™ playbooks and perform automated operations, such as quarantining and un-quarantining IP addresses on Cisco ISE and retrieving a list of all active sessions from Cisco ISE.

Version information

Connector Version: 2.1.0

Authored By: Community

Certified: No

Release Notes for version 2.1.0

Following enhancements have been made to the Cisco ISE connector in version 2.1.0:

• Added the following new operations and playbooks:
  • List internal users
  • Disable internal user
  • Enable internal user
  • Get internal user details
  • List guest users
  • Get guest user details
  • Suspend guest user
  • Reinstate guest users

Installing the connector

Use the Content Hub to install the connector. For the detailed procedure to install a connector, click here.

You can also use the following yum command as a root user to install connectors from an SSH session:

yum install cyops-connector-cisco-ise

Prerequisites to configuring the connector

• You must have the URL of the Cisco ISE server to which you will connect and perform automated operations and credentials (username-password pair) to access that server.
• The FortiSOAR™ server should have outbound connectivity to port 443 on the Cisco ISE server.

Minimum Permissions Required

• Not Applicable.

Configuring the connector

For the procedure to configure a connector, click here

Configuration parameters

In FortiSOAR™, on the Content Hub (or Connector Store) page, click the Manage tab, and then click the Cisco ISE connector card. On the connector popup, click the Configurations tab to enter the required configuration details.

Actions supported by the connector

The following automated operations can be included in playbooks, and you can also use the annotations to access operations:

operation: List All Active Sessions

Input parameters

None.

Output

The output contains the following populated JSON schema:
{
"request_status": "",
"result": {}
}

operation: EPS: Quarantine IP Address

Input parameters

Output

The output contains the following populated JSON schema:
{
"request_status": "",
"result": {}
}

operation: EPS: Quarantine MAC Address

Input parameters

Output

The output contains the following populated JSON schema:
{
"request_status": "",
"result": {}
}

operation: EPS: Un-Quarantine IP Address

Input parameters

Output

The output contains the following populated JSON schema:
{
"request_status": "",
"result": {}
}

operation: EPS: Un-Quarantine MAC Address

Input parameters

Output

The output contains the following populated JSON schema:
{
"request_status": "",
"result": {}
}

operation: End a Target MAC Address Session

Input parameters

Output

The output contains the following populated JSON schema:
{
"request_status": "",
"result": {}
}

operation: MAC Address Logout

Input parameters

Output

The output contains the following populated JSON schema:
{
"request_status": "",
"result": {}
}

operation: Get Endpoints

Input parameters

Note: All the input parameters are optional. However, if you do not specify any parameter, then no filter criterion is applied, and an unfiltered list is returned.

Output

The output contains the following populated JSON schema if you do not specify any endpoint name or ID for the 'Get Endpoint By' operation:
{
"SearchResult": {
"resources": [
{
"link": {
"type": "",
"rel": "",
"href": ""
},
"id": "",
"name": ""
}
],
"total": ""
}
}

The output contains the following populated JSON schema if you have specified an endpoint name or ID for the 'Get Endpoint By' operation:

{
"ERSEndPoint": {
"identityStore": "",
"id": "",
"portalUser": "",
"description": "",
"staticGroupAssignment": "",
"staticProfileAssignment": "",
"groupId": "",
"link": {
"type": "",
"rel": "",
"href": ""
},
"profileId": "",
"mac": "",
"identityStoreId": "",
"name": ""
}
}

operation: Get ANC Endpoint

Input parameters

Note: All the input parameters are optional. However, if you do not specify any parameter, then no filter criterion is applied, and an unfiltered list is returned.

Output

The output contains the following populated JSON schema if you do not specify any endpoint ID for the 'Get ANC Endpoint' operation:
{
"SearchResult": {
"resources": [
{
"link": {
"type": "",
"rel": "",
"href": ""
},
"id": ""
}
],
"total": ""
}
}

The output contains the following populated JSON schema if you have specified an endpoint ID for the 'Get ANC Endpoint' operation:

{
"ErsAncEndpoint": {
"link": {
"type": "",
"rel": "",
"href": ""
},
"policyName": "",
"id": "",
"macAddress": ""
}
}

operation: Create ANC Policy

Input parameters

Output

The output contains the following populated JSON schema:

{
"request_status": "",
"result": {}
}

operation: Get ANC Policy

Input parameters

Note: All the input parameters are optional. However, if you do not specify any parameter, then no filter criterion is applied, and an unfiltered list is returned.

Output

The output contains the following populated JSON schema if you do not specify any policy name or ID for the 'Get ANC Policy' operation:
{
"SearchResult": {
"resources": [
{
"link": {
"type": "",
"rel": "",
"href": ""
},
"id": "",
"name": ""
}
],
"total": ""
}
}

The output contains the following populated JSON schema if you have specified a policy name or ID for the 'Get ANC Policy' operation:

{
"ErsAncPolicy": {
"link": {
"type": "",
"rel": "",
"href": ""
},
"actions": [],
"id": "",
"name": ""
}
}

operation: Assign ANC Policy

Input parameters

Output

The output contains the following populated JSON schema:
{
"request_status": "",
"result": {}
}

operation: Revoke ANC Policy

Input parameters

Output

The output contains the following populated JSON schema:
{
"request_status": "",
"result": {}
}

operation: Get Internal User Details

Input parameters

Output

The output contains the following populated JSON schema:
{
"InternalUser": {
"id": "",
"link": {
"rel": "",
"href": "",
"type": ""
},
"name": "",
"enabled": "",
"lastName": "",
"password": "",
"firstName": "",
"changePassword": "",
"identityGroups": "",
"passwordIDStore": "",
"customAttributes": {
"Static-IPv4-Addr": ""
},
"expiryDateEnabled": ""
}
}

operation: List Internal Users

Input parameters

Note: All the input parameters are optional. However, if you do not specify any parameter, then no filter criterion is applied, and an unfiltered list, i.e., a list of all internal users, is returned.

Output

The output contains the following populated JSON schema:
{
"SearchResult": {
"total": "",
"nextPage": {
"rel": "",
"href": "",
"type": ""
},
"resources": [
{
"id": "",
"link": {
"rel": "",
"href": "",
"type": ""
},
"name": ""
}
]
}
}

operation: Disable Internal User

Input parameters

Output

The output contains the following populated JSON schema:
{
"UpdatedFieldsList": {
"updatedField": [
{
"field": "",
"newValue": "",
"oldValue": ""
}
]
}
}

operation: Enable Internal User

Input parameters

Output

The output contains the following populated JSON schema:
{
"UpdatedFieldsList": {
"updatedField": [
{
"field": "",
"newValue": "",
"oldValue": ""
}
]
}
}

operation: List Guest Users

Input parameters

Note: All the input parameters are optional. However, if you do not specify any parameter, then no filter criterion is applied, and an unfiltered list, i.e., a list of all guest users, is returned.

Output

The output contains the following populated JSON schema:
{
"SearchResult": {
"total": "",
"resources": [
{
"id": "",
"name": "",
"description": "",
"link": {
"rel": "",
"href": "",
"type": ""
}
}
]
}
}

operation: Get Guest User Details

Input parameters

Output

The output contains the following populated JSON schema:
{
"GuestUser": {
"id": "",
"name": "",
"description": "",
"guestType": "",
"sponsorUserName": "",
"guestInfo": {
"userName": "",
"emailAddress": "",
"phoneNumber": "",
"password": "",
"enabled": "",
"smsServiceProvider": ""
},
"guestAccessInfo": {
"validDays": "",
"fromDate": "",
"toDate": "",
"location": ""
},
"portalId": "",
"customFields": {
"another key": "",
"some key": ""
},
"link": {
"rel": "",
"href": "",
"type": ""
}
}
}

operation: Suspend Guest User

Input parameters

Output

The output contains the following populated JSON schema:

The output contains a non-dictionary value.

operation: Reinstate Guest User

Input parameters

Output

The output contains the following populated JSON schema:

The output contains a non-dictionary value.

Included playbooks

The Sample - Cisco ISE - 2.1.0 playbook collection comes bundled with the Cisco ISE connector. This playbook contains steps using which you can perform all supported actions. You can see the bundled playbooks in the Automation > Playbooks section in FortiSOAR™ after importing the Cisco ISE connector.

• Assign ANC Policy
• Create ANC Policy
• Disable Internal User
• EPS: Quarantine IP Address
• EPS: Quarantine MAC Address
• EPS: Un-Quarantine IP Address
• EPS: Un-Quarantine MAC Address
• Enable Internal User
• End a Target MAC Address Session
• Get ANC Endpoint
• Get ANC Policy
• Get Endpoints
• Get Guest User Details
• Get Internal User Details
• List All Active Sessions
• List Guest Users
• List Internal Users
• MAC Address Logout
• Reinstate Guest User
• Revoke ANC Policy
• Suspend Guest User

Note: If you are planning to use any of the sample playbooks in your environment, ensure that you clone those playbooks and move them to a different collection since the sample playbook collection gets deleted during the connector upgrade and delete.