In Cisco ASA configurations using IKEv2, the integrity command defines the hash algorithm. To use SHA-
512, the correct syntax is:
integrity sha512
Without this, the IKEv2 proposal is considered incomplete or mismatched with the peer. The encryption command sets encryption (AES-256, etc.), not hashing. The correct structure is:
crypto ikev2 policy <#>
encryption aes-256
integrity sha512
group 2
prf sha512
lifetime 86400
Reference: Designing and Implementing Secure Cloud Access for Users and Endpoints (SCAZT), Section 1:
Cloud Security Architecture, Pages 20-23
Reference: Designing and Implementing Secure Cloud Access for Users and Endpoints (SCAZT), Section 5, Pages 93-95

The SCAZT documentation emphasizes that when Cisco Secure XDR identifies a high-risk threat (e.g., risk score 8 out of 10 for malware distribution, as shown in the exhibit), the first priority is to prevent lateral movement and data exfiltration. The recommended first response action is to isolate the affected endpoint from the network.
Cisco Secure Endpoint and XDR allow you to trigger an "isolate" response directly from the dashboard, cutting off all non-management communication from the compromised device. This preserves the environment and enables forensic analysis before removing malware or taking destructive actions like rebuilding the system.
Reference: Designing and Implementing Secure Cloud Access for Users and Endpoints (SCAZT), Section 6:
Threat Response, Pages 113-118