Isolate Endpoint - Generic Deprecated

Deprecated. Use the "Isolate Endpoint - Generic V2" playbook instead.

Common Playbooks · 6 tasks · 4 inputs · 14 outputs

Details

ID	`Isolate Endpoint - Generic`
From Version	5.0.0
Tasks	6

README

Isolates a given endpoint using the following integrations:

Carbon Black Enterprise Response
Palo Alto Networks Traps

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

Block Endpoint - Carbon Black Response
Traps Isolate Endpoint
Isolate Endpoint - Cybereason

Integrations

This playbook does not use any integrations.

Scripts

This playbook does not use any scripts.

Commands

This playbook does not use any commands.

Playbook Inputs

Name	Description	Required
Hostname	The hostname of the endpoint to block.	Optional
EndpointId	The Endpoint ID to isolate using Traps.	Optional

Playbook Outputs

Path	Description	Type
CbResponse.Sensors.CbSensorID	The Carbon Black Response Sensors IDs that has been isolated.	string
Endpoint	The isolated Endpoint.	string
Traps.Isolate.EndpointID	The ID of the Endpoint.	string
Traps.IsolateResult.Status	The status of the isolation operation.	string

Playbook Image

Isolate_Endpoint_Generic

Inputs

Hostname — Hostname of the endpoint for isolation.
EndpointId — Endpoint ID to isolate using Traps.
xdr_endpoint_id — The endpoint ID (string) to isolate using Cortex XDR. You can retrieve the string from the xdr-get-endpoints command.
IP — IP address of the endpoint for isolation.

Outputs

CbResponse.Sensors.CbSensorID — Carbon Black Response Sensors ids that has been isolated.
Endpoint — The isolated enpoint.
Traps.Isolate.EndpointID — The ID of the endpoint.
Traps.IsolateResult.Status — The status of the isolation operation.
Cybereason.Machine — Cybereason Machine name.
Cybereason.IsIsolated — Is the machine isolated.
Endpoint.Hostname — Hostname of the endpoint.
PaloAltoNetworksXDR.Endpoint.endpoint_id — The endpoint ID.
PaloAltoNetworksXDR.Endpoint.endpoint_name — The endpoint name.
PaloAltoNetworksXDR.Endpoint.endpoint_status — The status of the endpoint.
PaloAltoNetworksXDR.Endpoint.ip — The endpoint's IP addresses.
PaloAltoNetworksXDR.Endpoint.is_isolated — Whether the endpoint is isolated.
CbResponse.Sensors.Status — Sensor status.
CbResponse.Sensors.Isolated — Is sensor isolated.

Flowchart

Source

playbook-Isolate_Endpoint_-_Generic.yml playbook-Isolate_Endpoint_-_Generic_V2.yml playbook-Isolate_Endpoint_-_Generic_V2_6_8.yml playbook-Isolate_Endpoint_-_Generic_V2_6_8_README.md playbook-Isolate_Endpoint_-_Generic_V2_README.md

Download History Raw

id: Isolate Endpoint - Generic
version: -1
name: Isolate Endpoint - Generic
deprecated: true
description: Deprecated. Use the "Isolate Endpoint - Generic V2" playbook instead.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 20f01f93-7b37-4f3f-8c17-a466dac351ef
    type: start
    task:
      id: 20f01f93-7b37-4f3f-8c17-a466dac351ef
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "3"
      - "6"
      - "7"
      - "8"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 695,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "2":
    id: "2"
    taskid: 050d36dd-0ec3-4490-827e-e210ac5e9a04
    type: title
    task:
      id: 050d36dd-0ec3-4490-827e-e210ac5e9a04
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 695,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "3":
    id: "3"
    taskid: 33a00cbb-bc23-47d0-8062-81dbcc134d25
    type: playbook
    task:
      id: 33a00cbb-bc23-47d0-8062-81dbcc134d25
      version: -1
      name: Traps Isolate Endpoint
      playbookName: Traps Isolate Endpoint
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      EndpointId:
        complex:
          root: inputs.EndpointId
          transformers:
          - operator: uniq
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  "6":
    id: "6"
    taskid: 0342c5df-d2ff-448e-8ef1-3f4674c42bff
    type: playbook
    task:
      id: 0342c5df-d2ff-448e-8ef1-3f4674c42bff
      version: -1
      name: Isolate Endpoint - Cybereason
      description: Isolate Endpoint - Cybereason
      playbookName: Isolate Endpoint - Cybereason
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      Hostname:
        complex:
          root: inputs.Hostname
          transformers:
          - operator: uniq
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 480,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  "7":
    id: "7"
    taskid: 8045389b-6e5f-406f-834d-98fc70d8421a
    type: playbook
    task:
      id: 8045389b-6e5f-406f-834d-98fc70d8421a
      version: -1
      name: Cortex XDR - Isolate Endpoint
      playbookName: Cortex XDR - Isolate Endpoint
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      endpoint_id:
        complex:
          root: inputs.xdr_endpoint_id
          transformers:
          - operator: uniq
      hostname:
        complex:
          root: inputs.Hostname
          transformers:
          - operator: uniq
      ip_list:
        complex:
          root: inputs.IP
          transformers:
          - operator: uniq
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 910,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  "8":
    id: "8"
    taskid: ed275240-5110-4452-88ba-66244c7a914a
    type: playbook
    task:
      id: ed275240-5110-4452-88ba-66244c7a914a
      version: -1
      name: Block Endpoint - Carbon Black Response
      playbookName: Block Endpoint - Carbon Black Response
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      Hostname:
        complex:
          root: inputs.Hostname
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 1340,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 385,
        "width": 1670,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: Hostname
  value:
    complex:
      root: Endpoint
      accessor: Hostname
  required: false
  description: Hostname of the endpoint for isolation.
  playbookInputQuery:
- key: EndpointId
  value:
    complex:
      root: PaloAltoNetworksXDR
      accessor: Endpoint.endpoint_id
  required: false
  description: Endpoint ID to isolate using Traps.
  playbookInputQuery:
- key: xdr_endpoint_id
  value:
    complex:
      root: PaloAltoNetworksXDR
      accessor: Endpoint.endpoint_id
  required: false
  description: The endpoint ID (string) to isolate using Cortex XDR. You can retrieve the string from the xdr-get-endpoints command.
  playbookInputQuery:
- key: IP
  value:
    complex:
      root: IP
      accessor: Address
  required: false
  description: IP address of the endpoint for isolation.
  playbookInputQuery:
outputs:
- contextPath: CbResponse.Sensors.CbSensorID
  description: Carbon Black Response Sensors ids that has been isolated.
  type: string
- contextPath: Endpoint
  description: The isolated enpoint.
  type: string
- contextPath: Traps.Isolate.EndpointID
  description: The ID of the endpoint.
  type: string
- contextPath: Traps.IsolateResult.Status
  description: The status of the isolation operation.
  type: string
- contextPath: Cybereason.Machine
  description: Cybereason Machine name.
- contextPath: Cybereason.IsIsolated
  description: Is the machine isolated.
- contextPath: Endpoint.Hostname
  description: Hostname of the endpoint.
- contextPath: PaloAltoNetworksXDR.Endpoint.endpoint_id
  description: The endpoint ID.
- contextPath: PaloAltoNetworksXDR.Endpoint.endpoint_name
  description: The endpoint name.
- contextPath: PaloAltoNetworksXDR.Endpoint.endpoint_status
  description: The status of the endpoint.
- contextPath: PaloAltoNetworksXDR.Endpoint.ip
  description: The endpoint's IP addresses.
- contextPath: PaloAltoNetworksXDR.Endpoint.is_isolated
  description: Whether the endpoint is isolated.
- contextPath: CbResponse.Sensors.Status
  description: Sensor status.
  type: unknown
- contextPath: CbResponse.Sensors.Isolated
  description: Is sensor isolated.
  type: unknown
fromversion: 5.0.0
tests:
- No Test