FireEye HX - Isolate Endpoint

This playbook will auto isolate endpoints by the endpoint ID that was provided in the playbook.

FireEye HX · 7 tasks · 2 inputs · 0 outputs

Details

IDFireEye HX - Isolate Endpoint
From Version5.5.0
Tasks7

README

This playbook will auto isolate endpoints by the endpoint ID that was provided in the playbook.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

FireEyeHXv2

Scripts

IsIntegrationAvailable

Commands

  • fireeye-hx-host-containment
  • fireeye-hx-get-host-information

Playbook Inputs

Name Description Default Value Required
Endpoint_id The endpoint ID or device ID to isolate.   Optional
Hostname The hostname to isolate.   Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

FireEye HX - Isolate Endpoint

Inputs

  • Endpoint_id — The endpoint ID or device ID to isolate.
  • Hostname — The hostname to isolate.

Commands used

fireeye-hx-get-host-information fireeye-hx-host-containment

Flowchart

no yes yes yes Start Start Is FireEye HX enabled? - IsIntegrationAvailable Is FireEye HX enabled? IsIntegrationAvailable Done Done Is there endpoint id? Is there endpoint id? Get host info - fireeye-hx-get-host-information Get host info fireeye-hx-get-host-information Is the device ready for isolation? Is the device ready for i... Isolate endpoint - fireeye-hx-host-containment Isolate endpoint fireeye-hx-host-containment

Source

playbook-FireEye_HX_-_Isolate_Endpoint.yml
Download History Raw 
id: 'FireEye HX - Isolate Endpoint'
version: -1
name: 'FireEye HX - Isolate Endpoint'
description: This playbook will auto isolate endpoints by the endpoint ID that was
  provided in the playbook.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 66ce18d3-a5eb-40c8-8424-597028d068df
    type: start
    task:
      id: 66ce18d3-a5eb-40c8-8424-597028d068df
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 140
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "1":
    id: "1"
    taskid: d399bde9-dd8a-4de5-8fa9-bc2c30202e48
    type: condition
    task:
      id: d399bde9-dd8a-4de5-8fa9-bc2c30202e48
      version: -1
      name: Is FireEye HX enabled?
      description: Returns 'yes' if integration brand is available. Otherwise returns
        'no'
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "2"
      "yes":
      - "3"
    scriptarguments:
      brandname:
        simple: FireEye HX
    results:
    - brandInstances
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 320
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "2":
    id: "2"
    taskid: e71526df-a0d8-4667-81a8-f3140088de36
    type: title
    task:
      id: e71526df-a0d8-4667-81a8-f3140088de36
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1850
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "3":
    id: "3"
    taskid: 3c7daaa3-17db-40e9-8891-d9aee3a469a8
    type: condition
    task:
      id: 3c7daaa3-17db-40e9-8891-d9aee3a469a8
      version: -1
      name: Is there endpoint id?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "4"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: inputs.Endpoint_id
            iscontext: true
    view: |-
      {
        "position": {
          "x": 760,
          "y": 520
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "4":
    id: "4"
    taskid: feb290f6-36ae-4e17-84d6-fd9a9a70eef9
    type: regular
    task:
      id: feb290f6-36ae-4e17-84d6-fd9a9a70eef9
      version: -1
      name: Get host info
      description: Get information on a host associated with an agent.
      script: '|||fireeye-hx-get-host-information'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      agentId:
        simple: ${inputs.Endpoint_id}
      hostName:
        simple: ${inputs.Hostname}
    continueonerror: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1060,
          "y": 780
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "5":
    id: "5"
    taskid: e853fa70-3ac6-4fcc-8f16-6b193e304208
    type: condition
    task:
      id: e853fa70-3ac6-4fcc-8f16-6b193e304208
      version: -1
      name: Is the device ready for isolation?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "6"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: FireEyeHX.Hosts.containment_state
            iscontext: true
          right:
            value:
              simple: normal
    view: |-
      {
        "position": {
          "x": 1060,
          "y": 970
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "6":
    id: "6"
    taskid: cfbb7f4b-51db-4496-8011-08fd13e943f3
    type: regular
    task:
      id: cfbb7f4b-51db-4496-8011-08fd13e943f3
      version: -1
      name: Isolate endpoint
      description: Apply containment for a specific host, so that it no longer has
        access to other systems.
      script: '|||fireeye-hx-host-containment'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      agentId:
        simple: ${inputs.Endpoint_id}
      hostName:
        simple: ${inputs.Hostname}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1060,
          "y": 1370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {
      "1_2_no": 0.73,
      "3_2_#default#": 0.22,
      "5_2_#default#": 0.39
    },
    "paper": {
      "dimensions": {
        "height": 1775,
        "width": 990,
        "x": 450,
        "y": 140
      }
    }
  }
inputs:
- key: Endpoint_id
  value: {}
  required: false
  description: The endpoint ID or device ID to isolate.
  playbookInputQuery:
- key: Hostname
  value: {}
  required: false
  description: The hostname to isolate.
  playbookInputQuery:
outputs: []
tests:
- FireEyeHX_v2
fromversion: 5.5.0