Cortex XDR - Isolate Endpoint

This playbook accepts an XDR endpoint ID and isolates it using the 'Palo Alto Networks Cortex XDR - Investigation and Response' integration.

Cortex XDR by Palo Alto Networks · 8 tasks · 3 inputs · 6 outputs

Inputs

  • endpoint_id — The endpoint ID (string) to isolate. You can retrieve the ID using the xdr-get-endpoints command.
  • hostname — A comma-separated list of hostnames.
  • ip_list — A comma-separated list of IP addresses.

Outputs

  • PaloAltoNetworksXDR.Endpoint.endpoint_id — The endpoint ID.
  • PaloAltoNetworksXDR.Endpoint.endpoint_name — The endpoint name.
  • PaloAltoNetworksXDR.Endpoint.endpoint_status — The status of the endpoint.
  • PaloAltoNetworksXDR.Endpoint.ip — A list of IP addresses.
  • PaloAltoNetworksXDR.Endpoint.is_isolated — Whether the endpoint is isolated.
  • Endpoint.Hostname — The hostname that is mapped to this endpoint.

Commands used

xdr-endpoint-isolate xdr-get-endpoints

Flowchart

yes Endpoint ID IP or Hostname yes Start Start Cortex XDR - isolate endpoint - xdr-endpoint-isolate Cortex XDR - isolate endp... xdr-endpoint-isolate Is 'Palo Alto Networks Cortex XDR - Investigation and Response' integration enabled? Is 'Palo Alto Networks Co... Done Done Is there an endpoint to isolate? Is there an endpoint to i... Cortex XDR - get endpoint ID - xdr-get-endpoints Cortex XDR - get endpoint ID xdr-get-endpoints Get endpoint status - xdr-get-endpoints Get endpoint status xdr-get-endpoints Is the endpoint ready for isolation? Is the endpoint ready for...