Isolate Endpoint - Generic Deprecated

Deprecated. Use the "Isolate Endpoint - Generic V2" playbook instead.

Common Playbooks · 6 tasks · 4 inputs · 14 outputs

Details

ID	`Isolate Endpoint - Generic`
From Version	5.0.0
Tasks	6

README

Isolates a given endpoint using the following integrations:

Carbon Black Enterprise Response
Palo Alto Networks Traps

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

Block Endpoint - Carbon Black Response
Traps Isolate Endpoint
Isolate Endpoint - Cybereason

Integrations

This playbook does not use any integrations.

Scripts

This playbook does not use any scripts.

Commands

This playbook does not use any commands.

Playbook Inputs

Name	Description	Required
Hostname	The hostname of the endpoint to block.	Optional
EndpointId	The Endpoint ID to isolate using Traps.	Optional

Playbook Outputs

Path	Description	Type
CbResponse.Sensors.CbSensorID	The Carbon Black Response Sensors IDs that has been isolated.	string
Endpoint	The isolated Endpoint.	string
Traps.Isolate.EndpointID	The ID of the Endpoint.	string
Traps.IsolateResult.Status	The status of the isolation operation.	string

Playbook Image

Isolate_Endpoint_Generic

Inputs

Hostname — Hostname of the endpoint for isolation.
EndpointId — Endpoint ID to isolate using Traps.
xdr_endpoint_id — The endpoint ID (string) to isolate using Cortex XDR. You can retrieve the string from the xdr-get-endpoints command.
IP — IP address of the endpoint for isolation.

Outputs

CbResponse.Sensors.CbSensorID — Carbon Black Response Sensors ids that has been isolated.
Endpoint — The isolated enpoint.
Traps.Isolate.EndpointID — The ID of the endpoint.
Traps.IsolateResult.Status — The status of the isolation operation.
Cybereason.Machine — Cybereason Machine name.
Cybereason.IsIsolated — Is the machine isolated.
Endpoint.Hostname — Hostname of the endpoint.
PaloAltoNetworksXDR.Endpoint.endpoint_id — The endpoint ID.
PaloAltoNetworksXDR.Endpoint.endpoint_name — The endpoint name.
PaloAltoNetworksXDR.Endpoint.endpoint_status — The status of the endpoint.
PaloAltoNetworksXDR.Endpoint.ip — The endpoint's IP addresses.
PaloAltoNetworksXDR.Endpoint.is_isolated — Whether the endpoint is isolated.
CbResponse.Sensors.Status — Sensor status.
CbResponse.Sensors.Isolated — Is sensor isolated.

Flowchart

Source

playbook-Isolate_Endpoint_-_Generic.yml playbook-Isolate_Endpoint_-_Generic_V2.yml playbook-Isolate_Endpoint_-_Generic_V2_6_8.yml playbook-Isolate_Endpoint_-_Generic_V2_6_8_README.md playbook-Isolate_Endpoint_-_Generic_V2_README.md

Download History Raw

contentitemexportablefields:
  contentitemfields:
    propagationLabels:
    - all
description: "This playbook isolates a given endpoint using various endpoint product integrations.\nMake sure to provide valid playbook inputs for the integration you are using."
id: Isolate Endpoint - Generic V2
inputs:
- description: The host name of the endpoint to isolate.
  key: Endpoint_hostname
  playbookInputQuery:
  required: false
  value: {}
- description: The IP of the endpoint to isolate.
  key: Endpoint_ip
  playbookInputQuery:
  required: false
  value: {}
- description: The ID of the endpoint to isolate.
  key: Endpoint_id
  playbookInputQuery:
  required: false
  value: {}
name: Isolate Endpoint - Generic V2
outputs:
- contextPath: CbResponse.Sensors.CbSensorID
  description: Carbon Black Response Sensor IDs that were isolated.
  type: string
- contextPath: Endpoint
  description: The isolated endpoint.
  type: string
- contextPath: Traps.Isolate.EndpointID
  description: The ID of the endpoint.
  type: string
- contextPath: Traps.IsolateResult.Status
  description: The status of the isolation operation.
  type: string
- contextPath: Cybereason.Machine
  description: The Cybereason machine name.
- contextPath: Cybereason.IsIsolated
  description: Whether the machine is isolated.
- contextPath: Endpoint.Hostname
  description: The host name of the endpoint.
- contextPath: PaloAltoNetworksXDR.Endpoint.endpoint_id
  description: The endpoint ID.
- contextPath: PaloAltoNetworksXDR.Endpoint.endpoint_name
  description: The endpoint name.
- contextPath: PaloAltoNetworksXDR.Endpoint.endpoint_status
  description: The status of the endpoint.
- contextPath: PaloAltoNetworksXDR.Endpoint.ip
  description: The endpoint's IP address.
- contextPath: PaloAltoNetworksXDR.Endpoint.is_isolated
  description: Whether the endpoint is isolated.
- contextPath: CbResponse.Sensors.Status
  description: The sensor status.
  type: unknown
- contextPath: CbResponse.Sensors.Isolated
  description: Whether the sensor is isolated.
  type: unknown
- contextPath: MicrosoftATP.MachineAction.ID
  description: The machine action ID.
  type: string
- contextPath: MicrosoftATP.IsolateList
  description: The IDs of the machines that were isolated.
  type: string
- contextPath: MicrosoftATP.NonIsolateList
  description: The IDs of the machines that will not be isolated.
  type: string
- contextPath: MicrosoftATP.IncorrectIDs
  description: Incorrect device IDs entered.
  type: string
- contextPath: MicrosoftATP.IncorrectHostnames
  description: Incorrect device host names entered.
  type: string
- contextPath: MicrosoftATP.IncorrectIPs
  description: Incorrect device IPs entered.
  type: string
starttaskid: '0'
tasks:
  '0':
    id: '0'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '6'
      - '7'
      - '9'
      - '10'
      - '11'
      - '12'
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      id: 20f01f93-7b37-4f3f-8c17-a466dac351ef
      iscommand: false
      name: ''
      version: -1
      description: ''
    taskid: 20f01f93-7b37-4f3f-8c17-a466dac351ef
    timertriggers: []
    type: start
    view: "{\n  \"position\": {\n    \"x\": 1125,\n    \"y\": 50\n  }\n}"
  '2':
    id: '2'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      id: 050d36dd-0ec3-4490-827e-e210ac5e9a04
      iscommand: false
      name: Done
      type: title
      version: -1
      description: ''
    taskid: 050d36dd-0ec3-4490-827e-e210ac5e9a04
    timertriggers: []
    type: title
    view: "{\n  \"position\": {\n    \"x\": 1125,\n    \"y\": 370\n  }\n}"
  '6':
    id: '6'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    loop:
      exitCondition: ''
      iscommand: false
      max: 100
      wait: 1
    nexttasks:
      '#none#':
      - '2'
    note: false
    quietmode: 0
    scriptarguments:
      Hostname:
        simple: ${inputs.Endpoint_hostname}
    separatecontext: true
    skipunavailable: true
    task:
      brand: ''
      description: This playbook isolates an endpoint based on the hostname provided.
      id: 31a268a0-3862-4dcb-8549-b55d0ad936a0
      iscommand: false
      name: Isolate Endpoint - Cybereason
      playbookName: Isolate Endpoint - Cybereason
      type: playbook
      version: -1
    taskid: 31a268a0-3862-4dcb-8549-b55d0ad936a0
    timertriggers: []
    type: playbook
    view: "{\n  \"position\": {\n    \"x\": 50,\n    \"y\": 195\n  }\n}"
  '7':
    id: '7'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    loop:
      exitCondition: ''
      iscommand: false
      max: 100
      wait: 1
    nexttasks:
      '#none#':
      - '2'
    note: false
    quietmode: 0
    scriptarguments:
      endpoint_id:
        simple: ${inputs.Endpoint_id}
      hostname:
        simple: ${inputs.Endpoint_hostname}
      ip_list:
        simple: ${inputs.Endpoint_ip}
    separatecontext: true
    skipunavailable: true
    task:
      brand: ''
      description: This playbook accepts an XDR endpoint ID and isolates it using the 'Palo Alto Networks Cortex XDR - Investigation and Response' integration.
      id: 46562ad2-14ed-4064-8ce8-9adfb791d660
      iscommand: false
      name: Cortex XDR - Isolate Endpoint
      playbookName: Cortex XDR - Isolate Endpoint
      type: playbook
      version: -1
    taskid: 46562ad2-14ed-4064-8ce8-9adfb791d660
    timertriggers: []
    type: playbook
    view: "{\n  \"position\": {\n    \"x\": 480,\n    \"y\": 195\n  }\n}"
  '9':
    id: '9'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    loop:
      exitCondition: ''
      iscommand: false
      max: 100
      wait: 1
    nexttasks:
      '#none#':
      - '2'
    note: false
    quietmode: 0
    scriptarguments:
      Device_id:
        simple: ${inputs.Endpoint_id}
    separatecontext: true
    skipunavailable: true
    task:
      brand: ''
      description: This playbook will auto isolate endpoints by the device ID that was provided in the playbook.
      id: 2604374d-9538-4451-8064-2f5bb5c6dd81
      iscommand: false
      name: Crowdstrike Falcon - Isolate Endpoint
      playbookId: Crowdstrike Falcon - Isolate Endpoint
      type: playbook
      version: -1
    taskid: 2604374d-9538-4451-8064-2f5bb5c6dd81
    timertriggers: []
    type: playbook
    view: "{\n  \"position\": {\n    \"x\": 910,\n    \"y\": 195\n  }\n}"
  '10':
    id: '10'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    loop:
      exitCondition: ''
      iscommand: false
      max: 100
      wait: 1
    nexttasks:
      '#none#':
      - '2'
    note: false
    quietmode: 0
    scriptarguments:
      Endpoint_id:
        simple: ${inputs.Endpoint_id}
      Hostname:
        simple: ${inputs.Endpoint_hostname}
    separatecontext: true
    skipunavailable: true
    task:
      brand: ''
      description: This playbook will auto isolate endpoints by the endpoint ID that was provided in the playbook.
      id: 48226108-0787-44b0-80f6-cf333758b5e8
      iscommand: false
      name: FireEye HX - Isolate Endpoint
      playbookName: FireEye HX - Isolate Endpoint
      type: playbook
      version: -1
    taskid: 48226108-0787-44b0-80f6-cf333758b5e8
    timertriggers: []
    type: playbook
    view: "{\n  \"position\": {\n    \"x\": 1340,\n    \"y\": 195\n  }\n}"
  '11':
    id: '11'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    loop:
      exitCondition: ''
      iscommand: false
      max: 100
      wait: 1
    nexttasks:
      '#none#':
      - '2'
    note: false
    quietmode: 0
    scriptarguments:
      Hostname:
        simple: ${inputs.Endpoint_hostname}
      Sensor_id:
        simple: ${inputs.Endpoint_id}
    separatecontext: true
    skipunavailable: true
    task:
      brand: ''
      description: Carbon Black Response - isolate an endpoint for a given hostname.
      id: 04a17761-3b84-492f-87c6-ef29fc4adc7d
      iscommand: false
      name: Block Endpoint - Carbon Black Response V2
      playbookName: Block Endpoint - Carbon Black Response V2
      type: playbook
      version: -1
    taskid: 04a17761-3b84-492f-87c6-ef29fc4adc7d
    timertriggers: []
    type: playbook
    view: "{\n  \"position\": {\n    \"x\": 1770,\n    \"y\": 195\n  }\n}"
  '12':
    id: '12'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    loop:
      exitCondition: ''
      iscommand: false
      max: 100
      wait: 1
    nexttasks:
      '#none#':
      - '2'
    note: false
    quietmode: 0
    scriptarguments:
      Device_IP:
        simple: ${inputs.Endpoint_ip}
      Device_id:
        simple: ${inputs.Endpoint_id}
      Hostname:
        simple: ${inputs.Endpoint_hostname}
    separatecontext: true
    skipunavailable: true
    task:
      brand: ''
      id: d438379a-5602-49f9-8d6d-404f9dbe3919
      iscommand: false
      name: Microsoft Defender For Endpoint - Isolate Endpoint
      playbookId: Microsoft Defender For Endpoint - Isolate Endpoint
      type: playbook
      version: -1
      description: ''
    taskid: d438379a-5602-49f9-8d6d-404f9dbe3919
    timertriggers: []
    type: playbook
    view: "{\n  \"position\": {\n    \"x\": 2200,\n    \"y\": 195\n  }\n}"
version: -1
view: "{\n  \"linkLabelsPosition\": {},\n  \"paper\": {\n    \"dimensions\": {\n      \"height\": 385,\n      \"width\": 2530,\n      \"x\": 50,\n      \"y\": 50\n    }\n  }\n}"
tests:
- Isolate and unisolate endpoint - test
fromversion: 5.5.0
toversion: 6.7.9
supportedModules:
- cloud_runtime_security
- xsiam
- edr