Cortex XDR - Isolate Endpoint

This playbook accepts an XDR endpoint ID and isolates it using the 'Palo Alto Networks Cortex XDR - Investigation and Response' integration.

Pack

CortexXDR

Tasks

8

Inputs

• endpoint_id — The endpoint ID (string) to isolate. You can retrieve the ID using the xdr-get-endpoints command.
• hostname — A comma-separated list of hostnames.
• ip_list — A comma-separated list of IP addresses.

Outputs

• PaloAltoNetworksXDR.Endpoint.endpoint_id — The endpoint ID.
• PaloAltoNetworksXDR.Endpoint.endpoint_name — The endpoint name.
• PaloAltoNetworksXDR.Endpoint.endpoint_status — The status of the endpoint.
• PaloAltoNetworksXDR.Endpoint.ip — A list of IP addresses.
• PaloAltoNetworksXDR.Endpoint.is_isolated — Whether the endpoint is isolated.
• Endpoint.Hostname — The hostname that is mapped to this endpoint.

Commands used

• xdr-endpoint-isolate
• xdr-get-endpoints