Isolate Endpoint - Generic Deprecated

Deprecated. Use the "Isolate Endpoint - Generic V2" playbook instead.

Common Playbooks · 6 tasks · 4 inputs · 14 outputs

Inputs

  • Hostname — Hostname of the endpoint for isolation.
  • EndpointId — Endpoint ID to isolate using Traps.
  • xdr_endpoint_id — The endpoint ID (string) to isolate using Cortex XDR. You can retrieve the string from the xdr-get-endpoints command.
  • IP — IP address of the endpoint for isolation.

Outputs

  • CbResponse.Sensors.CbSensorID — Carbon Black Response Sensors ids that has been isolated.
  • Endpoint — The isolated enpoint.
  • Traps.Isolate.EndpointID — The ID of the endpoint.
  • Traps.IsolateResult.Status — The status of the isolation operation.
  • Cybereason.Machine — Cybereason Machine name.
  • Cybereason.IsIsolated — Is the machine isolated.
  • Endpoint.Hostname — Hostname of the endpoint.
  • PaloAltoNetworksXDR.Endpoint.endpoint_id — The endpoint ID.
  • PaloAltoNetworksXDR.Endpoint.endpoint_name — The endpoint name.
  • PaloAltoNetworksXDR.Endpoint.endpoint_status — The status of the endpoint.
  • PaloAltoNetworksXDR.Endpoint.ip — The endpoint's IP addresses.
  • PaloAltoNetworksXDR.Endpoint.is_isolated — Whether the endpoint is isolated.
  • CbResponse.Sensors.Status — Sensor status.
  • CbResponse.Sensors.Isolated — Is sensor isolated.

Flowchart

Start Start Done Done Traps Isolate Endpoint - Traps Isolate Endpoint Traps Isolate Endpoint Traps Isolate Endpoint Isolate Endpoint - Cybereason - Isolate Endpoint - Cybereason Isolate Endpoint - Cybere... Isolate Endpoint - Cybereason Cortex XDR - Isolate Endpoint - Cortex XDR - Isolate Endpoint Cortex XDR - Isolate Endp... Cortex XDR - Isolate Endpoint Block Endpoint - Carbon Black Response - Block Endpoint - Carbon Black Response Block Endpoint - Carbon B... Block Endpoint - Carbon Black...