feat(cisco-ise): new Cisco ISE NAC integration

ISE ERS + ANC API, 6 commands: list/get endpoints, apply/clear ANC policy (quarantine containment), list ANC policies. HTTP Basic auth, stdlib-only. py_compile clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-12 21:59:07 +02:00
parent 232e310f77
commit a4241a5a5d
7 changed files with 483 additions and 0 deletions
@@ -0,0 +1,83 @@
+id: cisco_ise
+name: Cisco ISE
+version: 1.0.0
+description: "Cisco Identity Services Engine (ERS + ANC API) — network access containment: list and read endpoints, apply an Adaptive Network Control (ANC) quarantine policy to an endpoint, and clear it. HTTP Basic authentication; stdlib-only, no extra Python dependencies."
+changelog: "1.0.0 — Initial release: list/get endpoints, apply/clear ANC policy, list ANC policies."
+category: network
+
+# Per-instance configuration. HTTP Basic auth against the ERS API (port 9060).
+config_schema:
+  properties:
+    base_url:
+      type: string
+      description: "ISE URL including the ERS port (e.g. https://ise.example.com:9060)"
+    username:
+      type: string
+      description: "ERS admin username"
+    password:
+      type: string
+      description: "ERS admin password"
+      x-soar-sensitive: true
+    insecure:
+      type: boolean
+      description: "Trust any TLS certificate (not secure)"
+      default: false
+  required:
+    - base_url
+    - username
+    - password
+
+commands:
+  - id: list_endpoints
+    name: ise-list-endpoints
+    description: "List endpoints (optionally filter by MAC)."
+    risk: read
+    inputs_schema:
+      properties:
+        mac: { type: string, description: "Optional MAC address filter" }
+      required: []
+    outputs_schema: { properties: {} }
+  - id: get_endpoint
+    name: ise-get-endpoint
+    description: "Get an endpoint by ID."
+    risk: read
+    inputs_schema:
+      properties:
+        endpoint_id: { type: string, description: "Endpoint ID" }
+      required: [endpoint_id]
+    outputs_schema: { properties: {} }
+  - id: apply_anc_policy
+    name: ise-apply-anc-policy
+    description: "Apply an ANC policy to an endpoint by MAC (quarantine — containment)."
+    inputs_schema:
+      properties:
+        mac: { type: string, description: "Endpoint MAC address" }
+        policy_name: { type: string, description: "ANC policy name (e.g. Quarantine)" }
+      required: [mac, policy_name]
+    outputs_schema: { properties: {} }
+  - id: clear_anc_policy
+    name: ise-clear-anc-policy
+    description: "Clear the ANC policy from an endpoint by MAC."
+    inputs_schema:
+      properties:
+        mac: { type: string, description: "Endpoint MAC address" }
+        policy_name: { type: string, description: "ANC policy name currently applied" }
+      required: [mac, policy_name]
+    outputs_schema: { properties: {} }
+  - id: list_anc_policies
+    name: ise-list-anc-policies
+    description: "List ANC policies."
+    risk: read
+    inputs_schema:
+      properties: {}
+      required: []
+    outputs_schema: { properties: {} }
+
+  - id: test_connection
+    name: ise-test-connection
+    description: "Verify connectivity and credentials (used by the Test button)."
+    risk: read
+    inputs_schema:
+      properties: {}
+      required: []
+    outputs_schema: { properties: {} }