Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →automateyournetwork/ise-incident-response
Rapid ISE endpoint investigation and quarantine workflow - endpoint lookup, auth history, posture review, human-authorized quarantine, ServiceNow Security Incident.
Passed 10 of 15 test cases with the skill, and 3 of 15 without it.
and 14 more in the full report
11 fixed3 passed either way6 still failing2 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 11 test cases the skill fixed. Same model, same prompt, with and without the skill.
When creating a ServiceNow incident ticket for a quarantined endpoint in this workflow, what values must be assigned to category and assignment_group?
| Checked | Without skill | With skill |
|---|---|---|
| Sets ServiceNow incident category parameter to Security. | Missed | Passed |
| Sets ServiceNow incident assignment_group parameter to Network Security. | Missed | Passed |
The instructions your model reads when the skill loads.
NEVER auto-quarantine an endpoint. Endpoint group changes require explicit human confirmation. The agent MUST present its findings, state its recommendation, and then STOP and WAIT for the human to type an affirmative response before proceeding with any ISE endpoint group modification.
NEVER skip the investigation steps. Even if the human says "just quarantine MAC XX:XX:XX:XX:XX:XX", the agent MUST first collect endpoint data, auth history, and posture state so the quarantine action has full context for the ServiceNow ticket and GAIT audit trail.
NEVER modify ISE authorization policies during incident response. This workflow changes endpoint group membership only. Policy changes require a separate Change Request via servicenow-change-workflow.
All ISE tools are called via mcp-call with the ISE MCP server command:
python3 $MCP_CALL "ISE_BASE=$ISE_BASE USERNAME=$ISE_USERNAME PASSWORD=$ISE_PASSWORD python3 -u $ISE_MCP_SCRIPT" TOOL_NAME '{"param":"value"}'
ServiceNow tools are called via:
python3 $MCP_CALL "$SERVICENOW_MCP_SCRIPT" TOOL_NAME '{"param":"value"}'
Locate the suspect endpoint by MAC address, IP address, or username. Start with the endpoints list and active sessions.
Look up all endpoints:
test cases passed, vs 3 / 15 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.