Crowdstrike Falcon - Isolate Endpoint

This playbook will auto isolate endpoints by the device ID that was provided in the playbook.

CrowdStrike Falcon · 7 tasks · 1 input · 0 outputs

Inputs

  • Device_id — The device ID to isolate.

Commands used

cs-falcon-contain-host cs-falcon-search-device

Flowchart

no yes yes yes Start Start Is Crowdstrike Falcon enabled? - IsIntegrationAvailable Is Crowdstrike Falcon en... IsIntegrationAvailable Done Done Is there Device ID? Is there Device ID? Get device info - cs-falcon-search-device Get device info cs-falcon-search-device Is the device ready for isolation? Is the device ready for i... Isolate endpoint - cs-falcon-contain-host Isolate endpoint cs-falcon-contain-host