Cisco ISE Access Granted After Repeated Posture Failures

Siddhant Mishra@Siddhant

•updated yesterday•0•0•0

Detects a successful network admission following repeated posture compliance failures for the same endpoint. The expected outcome of failing posture is remediation then access; failures followed by success without remediation suggests the check was bypassed, disabled, or satisfied by spoofed posture data. Onboarding: CISCO-ISE is ingested via Syslog (KV) (Bloo extractor 196). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=compliance where sourcename='CISCO-ISE' and action='COMPLIANCE_CHECK' | duration 1h | groupby user, policy, reason, srcip