Isolate Endpoint - Generic V2

This playbook isolates a given endpoint using various endpoint product integrations. Make sure to provide valid playbook inputs for the integration you are using.

Common Playbooks · 8 tasks · 3 inputs · 20 outputs

Details

IDIsolate Endpoint - Generic V2
From Version5.5.0
To Version6.7.9
Tasks8

README

This playbook isolates a given endpoint using various endpoint product integrations.
Make sure to provide valid playbook inputs for the integration you are using.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • Block Endpoint - Carbon Black Response V2
  • FireEye HX - Isolate Endpoint
  • Cortex XDR - Isolate Endpoint
  • Crowdstrike Falcon - Isolate Endpoint
  • Isolate Endpoint - Cybereason
  • Microsoft Defender For Endpoint - Isolate Endpoint

Integrations

This playbook does not use any integrations.

Scripts

This playbook does not use any scripts.

Commands

This playbook does not use any commands.

Playbook Inputs

Name Description Default Value Required
Endpoint_hostname The host name of the endpoint to isolate.   Optional
Endpoint_ip The IP of the endpoint to isolate.   Optional
Endpoint_id The ID of the endpoint to isolate.   Optional

Playbook Outputs

Path Description Type
CbResponse.Sensors.CbSensorID Carbon Black Response Sensor IDs that were isolated. string
Endpoint The isolated endpoint. string
Traps.Isolate.EndpointID The ID of the endpoint. string
Traps.IsolateResult.Status The status of the isolation operation. string
Cybereason.Machine The Cybereason machine name. unknown
Cybereason.IsIsolated Whether the machine is isolated. unknown
Endpoint.Hostname The host name of the endpoint. unknown
PaloAltoNetworksXDR.Endpoint.endpoint_id The endpoint ID. unknown
PaloAltoNetworksXDR.Endpoint.endpoint_name The endpoint name. unknown
PaloAltoNetworksXDR.Endpoint.endpoint_status The status of the endpoint. unknown
PaloAltoNetworksXDR.Endpoint.ip The endpoint’s IP address. unknown
PaloAltoNetworksXDR.Endpoint.is_isolated Whether the endpoint is isolated. unknown
CbResponse.Sensors.Status The sensor status. unknown
CbResponse.Sensors.Isolated Whether the sensor is isolated. unknown
MicrosoftATP.MachineAction.ID The machine action ID. string
MicrosoftATP.IsolateList The IDs of the machines that were isolated. string
MicrosoftATP.NonIsolateList The IDs of the machines that will not be isolated. string
MicrosoftATP.IncorrectIDs Incorrect device IDs entered. string
MicrosoftATP.IncorrectHostnames Incorrect device host names entered. string
MicrosoftATP.IncorrectIPs Incorrect device IPs entered. string

Playbook Image

Isolate Endpoint - Generic V2

Inputs

  • Endpoint_hostname — The host name of the endpoint to isolate.
  • Endpoint_ip — The IP of the endpoint to isolate.
  • Endpoint_id — The ID of the endpoint to isolate.

Outputs

  • CbResponse.Sensors.CbSensorID — Carbon Black Response Sensor IDs that were isolated.
  • Endpoint — The isolated endpoint.
  • Traps.Isolate.EndpointID — The ID of the endpoint.
  • Traps.IsolateResult.Status — The status of the isolation operation.
  • Cybereason.Machine — The Cybereason machine name.
  • Cybereason.IsIsolated — Whether the machine is isolated.
  • Endpoint.Hostname — The host name of the endpoint.
  • PaloAltoNetworksXDR.Endpoint.endpoint_id — The endpoint ID.
  • PaloAltoNetworksXDR.Endpoint.endpoint_name — The endpoint name.
  • PaloAltoNetworksXDR.Endpoint.endpoint_status — The status of the endpoint.
  • PaloAltoNetworksXDR.Endpoint.ip — The endpoint's IP address.
  • PaloAltoNetworksXDR.Endpoint.is_isolated — Whether the endpoint is isolated.
  • CbResponse.Sensors.Status — The sensor status.
  • CbResponse.Sensors.Isolated — Whether the sensor is isolated.
  • MicrosoftATP.MachineAction.ID — The machine action ID.
  • MicrosoftATP.IsolateList — The IDs of the machines that were isolated.
  • MicrosoftATP.NonIsolateList — The IDs of the machines that will not be isolated.
  • MicrosoftATP.IncorrectIDs — Incorrect device IDs entered.
  • MicrosoftATP.IncorrectHostnames — Incorrect device host names entered.
  • MicrosoftATP.IncorrectIPs — Incorrect device IPs entered.

Flowchart

Start Start Done Done Isolate Endpoint - Cybereason - Isolate Endpoint - Cybereason Isolate Endpoint - Cybere... Isolate Endpoint - Cybereason Cortex XDR - Isolate Endpoint - Cortex XDR - Isolate Endpoint Cortex XDR - Isolate Endp... Cortex XDR - Isolate Endpoint Crowdstrike Falcon - Isolate Endpoint - Crowdstrike Falcon - Isolate Endpoint Crowdstrike Falcon - Isol... Crowdstrike Falcon - Isolate ... FireEye HX - Isolate Endpoint - FireEye HX - Isolate Endpoint FireEye HX - Isolate Endp... FireEye HX - Isolate Endpoint Block Endpoint - Carbon Black Response V2 - Block Endpoint - Carbon Black Response V2 Block Endpoint - Carbon B... Block Endpoint - Carbon Black... Microsoft Defender For Endpoint - Isolate Endpoint - Microsoft Defender For Endpoint - Isolate Endpoint Microsoft Defender For En... Microsoft Defender For Endpoi...

Source

playbook-Isolate_Endpoint_-_Generic_V2.yml playbook-Isolate_Endpoint_-_Generic_V2_6_8.yml playbook-Isolate_Endpoint_-_Generic_V2_6_8_README.md
Download History Raw 
This playbook isolates a given endpoint using various endpoint product integrations.
Make sure to provide valid playbook inputs for the integration you are using.

## Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

### Sub-playbooks

* Microsoft Defender For Endpoint - Isolate Endpoint
* FireEye HX - Isolate Endpoint
* Block Endpoint - Carbon Black Response V2.1
* Isolate Endpoint - Cybereason
* Crowdstrike Falcon - Isolate Endpoint
* Cortex XDR - Isolate Endpoint

### Integrations

This playbook does not use any integrations.

### Scripts

This playbook does not use any scripts.

### Commands

* core-isolate-endpoint

## Playbook Inputs

---

| **Name** | **Description** | **Default Value** | **Required** |
| --- | --- | --- | --- |
| Endpoint_hostname | The host name of the endpoint to isolate. |  | Optional |
| Endpoint_ip | The IP of the endpoint to isolate. |  | Optional |
| Endpoint_id | The ID of the endpoint to isolate. |  | Optional |

## Playbook Outputs

---

| **Path** | **Description** | **Type** |
| --- | --- | --- |
| Endpoint | The isolated endpoint. | string |
| Traps.Isolate.EndpointID | The ID of the endpoint. | string |
| Traps.IsolateResult.Status | The status of the isolation operation. | string |
| Cybereason.Machine | The Cybereason machine name. | unknown |
| Cybereason.IsIsolated | Whether the machine is isolated. | unknown |
| Endpoint.Hostname | The host name of the endpoint. | unknown |
| PaloAltoNetworksXDR.Endpoint.endpoint_id | The endpoint ID. | unknown |
| PaloAltoNetworksXDR.Endpoint.endpoint_name | The endpoint name. | unknown |
| PaloAltoNetworksXDR.Endpoint.endpoint_status | The status of the endpoint. | unknown |
| PaloAltoNetworksXDR.Endpoint.ip | The endpoint's IP address. | unknown |
| PaloAltoNetworksXDR.Endpoint.is_isolated | Whether the endpoint is isolated. | unknown |
| MicrosoftATP.MachineAction.ID | The machine action ID. | string |
| MicrosoftATP.IsolateList | The IDs of the machines that were isolated. | string |
| MicrosoftATP.NonIsolateList | The IDs of the machines that will not be isolated. | string |
| MicrosoftATP.IncorrectIDs | Incorrect device IDs entered. | string |
| MicrosoftATP.IncorrectHostnames | Incorrect device host names entered. | string |
| MicrosoftATP.IncorrectIPs | Incorrect device IPs entered. | string |
| Core.Isolation.endpoint_id | The ID of the isolated endpoint. | string |
| CarbonBlackEDR.Sensor | The sensor info. | unknown |
| CarbonBlackEDR.Sensor.id | The sensor id of this sensor. | unknown |
| CarbonBlackEDR.Sensor.is_isolating | Boolean representing the sensor-reported isolation status. | unknown |
| CarbonBlackEDR.Sensor.status | The sensor status. | unknown |

## Playbook Image

---

![Isolate Endpoint - Generic V2](../doc_files/Isolate_Endpoint_-_Generic_V2.png)