Isolate Endpoint - Generic V2

contentitemexportablefields:
  contentitemfields:
    propagationLabels:
    - all
description: "This playbook isolates a given endpoint using various endpoint product integrations.\nMake sure to provide valid playbook inputs for the integration you are using."
id: Isolate Endpoint - Generic V2
inputs:
- description: The host name of the endpoint to isolate.
  key: Endpoint_hostname
  playbookInputQuery:
  required: false
  value: {}
- description: The IP of the endpoint to isolate.
  key: Endpoint_ip
  playbookInputQuery:
  required: false
  value: {}
- description: The ID of the endpoint to isolate.
  key: Endpoint_id
  playbookInputQuery:
  required: false
  value: {}
name: Isolate Endpoint - Generic V2
outputs:
- contextPath: CbResponse.Sensors.CbSensorID
  description: Carbon Black Response Sensor IDs that were isolated.
  type: string
- contextPath: Endpoint
  description: The isolated endpoint.
  type: string
- contextPath: Traps.Isolate.EndpointID
  description: The ID of the endpoint.
  type: string
- contextPath: Traps.IsolateResult.Status
  description: The status of the isolation operation.
  type: string
- contextPath: Cybereason.Machine
  description: The Cybereason machine name.
- contextPath: Cybereason.IsIsolated
  description: Whether the machine is isolated.
- contextPath: Endpoint.Hostname
  description: The host name of the endpoint.
- contextPath: PaloAltoNetworksXDR.Endpoint.endpoint_id
  description: The endpoint ID.
- contextPath: PaloAltoNetworksXDR.Endpoint.endpoint_name
  description: The endpoint name.
- contextPath: PaloAltoNetworksXDR.Endpoint.endpoint_status
  description: The status of the endpoint.
- contextPath: PaloAltoNetworksXDR.Endpoint.ip
  description: The endpoint's IP address.
- contextPath: PaloAltoNetworksXDR.Endpoint.is_isolated
  description: Whether the endpoint is isolated.
- contextPath: CbResponse.Sensors.Status
  description: The sensor status.
  type: unknown
- contextPath: CbResponse.Sensors.Isolated
  description: Whether the sensor is isolated.
  type: unknown
- contextPath: MicrosoftATP.MachineAction.ID
  description: The machine action ID.
  type: string
- contextPath: MicrosoftATP.IsolateList
  description: The IDs of the machines that were isolated.
  type: string
- contextPath: MicrosoftATP.NonIsolateList
  description: The IDs of the machines that will not be isolated.
  type: string
- contextPath: MicrosoftATP.IncorrectIDs
  description: Incorrect device IDs entered.
  type: string
- contextPath: MicrosoftATP.IncorrectHostnames
  description: Incorrect device host names entered.
  type: string
- contextPath: MicrosoftATP.IncorrectIPs
  description: Incorrect device IPs entered.
  type: string
starttaskid: '0'
tasks:
  '0':
    id: '0'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '6'
      - '7'
      - '9'
      - '10'
      - '11'
      - '12'
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      id: 20f01f93-7b37-4f3f-8c17-a466dac351ef
      iscommand: false
      name: ''
      version: -1
      description: ''
    taskid: 20f01f93-7b37-4f3f-8c17-a466dac351ef
    timertriggers: []
    type: start
    view: "{\n  \"position\": {\n    \"x\": 1125,\n    \"y\": 50\n  }\n}"
  '2':
    id: '2'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      id: 050d36dd-0ec3-4490-827e-e210ac5e9a04
      iscommand: false
      name: Done
      type: title
      version: -1
      description: ''
    taskid: 050d36dd-0ec3-4490-827e-e210ac5e9a04
    timertriggers: []
    type: title
    view: "{\n  \"position\": {\n    \"x\": 1125,\n    \"y\": 370\n  }\n}"
  '6':
    id: '6'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    loop:
      exitCondition: ''
      iscommand: false
      max: 100
      wait: 1
    nexttasks:
      '#none#':
      - '2'
    note: false
    quietmode: 0
    scriptarguments:
      Hostname:
        simple: ${inputs.Endpoint_hostname}
    separatecontext: true
    skipunavailable: true
    task:
      brand: ''
      description: This playbook isolates an endpoint based on the hostname provided.
      id: 31a268a0-3862-4dcb-8549-b55d0ad936a0
      iscommand: false
      name: Isolate Endpoint - Cybereason
      playbookName: Isolate Endpoint - Cybereason
      type: playbook
      version: -1
    taskid: 31a268a0-3862-4dcb-8549-b55d0ad936a0
    timertriggers: []
    type: playbook
    view: "{\n  \"position\": {\n    \"x\": 50,\n    \"y\": 195\n  }\n}"
  '7':
    id: '7'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    loop:
      exitCondition: ''
      iscommand: false
      max: 100
      wait: 1
    nexttasks:
      '#none#':
      - '2'
    note: false
    quietmode: 0
    scriptarguments:
      endpoint_id:
        simple: ${inputs.Endpoint_id}
      hostname:
        simple: ${inputs.Endpoint_hostname}
      ip_list:
        simple: ${inputs.Endpoint_ip}
    separatecontext: true
    skipunavailable: true
    task:
      brand: ''
      description: This playbook accepts an XDR endpoint ID and isolates it using the 'Palo Alto Networks Cortex XDR - Investigation and Response' integration.
      id: 46562ad2-14ed-4064-8ce8-9adfb791d660
      iscommand: false
      name: Cortex XDR - Isolate Endpoint
      playbookName: Cortex XDR - Isolate Endpoint
      type: playbook
      version: -1
    taskid: 46562ad2-14ed-4064-8ce8-9adfb791d660
    timertriggers: []
    type: playbook
    view: "{\n  \"position\": {\n    \"x\": 480,\n    \"y\": 195\n  }\n}"
  '9':
    id: '9'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    loop:
      exitCondition: ''
      iscommand: false
      max: 100
      wait: 1
    nexttasks:
      '#none#':
      - '2'
    note: false
    quietmode: 0
    scriptarguments:
      Device_id:
        simple: ${inputs.Endpoint_id}
    separatecontext: true
    skipunavailable: true
    task:
      brand: ''
      description: This playbook will auto isolate endpoints by the device ID that was provided in the playbook.
      id: 2604374d-9538-4451-8064-2f5bb5c6dd81
      iscommand: false
      name: Crowdstrike Falcon - Isolate Endpoint
      playbookId: Crowdstrike Falcon - Isolate Endpoint
      type: playbook
      version: -1
    taskid: 2604374d-9538-4451-8064-2f5bb5c6dd81
    timertriggers: []
    type: playbook
    view: "{\n  \"position\": {\n    \"x\": 910,\n    \"y\": 195\n  }\n}"
  '10':
    id: '10'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    loop:
      exitCondition: ''
      iscommand: false
      max: 100
      wait: 1
    nexttasks:
      '#none#':
      - '2'
    note: false
    quietmode: 0
    scriptarguments:
      Endpoint_id:
        simple: ${inputs.Endpoint_id}
      Hostname:
        simple: ${inputs.Endpoint_hostname}
    separatecontext: true
    skipunavailable: true
    task:
      brand: ''
      description: This playbook will auto isolate endpoints by the endpoint ID that was provided in the playbook.
      id: 48226108-0787-44b0-80f6-cf333758b5e8
      iscommand: false
      name: FireEye HX - Isolate Endpoint
      playbookName: FireEye HX - Isolate Endpoint
      type: playbook
      version: -1
    taskid: 48226108-0787-44b0-80f6-cf333758b5e8
    timertriggers: []
    type: playbook
    view: "{\n  \"position\": {\n    \"x\": 1340,\n    \"y\": 195\n  }\n}"
  '11':
    id: '11'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    loop:
      exitCondition: ''
      iscommand: false
      max: 100
      wait: 1
    nexttasks:
      '#none#':
      - '2'
    note: false
    quietmode: 0
    scriptarguments:
      Hostname:
        simple: ${inputs.Endpoint_hostname}
      Sensor_id:
        simple: ${inputs.Endpoint_id}
    separatecontext: true
    skipunavailable: true
    task:
      brand: ''
      description: Carbon Black Response - isolate an endpoint for a given hostname.
      id: 04a17761-3b84-492f-87c6-ef29fc4adc7d
      iscommand: false
      name: Block Endpoint - Carbon Black Response V2
      playbookName: Block Endpoint - Carbon Black Response V2
      type: playbook
      version: -1
    taskid: 04a17761-3b84-492f-87c6-ef29fc4adc7d
    timertriggers: []
    type: playbook
    view: "{\n  \"position\": {\n    \"x\": 1770,\n    \"y\": 195\n  }\n}"
  '12':
    id: '12'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    loop:
      exitCondition: ''
      iscommand: false
      max: 100
      wait: 1
    nexttasks:
      '#none#':
      - '2'
    note: false
    quietmode: 0
    scriptarguments:
      Device_IP:
        simple: ${inputs.Endpoint_ip}
      Device_id:
        simple: ${inputs.Endpoint_id}
      Hostname:
        simple: ${inputs.Endpoint_hostname}
    separatecontext: true
    skipunavailable: true
    task:
      brand: ''
      id: d438379a-5602-49f9-8d6d-404f9dbe3919
      iscommand: false
      name: Microsoft Defender For Endpoint - Isolate Endpoint
      playbookId: Microsoft Defender For Endpoint - Isolate Endpoint
      type: playbook
      version: -1
      description: ''
    taskid: d438379a-5602-49f9-8d6d-404f9dbe3919
    timertriggers: []
    type: playbook
    view: "{\n  \"position\": {\n    \"x\": 2200,\n    \"y\": 195\n  }\n}"
version: -1
view: "{\n  \"linkLabelsPosition\": {},\n  \"paper\": {\n    \"dimensions\": {\n      \"height\": 385,\n      \"width\": 2530,\n      \"x\": 50,\n      \"y\": 50\n    }\n  }\n}"
tests:
- Isolate and unisolate endpoint - test
fromversion: 5.5.0
toversion: 6.7.9
supportedModules:
- cloud_runtime_security
- xsiam
- edr