Block Endpoint - Carbon Black Response V2 Deprecated

Deprecated. Use the `Block Endpoint - Carbon Black Response V2.1` playbook instead. Carbon Black Response - isolates an endpoint for a given hostname.

Carbon Black Enterprise Response · 6 tasks · 2 inputs · 5 outputs

Inputs

  • Hostname — The hostname to isolate.
  • Sensor_id — The sensor ID of the endpoint.

Outputs

  • CbResponse.Sensors.CbSensorID — Carbon Black Response Sensors IDs that are isolated.
  • Endpoint — The isolated endpoint.
  • CbResponse.Sensors.Status — Sensor status.
  • CbResponse.Sensors.Isolated — Is sensor isolated.
  • Endpoint.Hostname — Endpoint hostname.

Commands used

cb-quarantine-device cb-sensor-info

Flowchart

yes yes Start Start Get host information from Carbon Black Enterprise Response - cb-sensor-info Get host information from... cb-sensor-info Isolate endpoint - cb-quarantine-device Isolate endpoint cb-quarantine-device Done Done Is Carbon Black Enterprise Response enabled? - IsIntegrationAvailable Is Carbon Black Enterpris... IsIntegrationAvailable Is the endpoint ready for isolation? Is the endpoint ready for...