Carbon Black Response - Unisolate Endpoint

This playbook unisolates sensors according to the sensor ID that is provided in the playbook input.

Carbon Black Enterprise Response · 8 tasks · 1 input · 0 outputs

Inputs

  • Endpoint_ID — The sensor id that you want to unisolate.

Commands used

cb-list-sensors cb-sensor-info cb-unquarantine-device

Flowchart

no yes yes yes Start Start Is Carbon Black Enterprise Response enabled? - IsIntegrationAvailable Is Carbon Black Enterpris... IsIntegrationAvailable Done Done Is there sensor id? Is there sensor id? Get host information from Carbon Black Enterprise Response - cb-sensor-info Get host information from... cb-sensor-info Is the sensor isolated? Is the sensor isolated? Unisolate the sensor - cb-unquarantine-device Unisolate the sensor cb-unquarantine-device Get CB sensor list - cb-list-sensors Get CB sensor list cb-list-sensors