Isolate Endpoint - Generic V2

This playbook isolates a given endpoint using various endpoint product integrations. Make sure to provide valid playbook inputs for the integration you are using.

Common Playbooks · 8 tasks · 3 inputs · 20 outputs

Inputs

  • Endpoint_hostname — The host name of the endpoint to isolate.
  • Endpoint_ip — The IP of the endpoint to isolate.
  • Endpoint_id — The ID of the endpoint to isolate.

Outputs

  • CbResponse.Sensors.CbSensorID — Carbon Black Response Sensor IDs that were isolated.
  • Endpoint — The isolated endpoint.
  • Traps.Isolate.EndpointID — The ID of the endpoint.
  • Traps.IsolateResult.Status — The status of the isolation operation.
  • Cybereason.Machine — The Cybereason machine name.
  • Cybereason.IsIsolated — Whether the machine is isolated.
  • Endpoint.Hostname — The host name of the endpoint.
  • PaloAltoNetworksXDR.Endpoint.endpoint_id — The endpoint ID.
  • PaloAltoNetworksXDR.Endpoint.endpoint_name — The endpoint name.
  • PaloAltoNetworksXDR.Endpoint.endpoint_status — The status of the endpoint.
  • PaloAltoNetworksXDR.Endpoint.ip — The endpoint's IP address.
  • PaloAltoNetworksXDR.Endpoint.is_isolated — Whether the endpoint is isolated.
  • CbResponse.Sensors.Status — The sensor status.
  • CbResponse.Sensors.Isolated — Whether the sensor is isolated.
  • MicrosoftATP.MachineAction.ID — The machine action ID.
  • MicrosoftATP.IsolateList — The IDs of the machines that were isolated.
  • MicrosoftATP.NonIsolateList — The IDs of the machines that will not be isolated.
  • MicrosoftATP.IncorrectIDs — Incorrect device IDs entered.
  • MicrosoftATP.IncorrectHostnames — Incorrect device host names entered.
  • MicrosoftATP.IncorrectIPs — Incorrect device IPs entered.

Flowchart

Start Start Done Done Isolate Endpoint - Cybereason - Isolate Endpoint - Cybereason Isolate Endpoint - Cybere... Isolate Endpoint - Cybereason Cortex XDR - Isolate Endpoint - Cortex XDR - Isolate Endpoint Cortex XDR - Isolate Endp... Cortex XDR - Isolate Endpoint Crowdstrike Falcon - Isolate Endpoint - Crowdstrike Falcon - Isolate Endpoint Crowdstrike Falcon - Isol... Crowdstrike Falcon - Isolate ... FireEye HX - Isolate Endpoint - FireEye HX - Isolate Endpoint FireEye HX - Isolate Endp... FireEye HX - Isolate Endpoint Block Endpoint - Carbon Black Response V2 - Block Endpoint - Carbon Black Response V2 Block Endpoint - Carbon B... Block Endpoint - Carbon Black... Microsoft Defender For Endpoint - Isolate Endpoint - Microsoft Defender For Endpoint - Isolate Endpoint Microsoft Defender For En... Microsoft Defender For Endpoi...