How do I install the Ise Incident Response skill?

Run npx skillmds@latest add gabrielmoreira/ise-incident-response in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Ise Incident Response skill do?

Rapid ISE endpoint investigation and quarantine workflow - endpoint lookup, auth history, posture review, human-authorized quarantine, ServiceNow Security Incident. Use when a SOC alert flags a compromised endpoint, an unauthorized device is detected on the network, an endpoint is doing port scanning or lateral movement, or you need to quarantine a MAC address in ISE. It is listed under Security on SkillMD.

Is Ise Incident Response safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Ise Incident Response?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Ise Incident Response free to use?

Yes. Installing skills from SkillMD is free. This skill is licensed under Apache-2.

Who published Ise Incident Response?

gabrielmoreira (@gabrielmoreira) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Ise Incident Response by gabrielmoreira

Name: Ise Incident Response
Rating: 4.2 (5 reviews)
Author: gabrielmoreira

ISE Incident Response

Safety -- Non-Negotiable Rules

NEVER auto-quarantine an endpoint. Endpoint group changes require explicit human confirmation. The agent MUST present its findings, state its recommendation, and then STOP and WAIT for the human to type an affirmative response before proceeding with any ISE endpoint group modification.

NEVER skip the investigation steps. Even if the human says "just quarantine MAC XX:XX:XX:XX:XX:XX", the agent MUST first collect endpoint data, auth history, and posture state so the quarantine action has full context for the ServiceNow ticket and GAIT audit trail.

NEVER modify ISE authorization policies during incident response. This workflow changes endpoint group membership only. Policy changes require a separate Change Request via servicenow-change-workflow.

When to Use

Suspected compromised endpoint (SOC alert, SIEM correlation)
Unauthorized device detected on the network
Endpoint exhibiting anomalous behavior (port scanning, lateral movement)
Failed posture compliance requiring immediate isolation
Rogue access point or hub detected on a switchport

How to Call the ISE MCP Tools

All ISE tools are called via mcp-call with the ISE MCP server command:

python3 $MCP_CALL "ISE_BASE=$ISE_BASE USERNAME=$ISE_USERNAME PASSWORD=$ISE_PASSWORD python3 -u $ISE_MCP_SCRIPT" TOOL_NAME '{"param":"value"}'

ServiceNow tools are called via:

python3 $MCP_CALL "$SERVICENOW_MCP_SCRIPT" TOOL_NAME '{"param":"value"}'

Incident Response Procedure

Phase 1: Endpoint Identification

Locate the suspect endpoint by MAC address, IP address, or username. Start with the endpoints list and active sessions.

Look up all endpoints:

python3 $MCP_CALL "ISE_BASE=$ISE_BASE USERNAME=$ISE_USERNAME PASSWORD=$ISE_PASSWORD python3 -u $ISE_MCP_SCRIPT" endpoints '{}'

Check active sessions for the suspect:

python3 $MCP_CALL "ISE_BASE=$ISE_BASE USERNAME=$ISE_USERNAME PASSWORD=$ISE_PASSWORD python3 -u $ISE_MCP_SCRIPT" active_sessions '{}'

Filter the results for the target MAC/IP/username. Record:

MAC address
IP address (if assigned)
Username (if 802.1X authenticated)
Connected switch and port
Identity group membership
Profile classification
Session state (active/inactive)

Phase 2: Authentication History Review

Pull authorization and authentication rules to understand what access the endpoint was granted and why:

python3 $MCP_CALL "ISE_BASE=$ISE_BASE USERNAME=$ISE_USERNAME PASSWORD=$ISE_PASSWORD python3 -u $ISE_MCP_SCRIPT" network_access_authorization_rules '{}'

python3 $MCP_CALL "ISE_BASE=$ISE_BASE USERNAME=$ISE_USERNAME PASSWORD=$ISE_PASSWORD python3 -u $ISE_MCP_SCRIPT" network_access_authentication_rules '{}'

python3 $MCP_CALL "ISE_BASE=$ISE_BASE USERNAME=$ISE_USERNAME PASSWORD=$ISE_PASSWORD python3 -u $ISE_MCP_SCRIPT" network_access_policy_set '{}'

Determine:

Which policy set matched the endpoint
Which authorization rule granted access
What authorization profile was assigned (VLAN, dACL, SGT)
Whether posture was evaluated
Whether 802.1X or MAB was used

Phase 3: Posture and Profile Assessment

Evaluate the endpoint's posture compliance and profiling accuracy:

python3 $MCP_CALL "ISE_BASE=$ISE_BASE USERNAME=$ISE_USERNAME PASSWORD=$ISE_PASSWORD python3 -u $ISE_MCP_SCRIPT" profiler_profiles '{}'

python3 $MCP_CALL "ISE_BASE=$ISE_BASE USERNAME=$ISE_USERNAME PASSWORD=$ISE_PASSWORD python3 -u $ISE_MCP_SCRIPT" identity_groups '{}'

Determine:

Is the endpoint posture-compliant, non-compliant, or unknown?
What profiler profile matched? What certainty factor?
Is the endpoint in the correct identity group?
Does the endpoint profile match expected behavior (e.g., a "printer" making HTTP requests to external sites)?

Phase 4: Risk Assessment and Recommendation

Compile findings and present a risk assessment to the human operator:

ENDPOINT INVESTIGATION SUMMARY
===============================
Target: [MAC address]
IP: [IP address]
Username: [username or N/A]
Location: [switch:port]
Profile: [ISE profile] (certainty: N)
Identity Group: [current group]
Auth Method: [802.1X / MAB]
Authorization Rule: [rule name]
Authorization Profile: [profile name — VLAN, dACL, SGT]
Posture Status: [Compliant / Non-Compliant / Unknown / Not Assessed]
Session Duration: [time]

RISK INDICATORS:
  - [List specific concerns, e.g., "Profiled as printer but generating DNS queries to known C2 domains"]
  - [e.g., "MAB-only authentication — no certificate or credential validation"]
  - [e.g., "Non-compliant posture but granted production VLAN access"]

RECOMMENDATION: [QUARANTINE / MONITOR / NO ACTION]
Rationale: [Brief explanation of why this recommendation is being made]

* HUMAN DECISION POINT *

STOP HERE. Present the investigation summary above and ask the human operator:

"Based on this investigation, I recommend [QUARANTINE/MONITOR/NO ACTION] for endpoint [MAC]. Do you authorize me to move this endpoint to the quarantine identity group in ISE? Please confirm with YES or NO."

Do NOT proceed to Phase 5 unless the human explicitly responds with an affirmative.

If the human says NO or requests monitoring only, skip to Phase 6 (ServiceNow) and record the decision.

Phase 5: Quarantine Execution (Human-Authorized Only)

This phase executes ONLY after explicit human authorization.

Move the endpoint to the quarantine identity group. The ISE MCP endpoint tools handle endpoint group membership. The specific approach depends on the ISE MCP endpoint update capabilities.

After the group change:

Verify the endpoint group was updated by re-querying:

python3 $MCP_CALL "ISE_BASE=$ISE_BASE USERNAME=$ISE_USERNAME PASSWORD=$ISE_PASSWORD python3 -u $ISE_MCP_SCRIPT" endpoints '{}'

Verify the active session was affected (CoA should trigger reauth):

python3 $MCP_CALL "ISE_BASE=$ISE_BASE USERNAME=$ISE_USERNAME PASSWORD=$ISE_PASSWORD python3 -u $ISE_MCP_SCRIPT" active_sessions '{}'

Confirm the endpoint is now in the quarantine group and receiving restricted access.

Phase 6: Open ServiceNow Security Incident

Create a Security Incident in ServiceNow documenting the investigation and action taken:

python3 $MCP_CALL "$SERVICENOW_MCP_SCRIPT" create_incident '{"short_description":"ISE Security Incident: Endpoint [MAC] quarantined","description":"Endpoint Investigation Report\n\nTarget: [MAC]\nIP: [IP]\nUsername: [username]\nLocation: [switch:port]\nProfile: [profile]\nAuth Method: [auth method]\nPosture: [status]\n\nRisk Indicators:\n- [indicator 1]\n- [indicator 2]\n\nAction Taken: Endpoint moved to quarantine group by [human operator] authorization.\nISE Identity Group: Quarantine\nTimestamp: [ISO 8601 timestamp]","category":"Security","impact":"2","urgency":"2","assignment_group":"Network Security"}'

If the human chose NO ACTION or MONITOR, adjust the ticket accordingly:

python3 $MCP_CALL "$SERVICENOW_MCP_SCRIPT" create_incident '{"short_description":"ISE Security Investigation: Endpoint [MAC] — monitoring","description":"Endpoint Investigation Report\n\nTarget: [MAC]\nIP: [IP]\nUsername: [username]\nLocation: [switch:port]\n\nInvestigation completed. Human operator reviewed findings and chose MONITOR (no quarantine).\nReason: [human-provided reason if any]\n\nMonitoring actions recommended:\n- Continue session logging\n- Set SIEM alert for this MAC\n- Reassess in 24 hours","category":"Security","impact":"3","urgency":"3","assignment_group":"Network Security"}'

Add work notes with the full investigation timeline:

python3 $MCP_CALL "$SERVICENOW_MCP_SCRIPT" add_comment '{"incident_id":"INC0010001","comment":"Investigation timeline:\n1. Endpoint identified via [source: SOC alert / manual report]\n2. ISE data collected: profile, auth history, posture state\n3. Risk assessment: [QUARANTINE/MONITOR/NO ACTION]\n4. Human decision: [AUTHORIZED/DECLINED]\n5. Action executed: [describe]\n6. Verification: [endpoint confirmed in quarantine group / monitoring continues]","is_work_note":true}'

Phase 7: GAIT Audit Trail

Record the full incident response session in GAIT:

python3 $MCP_CALL "python3 -u $GAIT_MCP_SCRIPT" gait_record_turn '{"input":{"role":"assistant","content":"ISE Incident Response completed. Target: [MAC]. Investigation: auth history reviewed, posture assessed, profile verified. Risk: [HIGH/MEDIUM/LOW]. Recommendation: [QUARANTINE/MONITOR]. Human decision: [AUTHORIZED/DECLINED]. Action: [endpoint quarantined / monitoring only]. ServiceNow: INC0010001 created.","artifacts":[]}}'

Example: Full Investigation Flow

Scenario: SOC alerts on MAC AA:BB:CC:DD:EE:FF making lateral connections to finance VLAN.

# Step 1: Find the endpoint
python3 $MCP_CALL "ISE_BASE=$ISE_BASE USERNAME=$ISE_USERNAME PASSWORD=$ISE_PASSWORD python3 -u $ISE_MCP_SCRIPT" endpoints '{}'

# Step 2: Check if it has an active session
python3 $MCP_CALL "ISE_BASE=$ISE_BASE USERNAME=$ISE_USERNAME PASSWORD=$ISE_PASSWORD python3 -u $ISE_MCP_SCRIPT" active_sessions '{}'

# Step 3: Review what authorization it received
python3 $MCP_CALL "ISE_BASE=$ISE_BASE USERNAME=$ISE_USERNAME PASSWORD=$ISE_PASSWORD python3 -u $ISE_MCP_SCRIPT" network_access_authorization_rules '{}'

# Step 4: Check its profile and posture
python3 $MCP_CALL "ISE_BASE=$ISE_BASE USERNAME=$ISE_USERNAME PASSWORD=$ISE_PASSWORD python3 -u $ISE_MCP_SCRIPT" profiler_profiles '{}'

# Step 5: Check identity group
python3 $MCP_CALL "ISE_BASE=$ISE_BASE USERNAME=$ISE_USERNAME PASSWORD=$ISE_PASSWORD python3 -u $ISE_MCP_SCRIPT" identity_groups '{}'

# Step 6: Check TrustSec assignment
python3 $MCP_CALL "ISE_BASE=$ISE_BASE USERNAME=$ISE_USERNAME PASSWORD=$ISE_PASSWORD python3 -u $ISE_MCP_SCRIPT" trustsec_sgts '{}'

Present findings to operator. Wait for human decision.

If authorized:

# Verify quarantine took effect
python3 $MCP_CALL "ISE_BASE=$ISE_BASE USERNAME=$ISE_USERNAME PASSWORD=$ISE_PASSWORD python3 -u $ISE_MCP_SCRIPT" endpoints '{}'

python3 $MCP_CALL "ISE_BASE=$ISE_BASE USERNAME=$ISE_USERNAME PASSWORD=$ISE_PASSWORD python3 -u $ISE_MCP_SCRIPT" active_sessions '{}'

Then open ServiceNow incident and record in GAIT.

Investigation Checklist

Use this checklist to ensure no step is skipped:

Endpoint identified (MAC, IP, username, switch:port)
Active session state checked
Authorization rule and profile determined
Authentication method verified (802.1X vs MAB)
Posture compliance status confirmed
Profiler profile and certainty factor reviewed
Identity group membership noted
TrustSec SGT assignment checked (if applicable)
Risk assessment compiled and presented to human
Human decision received (QUARANTINE / MONITOR / NO ACTION)
Action executed (if authorized)
Post-action verification completed
ServiceNow Security Incident created
GAIT audit trail recorded

Integration with Other Skills

Use ise-posture-audit for the comprehensive policy review that often follows an incident
Use pyats-security to verify the network device-side 802.1X and port-security configuration on the affected switchport
Use pyats-troubleshoot to trace the endpoint's network path and verify ACL enforcement at each hop
Use servicenow-change-workflow if the incident reveals a policy gap that requires an ISE authorization rule change (separate CR required)
Use gait-session-tracking to maintain the immutable audit trail across the full incident lifecycle
Use markmap-viz to visualize the endpoint's access path (SGT assignment, AuthZ rule, VLAN, dACL)

Ise Incident Response

File contents

ISE Incident Response

Safety -- Non-Negotiable Rules

When to Use

How to Call the ISE MCP Tools

Incident Response Procedure

Phase 1: Endpoint Identification

Phase 2: Authentication History Review

Phase 3: Posture and Profile Assessment

Phase 4: Risk Assessment and Recommendation

* HUMAN DECISION POINT *

Phase 5: Quarantine Execution (Human-Authorized Only)

Phase 6: Open ServiceNow Security Incident

Phase 7: GAIT Audit Trail

Example: Full Investigation Flow

Investigation Checklist

Integration with Other Skills

Frequently asked questions

Ise Incident Response

File contents

ISE Incident Response

Safety -- Non-Negotiable Rules

When to Use

How to Call the ISE MCP Tools

Incident Response Procedure

Phase 1: Endpoint Identification

Phase 2: Authentication History Review

Phase 3: Posture and Profile Assessment

Phase 4: Risk Assessment and Recommendation

*** HUMAN DECISION POINT ***

Phase 5: Quarantine Execution (Human-Authorized Only)

Phase 6: Open ServiceNow Security Incident

Phase 7: GAIT Audit Trail

Example: Full Investigation Flow

Investigation Checklist

Integration with Other Skills

Related skills

Frequently asked questions

How do I install the Ise Incident Response skill?

What does the Ise Incident Response skill do?

Is Ise Incident Response safe to use?

Which AI agents work with Ise Incident Response?

Is Ise Incident Response free to use?

Who published Ise Incident Response?

* HUMAN DECISION POINT *