id: cisco_ise
name: Cisco ISE
version: 1.1.0
description: "Cisco Identity Services Engine (ERS + ANC API) — network access containment: list and read endpoints, apply an Adaptive Network Control (ANC) quarantine policy to an endpoint, and clear it. HTTP Basic authentication; stdlib-only, no extra Python dependencies."
changelog: "1.1.0 — Declare the risk tier on the 2 commands that carried none, all of them destructive. An unset risk was already gated as destructive, so the approval prompt does not move; what changes is that the tier is a stated decision rather than a default, and a command added later cannot inherit it by omission. | 1.0.0 — Initial release: list/get endpoints, apply/clear ANC policy, list ANC policies."
category: network

# Per-instance configuration. HTTP Basic auth against the ERS API (port 9060).
config_schema:
  properties:
    base_url:
      type: string
      description: "ISE URL including the ERS port (e.g. https://ise.example.com:9060)"
    username:
      type: string
      description: "ERS admin username"
    password:
      type: string
      description: "ERS admin password"
      x-soar-sensitive: true
    insecure:
      type: boolean
      description: "Trust any TLS certificate (not secure)"
      default: false
  required:
    - base_url
    - username
    - password

commands:
  - id: list_endpoints
    name: ise-list-endpoints
    description: "List endpoints (optionally filter by MAC)."
    risk: read
    inputs_schema:
      properties:
        mac: { type: string, description: "Optional MAC address filter" }
      required: []
    outputs_schema: { properties: {} }
  - id: get_endpoint
    name: ise-get-endpoint
    description: "Get an endpoint by ID."
    risk: read
    inputs_schema:
      properties:
        endpoint_id: { type: string, description: "Endpoint ID" }
      required: [endpoint_id]
    outputs_schema: { properties: {} }
  - id: apply_anc_policy
    name: ise-apply-anc-policy
    description: "Apply an ANC policy to an endpoint by MAC (quarantine — containment)."
    risk: destructive
    inputs_schema:
      properties:
        mac: { type: string, description: "Endpoint MAC address" }
        policy_name: { type: string, description: "ANC policy name (e.g. Quarantine)" }
      required: [mac, policy_name]
    outputs_schema: { properties: {} }
  - id: clear_anc_policy
    name: ise-clear-anc-policy
    description: "Clear the ANC policy from an endpoint by MAC."
    risk: destructive
    inputs_schema:
      properties:
        mac: { type: string, description: "Endpoint MAC address" }
        policy_name: { type: string, description: "ANC policy name currently applied" }
      required: [mac, policy_name]
    outputs_schema: { properties: {} }
  - id: list_anc_policies
    name: ise-list-anc-policies
    description: "List ANC policies."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }

  - id: test_connection
    name: ise-test-connection
    description: "Verify connectivity and credentials (used by the Test button)."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }