Get endpoint details - Generic Deprecated

Deprecated. Use the `Endpoint Enrichment - Generic v2.1` playbook instead. This playbook uses the generic command !endpoint to retrieve details on a specific endpoint. This command currently supports the following integrations: - Palo Alto Networks Cortex XDR - Investigation and Response. - CrowdStrike Falcon.

Common Playbooks · 17 tasks · 3 inputs · 8 outputs

Inputs

  • Endpoint_id — The ID of the endpoint that you want to get details about.
  • Endpoint_ip — The IP of the endpoint that you want to get details about.
  • Endpoint_hostname — The hostname of the endpoint that you want to get details about.

Outputs

  • Endpoint.Hostname — The endpoint's hostname.
  • Endpoint.OS — The endpoint's operation system.
  • Endpoint.IPAddress — The endpoint's IP address or list of IP addresses.
  • Endpoint.ID — The endpoint's ID.
  • Endpoint.Status — The endpoint's status.
  • Endpoint.IsIsolated — Endpoint isolation status.
  • Endpoint.MACAddress — Endpoint MAC address.
  • Endpoint.Vendor — The integration name of the endpoint vendor.

Commands used

endpoint

Flowchart

yes yes yes yes yes yes yes yes yes Start Start Is the endpoint id was provided? Is the endpoint id was pr... Get endpoint by ID - endpoint Get endpoint by ID endpoint Is the hostname provided? Is the hostname provided? Get endpoint by hostname - endpoint Get endpoint by hostname endpoint Done Done Is the endpoint IP provided? Is the endpoint IP provided? Get endpoint by IP - endpoint Get endpoint by IP endpoint Is the endpoint details retrieved by ID? Is the endpoint details r... Is agent ID provided? Is agent ID provided? Set endpoint ID to context - Set Set endpoint ID to context Set Is the endpoint details retrieved by hostname? Is the endpoint details r... Was hostname provided? Was hostname provided? Set endpoint hostname to context - Set Set endpoint hostname to ... Set Is the endpoint details retrieved by IP? Is the endpoint details r... Set endpoint IP to context - Set Set endpoint IP to context Set Was endpoint IP provided? Was endpoint IP provided?