Configure Authorization Profile
The authorization profile in Cisco ISE now includes an option to scan endpoints for vulnerabilities.
You can choose to run the scan periodically and also specify the time interval for these scans.
After you define the authorization profile, you can apply it to an existing authorization policy rule or create a new authorization policy rule.
https://www.cisco.com/c/en/us/td/docs/security/ise/2-
2/admin_guide/b_ise_admin_guide_22/b_ise_admin_guide_22_chapter_010100.html