Carbon Black Response - Unisolate Endpoint

This playbook unisolates sensors according to the sensor ID that is provided in the playbook input.

Carbon Black Enterprise Response · 8 tasks · 1 input · 0 outputs

Details

ID	`Carbon Black Response - Unisolate Endpoint`
From Version	5.5.0
Tasks	8

README

This playbook unisolates sensors according to the sensor ID that is provided in the playbook input.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

carbonblack-v2

Scripts

IsIntegrationAvailable

Commands

cb-sensor-info
cb-list-sensors
cb-unquarantine-device

Playbook Inputs

Name	Description	Default Value	Required
Endpoint_ID	The sensor id you want to unisolate.		Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Carbon Black Response - Unisolate Endpoint

Inputs

Endpoint_ID — The sensor id that you want to unisolate.

Commands used

cb-list-sensors cb-sensor-info cb-unquarantine-device

Flowchart

Source

playbook-Carbon_Black_Response_-_Unisolate_Endpoint.yml

Download History Raw

id: Carbon Black Response - Unisolate Endpoint
version: -1
name: Carbon Black Response - Unisolate Endpoint
description: This playbook unisolates sensors according to the sensor ID that is provided in the playbook input.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 9d721bc0-6ac0-46e4-807d-465bcd327db3
    type: start
    task:
      id: 9d721bc0-6ac0-46e4-807d-465bcd327db3
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "1":
    id: "1"
    taskid: fc08bfe1-08dd-4d22-8147-85aced6e6a9d
    type: condition
    task:
      id: fc08bfe1-08dd-4d22-8147-85aced6e6a9d
      version: -1
      name: Is Carbon Black Enterprise Response enabled?
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'.
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "2"
      "yes":
      - "7"
    scriptarguments:
      brandname:
        simple: carbonblack-v2
    results:
    - brandInstances
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 250
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "2":
    id: "2"
    taskid: ebe4096d-92b3-4dc9-82dd-13f433174e51
    type: title
    task:
      id: ebe4096d-92b3-4dc9-82dd-13f433174e51
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1550
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "3":
    id: "3"
    taskid: a331ff25-42fc-4e76-8d62-532d284c752b
    type: condition
    task:
      id: a331ff25-42fc-4e76-8d62-532d284c752b
      version: -1
      name: Is there sensor id?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "4"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.Endpoint_ID
            iscontext: true
      - - operator: containsGeneral
          left:
            value:
              simple: Endpoint.CbSensorID
            iscontext: true
          right:
            value:
              simple: inputs.Endpoint_ID
            iscontext: true
    view: |-
      {
        "position": {
          "x": 700,
          "y": 580
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "4":
    id: "4"
    taskid: d308391d-bca5-4895-8ca3-7212016b1112
    type: regular
    task:
      id: d308391d-bca5-4895-8ca3-7212016b1112
      version: -1
      name: Get host information from Carbon Black Enterprise Response
      description: Display information about the given sensor.
      script: carbonblack-v2|||cb-sensor-info
      type: regular
      iscommand: true
      brand: carbonblack-v2
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      groupid: {}
      hostname: {}
      ip: {}
      sensor:
        simple: ${inputs.Endpoint_ID}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1060,
          "y": 860
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "5":
    id: "5"
    taskid: 0ad47e84-28ee-43d8-8c9b-06cc056927ac
    type: condition
    task:
      id: 0ad47e84-28ee-43d8-8c9b-06cc056927ac
      version: -1
      name: Is the sensor isolated?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "6"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: CbResponse.Sensors.Isolated
            iscontext: true
          right:
            value:
              simple: "true"
    view: |-
      {
        "position": {
          "x": 1060,
          "y": 1020
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "6":
    id: "6"
    taskid: 6e64eb8f-6046-41a9-8f7c-d9210545d742
    type: regular
    task:
      id: 6e64eb8f-6046-41a9-8f7c-d9210545d742
      version: -1
      name: Unisolate the sensor
      description: Unquarantine the endpoint.
      script: carbonblack-v2|||cb-unquarantine-device
      type: regular
      iscommand: true
      brand: carbonblack-v2
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      sensor:
        simple: ${inputs.Endpoint_ID}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1060,
          "y": 1320
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "7":
    id: "7"
    taskid: f9b56018-29bb-4a84-8c72-fc5bcaf10745
    type: regular
    task:
      id: f9b56018-29bb-4a84-8c72-fc5bcaf10745
      version: -1
      name: Get CB sensor list
      description: List the CarbonBlack sensors.
      script: '|||cb-list-sensors'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      limit: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 700,
          "y": 430
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
system: true
view: |-
  {
    "linkLabelsPosition": {
      "1_2_no": 0.6,
      "3_2_#default#": 0.23,
      "5_2_#default#": 0.45
    },
    "paper": {
      "dimensions": {
        "height": 1565,
        "width": 990,
        "x": 450,
        "y": 50
      }
    }
  }
inputs:
- key: Endpoint_ID
  value: {}
  required: false
  description: 'The sensor id that you want to unisolate. '
  playbookInputQuery:
outputs: []
tests:
- Carbon Black Response Test
- CBFindIP - Test
fromversion: 5.5.0