Crowdstrike Falcon - Unisolate Endpoint

This playbook unisolates devices according to the device ID that is provided in the playbook input.

CrowdStrike Falcon · 7 tasks · 1 input · 0 outputs

Inputs

  • Endpoint_id — The endpoint ID/device ID that you want to unisolate.

Commands used

cs-falcon-lift-host-containment cs-falcon-search-device

Flowchart

no yes yes yes Start Start Is Crowdstrike Falcon enabled? - IsIntegrationAvailable Is Crowdstrike Falcon ena... IsIntegrationAvailable Done Done Is there a device ID? Is there a device ID? Get device info - cs-falcon-search-device Get device info cs-falcon-search-device Is device contained? Is device contained? Unisolate device - cs-falcon-lift-host-containment Unisolate device cs-falcon-lift-host-containment