Cisco AMP provides endpoint threat detection and can send threat intelligence to Cisco ISE to trigger containment actions such as quarantine or restricted access based on detected malware or compromise.
Cisco Stealthwatch offers network traffic analysis and behavioral detection of threats, which can also integrate with ISE to initiate containment by identifying suspicious or malicious endpoint activity.
https://community.cisco.com/t5/network-access-control/cisco-ise-amp-for-endpoints- integration/td-p/4273949