Crowdstrike Falcon - Isolate Endpoint

This playbook will auto isolate endpoints by the device ID that was provided in the playbook.

Pack

CrowdStrikeFalcon

Tasks

7

Inputs

• Device_id — The device ID to isolate.

Commands used

• cs-falcon-contain-host
• cs-falcon-search-device