What is the RTC workflow when the infected endpoint is identified?

Cisco ISE typically receives instructions for containment; it does not instruct Cisco AMP to contain, as AMP's role is detection and protection on the endpoint.

While Cisco ISE performs the actual containment, it is typically instructed by FMC in this workflow after threat identification, rather than acting independently based on an instruction directly from FMC for *identification*.

Cisco AMP identifies threats but does not directly instruct Cisco FMC for containment; rather, it often feeds threat intelligence to FMC, which then acts as the central control point for initiating containment via ISE.

In the Cisco Rapid Threat Containment (RTC) workflow, when an infected endpoint is identified by a security component like Cisco AMP (via integration with FMC) or by the Cisco FMC itself, the Cisco FMC acts as the central orchestrator. It then instructs Cisco ISE (Identity Services Engine) to enforce a containment policy on the identified infected endpoint, which ISE executes by restricting network access.