When endpoints fail the policy assessment, the Cisco ISE must create a record with sufficient detail suitable for forwarding to a remediation server for automated remediation or sending to the user for manual remediation.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-242585	CSCO-NC-000110	SV-242585r714065_rule		Medium

Description
Failing the NAC assessment means that an unauthorized machine has attempted to access the secure network. Without generating log records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident, or identify those responsible for one.

STIG	Date
Cisco ISE NAC Security Technical Implementation Guide	2021-04-14

Details

Check Text ( C-45860r714063_chk )
Verify that each requirement used has a message to display. 1. Navigate to Work Centers >> Posture >> Posture Policy. 2. Make a note of each "Requirement" tied to an enabled Posture Policy. 3. Navigate to Work Centers >> Posture >> Policy Elements >> Requirements. 4. Verify that each requirement noted has a message in the "Message Shown to Agent User" box. If a requirement that is used does not have a message, this is a finding.

Check Text ( C-45860r714063_chk )

Verify that each requirement used has a message to display.

1. Navigate to Work Centers >> Posture >> Posture Policy.
2. Make a note of each "Requirement" tied to an enabled Posture Policy.
3. Navigate to Work Centers >> Posture >> Policy Elements >> Requirements.
4. Verify that each requirement noted has a message in the "Message Shown to Agent User" box.

If a requirement that is used does not have a message, this is a finding.

Fix Text (F-45817r714064_fix)
Configure a message prior to remediation: 1. Navigate to Work Centers >> Posture >> Policy Elements >> Requirements. 2. On the requirements under "Remediation Actions" define a message in the "Message Shown to Agent User". 3. Choose "Done". 4. Choose "Save".