Containment Plan - Isolate Device

## Containment Plan - Isolate Device This playbook is a sub-playbook within the containment plan playbook. The playbook isolates devices using core commands.

Common Playbooks · 11 tasks · 3 inputs · 1 output

Inputs

  • HostContainment — Whether to execute endpoint isolation.
  • EndpointID — The endpoint ID to run commands over.
  • EndpointHostName — The endpoint hostname.

Outputs

  • Core.Isolation.endpoint_id — The isolated endpoint ID.

Commands used

core-get-endpoints core-isolate-endpoint setParentIncidentContext

Flowchart

Yes Endpoint ID Endpoint Name yes Start Start Auto endpoint isolation - core-isolate-endpoint Auto endpoint isolation core-isolate-endpoint Set Isolated endpoint ID to the Incident context - setParentIncidentContext Set Isolated endpoint ID ... setParentIncidentContext Done Done Get endpoint info by endpoint ID - core-get-endpoints Get endpoint info by endp... core-get-endpoints Set endpoint IDs to isolate - SetAndHandleEmpty Set endpoint IDs to isolate SetAndHandleEmpty Should isolate the device? Should isolate the device? Set Isolated endpoint ID to the Incident context - setParentIncidentContext Set Isolated endpoint ID ... setParentIncidentContext Is the endpoint ID or the endpoint name defined? Is the endpoint ID or the... Get endpoint info by endpoint name - core-get-endpoints Get endpoint info by endp... core-get-endpoints is the endpoint already isolated? is the endpoint already i...