Microsoft Defender For Endpoint - Isolate Endpoint

id: Microsoft Defender For Endpoint - Isolate Endpoint
version: -1
name: Microsoft Defender For Endpoint - Isolate Endpoint
description: This playbook accepts an endpoint ID, IP, or host name and isolates it using the Microsoft Defender For Endpoint integration.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 0c9a3619-7414-4966-860a-3b83f7ae3c9a
    type: start
    task:
      id: 0c9a3619-7414-4966-860a-3b83f7ae3c9a
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": -350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: f658a709-df9b-463e-8305-7c14c5b68512
    type: condition
    task:
      id: f658a709-df9b-463e-8305-7c14c5b68512
      version: -1
      name: Is Microsoft Defender For Endpoint Integration Enabled?
      description: Returns 'yes' if the integration is available.
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "32"
    scriptarguments:
      brandname:
        simple: Microsoft Defender Advanced Threat Protection
    results:
    - brandInstances
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": -230
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 2f36c13b-1511-485c-86e0-0bbf57eba943
    type: title
    task:
      id: 2f36c13b-1511-485c-86e0-0bbf57eba943
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1800
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: 2c229082-3fd9-43b2-83dc-5ff28a9be1b9
    type: condition
    task:
      id: 2c229082-3fd9-43b2-83dc-5ff28a9be1b9
      version: -1
      name: Is the device ready for isolation?
      description: Is the device ready for isolation?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "31"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: MicrosoftATP.IsolateList
            iscontext: true
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 1160,
          "y": 805
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: 4448d4cc-2c91-4b3a-8aa8-01705c810970
    type: regular
    task:
      id: 4448d4cc-2c91-4b3a-8aa8-01705c810970
      version: -1
      name: Isolate endpoint
      description: Isolates a machine from accessing external networks.
      script: '|||microsoft-atp-isolate-machine'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      comment:
        simple: 'XSOAR Microsoft Defender Isolate Endpoint - #Inc ${incident.id}'
      isolation_type:
        simple: ${inputs.Isolation_type}
      machine_id:
        simple: ${MicrosoftATP.IsolateList}
    continueonerror: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1160,
          "y": 1180
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: f4b67ca6-19e6-492d-84e9-3e93ef002e3e
    type: condition
    task:
      id: f4b67ca6-19e6-492d-84e9-3e93ef002e3e
      version: -1
      name: ' Check if Isolate Action Succeeded'
      description: Checks whether given entry/entries returned an error. Use ${lastCompletedTaskEntries} to check the previous task entries. For an array of entries, returns 'yes' if one of the entries returned an error.
      scriptName: isError
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "9"
    scriptarguments:
      entryId:
        simple: ${lastCompletedTaskEntries}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1160,
          "y": 1350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: 6ee8a70d-bd1a-4fe0-8e3f-2ff1a9ac9b89
    type: regular
    task:
      id: 6ee8a70d-bd1a-4fe0-8e3f-2ff1a9ac9b89
      version: -1
      name: Print a warning to the war room - Device already isolated
      description: Prints a device already isolated message to the War Room (Markdown supported).
      scriptName: Print
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      value:
        complex:
          root: MicrosoftATP.IsolateList
          filters:
          - - operator: notIn
              left:
                value:
                  simple: MicrosoftATP.IsolateList
                iscontext: true
              right:
                value:
                  simple: MicrosoftATP.MachineAction.MachineID
                iscontext: true
          transformers:
          - operator: concat
            args:
              prefix:
                value:
                  simple: |
                    The Isolate Action did not succeed. Please validate your input or check if the machine is already in an Isolate state. The Device ID/s that were not Isolated
              suffix: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1160,
          "y": 1630
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: 913c4449-5898-4aaf-87d0-e4454d35c87b
    type: regular
    task:
      id: 913c4449-5898-4aaf-87d0-e4454d35c87b
      version: -1
      name: Print inactive device
      description: Prints an inactive device message to the War Room (Markdown supported).
      scriptName: Print
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      value:
        simple: |-
          The following devices can't be isolated. Please validate that those devices are active in the system.
          ${MicrosoftATP.NonIsolateList}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 730,
          "y": 1630
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: 7cc2d23d-784c-4029-8d0b-62aebc0b2abd
    type: regular
    task:
      id: 7cc2d23d-784c-4029-8d0b-62aebc0b2abd
      version: -1
      name: Set Active Device
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: MicrosoftATP.IsolateList
      value:
        complex:
          root: MicrosoftATP.Machine
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: MicrosoftATP.Machine.HealthStatus
                iscontext: true
              right:
                value:
                  simple: Active
              ignorecase: true
          accessor: ID
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1160,
          "y": 620
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: 9543301b-5b6c-4bb5-864c-3d40cd4152dd
    type: regular
    task:
      id: 9543301b-5b6c-4bb5-864c-3d40cd4152dd
      version: -1
      name: Set Non-valid Devices
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "13"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: MicrosoftATP.NonIsolateList
      value:
        complex:
          root: MicrosoftATP.Machine
          filters:
          - - operator: isNotEqualString
              left:
                value:
                  simple: MicrosoftATP.Machine.HealthStatus
                iscontext: true
              right:
                value:
                  simple: Active
              ignorecase: true
          accessor: ID
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 730,
          "y": 620
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: ba1c6190-674a-44db-89cd-d8e982093c58
    type: condition
    task:
      id: ba1c6190-674a-44db-89cd-d8e982093c58
      version: -1
      name: Is there any inactive device?
      description: Are there any inactive devices?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "10"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: MicrosoftATP.NonIsolateList
            iscontext: true
          right:
            value: {}
    view: |-
      {
        "position": {
          "x": 730,
          "y": 805
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "17":
    id: "17"
    taskid: 30182da7-2783-468c-8d15-4305b8f01d5e
    type: regular
    task:
      id: 30182da7-2783-468c-8d15-4305b8f01d5e
      version: -1
      name: Print incorrect Device ID
      description: Prints an incorrect device ID message to the War Room (Markdown supported).
      scriptName: Print
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      value:
        simple: "Please note that the following ID / Hostname / IP are incorrect. No action was taken on the following Device ID / hostname / IP: \n${MicrosoftATP.IncorrectIDs}\n${MicrosoftATP.IncorrectIPs}\n${MicrosoftATP.IncorrectHostnames}"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 310,
          "y": 1630
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "19":
    id: "19"
    taskid: 2816c649-e7c3-4f09-8730-e20eb9346ac2
    type: condition
    task:
      id: 2816c649-e7c3-4f09-8730-e20eb9346ac2
      version: -1
      name: Check if there is any provided incorrect info
      description: Check if there are any incorrect device IDs.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "20"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.Device_id
                filters:
                - - operator: notIn
                    left:
                      value:
                        simple: inputs.Device_id
                      iscontext: true
                    right:
                      value:
                        simple: MicrosoftATP.Machine.ID
                      iscontext: true
                transformers:
                - operator: uniq
            iscontext: true
          right:
            value: {}
        - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.Hostname
                filters:
                - - operator: notIn
                    left:
                      value:
                        simple: inputs.Hostname
                      iscontext: true
                    right:
                      value:
                        simple: MicrosoftATP.Machine.ComputerDNSName
                      iscontext: true
                transformers:
                - operator: uniq
            iscontext: true
        - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.Device_IP
                filters:
                - - operator: notIn
                    left:
                      value:
                        simple: inputs.Device_IP
                      iscontext: true
                    right:
                      value:
                        simple: MicrosoftATP.Machine.NetworkInterfaces.IPAddresses
                      iscontext: true
                transformers:
                - operator: uniq
            iscontext: true
    view: |-
      {
        "position": {
          "x": 310,
          "y": 620
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "20":
    id: "20"
    taskid: 9b159ca4-130c-4e62-88c4-8b797db390fd
    type: regular
    task:
      id: 9b159ca4-130c-4e62-88c4-8b797db390fd
      version: -1
      name: Set Incorrect ID
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "24"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: MicrosoftATP.IncorrectIDs
      value:
        complex:
          root: inputs.Device_id
          filters:
          - - operator: notIn
              left:
                value:
                  simple: inputs.Device_id
                iscontext: true
              right:
                value:
                  simple: MicrosoftATP.Machine.ID
                iscontext: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 310,
          "y": 805
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "23":
    id: "23"
    taskid: 66a8b331-c775-4263-8289-dcedbf3f2799
    type: regular
    task:
      id: 66a8b331-c775-4263-8289-dcedbf3f2799
      version: -1
      name: Set Incorrect IP
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "17"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: MicrosoftATP.IncorrectIPs
      value:
        complex:
          root: inputs.Device_IP
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.Device_IP
                iscontext: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 310,
          "y": 1350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "24":
    id: "24"
    taskid: f95ccb2e-09b5-4ae3-88d7-802940ec7bd1
    type: regular
    task:
      id: f95ccb2e-09b5-4ae3-88d7-802940ec7bd1
      version: -1
      name: Set Incorrect Hostname
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "23"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: MicrosoftATP.IncorrectHostnames
      value:
        complex:
          root: inputs.Hostname
          filters:
          - - operator: notIn
              left:
                value:
                  simple: inputs.Hostname
                iscontext: true
              right:
                value:
                  simple: MicrosoftATP.Machine.ComputerDNSName
                iscontext: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 310,
          "y": 1180
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "27":
    id: "27"
    taskid: 93070bb8-0dbd-4a97-842e-f851bba34472
    type: title
    task:
      id: 93070bb8-0dbd-4a97-842e-f851bba34472
      version: -1
      name: Normalizing Device info
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "28"
      - "30"
      - "29"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 730,
          "y": 300
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "28":
    id: "28"
    taskid: 79a55f6a-7ab3-4d04-8b68-cfc13ab442dc
    type: title
    task:
      id: 79a55f6a-7ab3-4d04-8b68-cfc13ab442dc
      version: -1
      name: Active Device
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "11"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1160,
          "y": 450
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "29":
    id: "29"
    taskid: 74d28cdb-2cf4-4d2e-846c-762d094bf01f
    type: title
    task:
      id: 74d28cdb-2cf4-4d2e-846c-762d094bf01f
      version: -1
      name: Inactive Device
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "12"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 730,
          "y": 450
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "30":
    id: "30"
    taskid: 59d101b0-bfca-443a-8cb7-8465d9e44521
    type: title
    task:
      id: 59d101b0-bfca-443a-8cb7-8465d9e44521
      version: -1
      name: Incorrect Input
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "19"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 310,
          "y": 450
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "31":
    id: "31"
    taskid: 38e3795b-141d-4aba-820a-4f95e7eb47da
    type: title
    task:
      id: 38e3795b-141d-4aba-820a-4f95e7eb47da
      version: -1
      name: Isolate Device
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "7"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1160,
          "y": 1030
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "32":
    id: "32"
    taskid: 361b1e36-d71c-4128-83a8-012269159fec
    type: condition
    task:
      id: 361b1e36-d71c-4128-83a8-012269159fec
      version: -1
      name: Was any data provided?
      type: condition
      iscommand: false
      description: 'Validate/Enrich inputs through !endpoint'
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "33"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.Device_id
            iscontext: true
        - operator: isNotEmpty
          left:
            value:
              simple: inputs.Device_IP
            iscontext: true
        - operator: isNotEmpty
          left:
            value:
              simple: inputs.Hostname
            iscontext: true
    view: |-
      {
        "position": {
          "x": 730,
          "y": -60
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "33":
    id: "33"
    taskid: 91926f31-cb8d-4e2a-8d36-11b6b491c6cd
    type: regular
    task:
      id: 91926f31-cb8d-4e2a-8d36-11b6b491c6cd
      version: -1
      name: Enrich Endpoint info
      description: Returns information about an endpoint.
      script: '|||endpoint'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "27"
    scriptarguments:
      hostname:
        simple: ${inputs.Hostname}
      id:
        simple: ${inputs.Device_id}
      ip:
        simple: ${inputs.Device_IP}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 730,
          "y": 150
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "13_10_yes": 0.67,
      "13_2_#default#": 0.1,
      "19_2_#default#": 0.21,
      "1_2_#default#": 0.1,
      "5_2_#default#": 0.1,
      "8_2_#default#": 0.1,
      "8_9_yes": 0.62
    },
    "paper": {
      "dimensions": {
        "height": 2215,
        "width": 1490,
        "x": 50,
        "y": -350
      }
    }
  }
inputs:
- key: Device_id
  value: {}
  required: false
  description: |-
    The device ID to isolate.
    For more information about the device, you can use the following commands:
    !microsoft-atp-get-machine-details
    !microsoft-atp-get-machines
  playbookInputQuery:
- key: Hostname
  value: {}
  required: false
  description: The host name you want to isolate.
  playbookInputQuery:
- key: Device_IP
  value: {}
  required: false
  description: The device IP you want to isolate.
  playbookInputQuery:
- key: Isolation_type
  value:
    simple: Full
  required: false
  description: |-
    Optional Values: Full/Selective. Default is Full.

    For more information see Microsoft documentation:
      https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/respond-machine-alerts?view=o365-worldwide#isolate-devices-from-the-network
  playbookInputQuery:
outputs:
- contextPath: MicrosoftATP.MachineAction.ID
  description: The machine action ID.
  type: string
- contextPath: MicrosoftATP.IsolateList
  description: The machine IDs that were isolated.
  type: string
- contextPath: MicrosoftATP.NonIsolateList
  description: The machine IDs that will not be isolated.
  type: string
- contextPath: MicrosoftATP.IncorrectIDs
  description: Incorrect device IDs entered.
  type: string
- contextPath: MicrosoftATP.IncorrectHostnames
  description: Incorrect device host names entered.
  type: string
- contextPath: MicrosoftATP.IncorrectIPs
  description: Incorrect device IPs entered.
  type: string
tests:
- No tests (auto formatted)
fromversion: 6.2.0