Containment Plan - Isolate Device

## Containment Plan - Isolate Device This playbook is a sub-playbook within the containment plan playbook. The playbook isolates devices using core commands.

Pack

CommonPlaybooks

Tasks

11

Inputs

• HostContainment — Whether to execute endpoint isolation.
• EndpointID — The endpoint ID to run commands over.
• EndpointHostName — The endpoint hostname.

Outputs

• Core.Isolation.endpoint_id — The isolated endpoint ID.

Commands used

• core-get-endpoints
• core-isolate-endpoint
• setParentIncidentContext