Isolate Endpoint - Generic Deprecated

Deprecated. Use the "Isolate Endpoint - Generic V2" playbook instead.

Common Playbooks · 6 tasks · 4 inputs · 14 outputs

Details

IDIsolate Endpoint - Generic
From Version5.0.0
Tasks6

README

Isolates a given endpoint using the following integrations:

  • Carbon Black Enterprise Response
  • Palo Alto Networks Traps

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • Block Endpoint - Carbon Black Response
  • Traps Isolate Endpoint
  • Isolate Endpoint - Cybereason

Integrations

This playbook does not use any integrations.

Scripts

This playbook does not use any scripts.

Commands

This playbook does not use any commands.

Playbook Inputs

Name Description Required
Hostname The hostname of the endpoint to block. Optional
EndpointId The Endpoint ID to isolate using Traps. Optional

Playbook Outputs

Path Description Type
CbResponse.Sensors.CbSensorID The Carbon Black Response Sensors IDs that has been isolated. string
Endpoint The isolated Endpoint. string
Traps.Isolate.EndpointID The ID of the Endpoint. string
Traps.IsolateResult.Status The status of the isolation operation. string

Playbook Image

Isolate_Endpoint_Generic

Inputs

  • Hostname — Hostname of the endpoint for isolation.
  • EndpointId — Endpoint ID to isolate using Traps.
  • xdr_endpoint_id — The endpoint ID (string) to isolate using Cortex XDR. You can retrieve the string from the xdr-get-endpoints command.
  • IP — IP address of the endpoint for isolation.

Outputs

  • CbResponse.Sensors.CbSensorID — Carbon Black Response Sensors ids that has been isolated.
  • Endpoint — The isolated enpoint.
  • Traps.Isolate.EndpointID — The ID of the endpoint.
  • Traps.IsolateResult.Status — The status of the isolation operation.
  • Cybereason.Machine — Cybereason Machine name.
  • Cybereason.IsIsolated — Is the machine isolated.
  • Endpoint.Hostname — Hostname of the endpoint.
  • PaloAltoNetworksXDR.Endpoint.endpoint_id — The endpoint ID.
  • PaloAltoNetworksXDR.Endpoint.endpoint_name — The endpoint name.
  • PaloAltoNetworksXDR.Endpoint.endpoint_status — The status of the endpoint.
  • PaloAltoNetworksXDR.Endpoint.ip — The endpoint's IP addresses.
  • PaloAltoNetworksXDR.Endpoint.is_isolated — Whether the endpoint is isolated.
  • CbResponse.Sensors.Status — Sensor status.
  • CbResponse.Sensors.Isolated — Is sensor isolated.

Flowchart

Start Start Done Done Traps Isolate Endpoint - Traps Isolate Endpoint Traps Isolate Endpoint Traps Isolate Endpoint Isolate Endpoint - Cybereason - Isolate Endpoint - Cybereason Isolate Endpoint - Cybere... Isolate Endpoint - Cybereason Cortex XDR - Isolate Endpoint - Cortex XDR - Isolate Endpoint Cortex XDR - Isolate Endp... Cortex XDR - Isolate Endpoint Block Endpoint - Carbon Black Response - Block Endpoint - Carbon Black Response Block Endpoint - Carbon B... Block Endpoint - Carbon Black...

Source

playbook-Isolate_Endpoint_-_Generic.yml playbook-Isolate_Endpoint_-_Generic_V2.yml playbook-Isolate_Endpoint_-_Generic_V2_6_8.yml playbook-Isolate_Endpoint_-_Generic_V2_6_8_README.md playbook-Isolate_Endpoint_-_Generic_V2_README.md
Download History Raw 
This playbook isolates a given endpoint using various endpoint product integrations.
Make sure to provide valid playbook inputs for the integration you are using.

## Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

### Sub-playbooks

* Microsoft Defender For Endpoint - Isolate Endpoint
* FireEye HX - Isolate Endpoint
* Block Endpoint - Carbon Black Response V2.1
* Isolate Endpoint - Cybereason
* Crowdstrike Falcon - Isolate Endpoint
* Cortex XDR - Isolate Endpoint

### Integrations

This playbook does not use any integrations.

### Scripts

This playbook does not use any scripts.

### Commands

* core-isolate-endpoint

## Playbook Inputs

---

| **Name** | **Description** | **Default Value** | **Required** |
| --- | --- | --- | --- |
| Endpoint_hostname | The host name of the endpoint to isolate. |  | Optional |
| Endpoint_ip | The IP of the endpoint to isolate. |  | Optional |
| Endpoint_id | The ID of the endpoint to isolate. |  | Optional |

## Playbook Outputs

---

| **Path** | **Description** | **Type** |
| --- | --- | --- |
| Endpoint | The isolated endpoint. | string |
| Traps.Isolate.EndpointID | The ID of the endpoint. | string |
| Traps.IsolateResult.Status | The status of the isolation operation. | string |
| Cybereason.Machine | The Cybereason machine name. | unknown |
| Cybereason.IsIsolated | Whether the machine is isolated. | unknown |
| Endpoint.Hostname | The host name of the endpoint. | unknown |
| PaloAltoNetworksXDR.Endpoint.endpoint_id | The endpoint ID. | unknown |
| PaloAltoNetworksXDR.Endpoint.endpoint_name | The endpoint name. | unknown |
| PaloAltoNetworksXDR.Endpoint.endpoint_status | The status of the endpoint. | unknown |
| PaloAltoNetworksXDR.Endpoint.ip | The endpoint's IP address. | unknown |
| PaloAltoNetworksXDR.Endpoint.is_isolated | Whether the endpoint is isolated. | unknown |
| MicrosoftATP.MachineAction.ID | The machine action ID. | string |
| MicrosoftATP.IsolateList | The IDs of the machines that were isolated. | string |
| MicrosoftATP.NonIsolateList | The IDs of the machines that will not be isolated. | string |
| MicrosoftATP.IncorrectIDs | Incorrect device IDs entered. | string |
| MicrosoftATP.IncorrectHostnames | Incorrect device host names entered. | string |
| MicrosoftATP.IncorrectIPs | Incorrect device IPs entered. | string |
| Core.Isolation.endpoint_id | The ID of the isolated endpoint. | string |
| CarbonBlackEDR.Sensor | The sensor info. | unknown |
| CarbonBlackEDR.Sensor.id | The sensor id of this sensor. | unknown |
| CarbonBlackEDR.Sensor.is_isolating | Boolean representing the sensor-reported isolation status. | unknown |
| CarbonBlackEDR.Sensor.status | The sensor status. | unknown |

## Playbook Image

---

![Isolate Endpoint - Generic V2](../doc_files/Isolate_Endpoint_-_Generic_V2.png)