Cisco Identity Services Engine

LAST UPDATED: APRIL 28, 2025

Overview

The Cisco Identity Services Engine (ISE) is a one-stop solution to streamline security policy management and allows the organization to see users and devices controlling access across wired, wireless, and VPN connections to the corporate network.

D3 SOAR is providing REST operations to function with Cisco Identity Services Engine.

Cisco Identity Services Engine is available for use in:

Connection

To connect to Cisco Identity Services Engine from D3 SOAR, follow this part to collect the required information below:

Configuring Cisco Identity Services Engine to Work with D3 SOAR

Enabling ERS (port 9060)

ERS operates on HTTPS port 9060, which is closed by default. Clients attempting to access this port without first enabling ERS will encounter a server timeout. Follow the steps below to enable ERS using the Cisco Identity Services Engine UI.

1. Log into the Cisco Identity Services Engine UI.

   

2. Hover over the Administration option in the navigation menu, then select the Settings link in the System category.

   

3. Navigate to the ERS Settings tab, select the Enable ERS for Read/Write radio option, then click the Save button to apply the changes.

   

Creating ERS Admin

To use the integration, create a Cisco ISE administrator assigned to the ERS-Admin group.

1. Hover over the Administration option in the navigation menu, then select the Admin Access link in the System category.

   

2. Expand the Administrators accordion, open the Admin Users tab.

   

3. Click the + Add button, then choose the Create an Admin User option.

   

4. Create an administrator account.

   

   1. Enter the name.
      This is the login username. Refer to step 2 in Configuring D3 SOAR to Work with Cisco Identity Services Engine.

   2. Enter and confirm the password.
      This is the login password. Refer to step 3 in Configuring D3 SOAR to Work with Cisco Identity Services Engine.

   3. Select the ERS admin option in the Admin Groups section.

   4. Click the Submit button to create the user.

Configuring D3 SOAR to Work with Cisco Identity Services Engine

1. Log in to D3 SOAR.

2. Find the Cisco Identity Services Engine integration.

   

   1. Navigate to Configuration on the top header menu.

   2. Click on the Integration icon on the left sidebar.

   3. Type Cisco Identity Services Engine in the search box to find the integration, then click it to select it.

   4. Click on the + Connection button on the right side of the Connections section. A new connection window will appear.

3. Configure the following fields to create a connection to Cisco Identity Services Engine.

   

   1. Connection Name: The desired name for the connection.

   2. Site: Specifies the site to use the integration connection. Use the drop-down menu to select the site. The Share to Internal Sites option enables all sites defined as internal sites to use the connection. Selecting a specific site will only enable that site to use the connection.

   3. Recipient site for events from connections Shared to Internal Sites: This field is displayed when Share to Internal Sites is selected for the Site field, allowing selection of the internal site for deploying the integration connection.

   4. Agent Name (Optional): Specifies the proxy agent required to build the connection. Use the dropdown menu to select the proxy agent from a list of previously configured proxy agents.

   5. Description (Optional): Add a description for the connection.

   6. Tenant (Optional): When configuring the connection from a master tenant site, users have the option to choose the specific tenant sites to share the connection with. Once this setting is enabled, users can filter and select the desired tenant sites from the dropdowns to share the connection.

      

   7. Configure User Permissions: Defines which users have access to the connection.

   8. Active: Check the checkbox to ensure the connection is available for use.

   9. System: This section contains the parameters defined specifically for the integration. These parameters must be configured to create the integration connection.

      

      1. Input the Server URL. Ensure to append the port number to the URL (e.g., https: https://192.168.45.123:9060).

      2. Input the User Name. Refer to step 4a in Creating ERS Admin.

      3. Input the Password. Refer to step 4b in Creating ERS Admin.

   10. Enable Password Vault: An optional feature that allows users to take the stored credentials from their own password vault. Refer to the password vault connection guide if needed.

   11. Connection Health Check: Periodically checks the connection status by scheduling the Test Connection command at the specified interval (in minutes). Available only for active connections, this feature also allows configuring email notifications for failed attempts.

4. Test the connection.

   

   1. Click on the Test Connection button to verify credentials and connectivity. A success alert displays Passed with a green checkmark. If the connection fails, review the parameters and retry.

   2. Click OK to close the alert window.

   3. Click + Add to create and add the configured connection.

Commands

Cisco Identity Services Engine includes the following executable commands for users to set up schedules or create playbook workflows. With the Test Command function, users can execute these commands independently for playbook troubleshooting.

Integration API Note

For more information about the Cisco Identity Services Engine API, refer to the Cisco Identity Services Engine API reference.

Assign Endpoints to Blacklist

Adds endpoints to the blacklist using their MAC addresses.

Input

["**:**:**:**:**:**"]

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data displays Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Create User

Creates a new internal user. The user can be viewed and modified by navigating to Administration > Identities under Identity Management in the Cisco Identity Services Engine user interface.

READER NOTE

If user creation is successful, the user can be viewed and modified (if necessary) by navigating to Administration > Identities under Identity Management in the Cisco Identity Services Engine user interface.

Input

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data displays Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Delete User

Deletes internal users using their usernames.

READER NOTE

User Name is a required parameter to run this command.

• Run the List All Users command to obtain the User Name. User Names can be found in the raw data at the path $.SearchResult.resources[*].name.

Input

["jdoe"] 

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data displays Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Disable User

Disables an internal user using their username.

READER NOTE

User Name is a required parameter to run this command.

• Run the List All Users command to obtain the User Name. User Names can be found in the raw data at the path $.SearchResult.resources[*].name.

Input

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data displays Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Enable User

Enables an internal user who has been disabled using their username.

READER NOTE

User Name is a required parameter to run this command.

• Run the List All Users command to obtain the User Name. User Names can be found in the raw data at the path $.SearchResult.resources[*].name.

Input

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data displays Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

List All Users

Lists all internal users.

Input

N/A

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data displays Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Test Connection

Allows users to perform a health check on an integration connection. Users can schedule a periodic health check by selecting Connection Health Check when editing an integration connection.

Input

N/A

Output

Error Handling

If the Return Data displays Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.