Automatic Antivirus Remediation in Posture

Question

Hi All,
I have configured ISE (1.2) to check Antivirus Installation on endpoints and it is working flawlessly.
Now, the client wants,
1) If Antivirus is not updated on endpoint for more than 5 days; it should be considered as "non-compliant" and as a remediation action; updates should be downloaded automatically.
--> I configured AV Remediation action.
Now, the problem is when endpoint gets categorized as non-compliant, ideally AV updates should get downloaded on endpoint as a remediation action. But AV updates are not getting downloaded.
Please help me in solving this problem..
Thanks in advance,
Aditya

Answer 1

Adding an Antivirus Remediation
You can create an antivirus remediation, which updates clients with up-to-date file definitions for compliance after remediation.
The AV Remediations page displays all the antivirus remediations along with their name and description and their modes of remediation.
Step 1 Choose Policy > Policy Elements > Results > Posture.
Step 2 Click Remediation Actions.
Step 3 Click AV Remediation.
Step 4 Click Add.
Step 5 Modify the values in the New AV Remediation page.
Step 6 Click Submit.
http://www.cisco.com/c/en/us/td/docs/security/ise/1-2/user_guide/ise_user_guide/ise_pos_pol.html#pgfId-1924006
Antivirus Remediation
The following table describes the fields in the AV Remediation page. The navigation path is Policy > Policy Elements > Results > Posture > Remediation Actions > AV Remediation.
http://www.cisco.com/c/en/us/td/docs/security/ise/1-2/user_guide/ise_user_guide/ise_ui_reference_policy.html#23739
Table C-23 Antivirus Remediation
Fields
Usage Guidelines
Name
Enter a name for the antivirus remediation.
Description
Enter a description for the antivirus remediation.
Remediation Type
Choose one of the following:
Automatic —When selected, you should enter values for the Interval and Retry Count.
Manual —When selected, Retry Count and Interval fields are not editable.
Interval (in seconds)
Enter the time interval in seconds that clients can try to remediate after previous attempts.
Retry Count
Enter the number of attempts that clients can try to update an antivirus definition.
Operating System
Choose one of the following:
Windows
Macintosh —when selected Remediation Type, Interval, and Retry Count fields are not editable
AV Vendor Name
Choose the antivirus vendor.