Microsoft Defender For Endpoint - Isolate Endpoint

This playbook accepts an endpoint ID, IP, or host name and isolates it using the Microsoft Defender For Endpoint integration.

Microsoft Defender for Endpoint · 23 tasks · 4 inputs · 6 outputs

Inputs

  • Device_id — The device ID to isolate. For more information about the device, you can use the following commands: !microsoft-atp-get-machine-details !microsoft-atp-get-machines
  • Hostname — The host name you want to isolate.
  • Device_IP — The device IP you want to isolate.
  • Isolation_type — Optional Values: Full/Selective. Default is Full. For more information see Microsoft documentation: https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/respond-machine-alerts?view=o365-worldwide#isolate-devices-from-the-network

Outputs

  • MicrosoftATP.MachineAction.ID — The machine action ID.
  • MicrosoftATP.IsolateList — The machine IDs that were isolated.
  • MicrosoftATP.NonIsolateList — The machine IDs that will not be isolated.
  • MicrosoftATP.IncorrectIDs — Incorrect device IDs entered.
  • MicrosoftATP.IncorrectHostnames — Incorrect device host names entered.
  • MicrosoftATP.IncorrectIPs — Incorrect device IPs entered.

Commands used

endpoint microsoft-atp-isolate-machine

Flowchart

yes yes yes yes yes yes Start Start Is Microsoft Defender For Endpoint Integration Enabled? - IsIntegrationAvailable Is Microsoft Defender For... IsIntegrationAvailable Done Done Is the device ready for isolation? Is the device ready for i... Isolate endpoint - microsoft-atp-isolate-machine Isolate endpoint microsoft-atp-isolate-machine Check if Isolate Action Succeeded - isError Check if Isolate Action ... isError Print a warning to the war room - Device already isolated - Print Print a warning to the wa... Print Print inactive device - Print Print inactive device Print Set Active Device - SetAndHandleEmpty Set Active Device SetAndHandleEmpty Set Non-valid Devices - SetAndHandleEmpty Set Non-valid Devices SetAndHandleEmpty Is there any inactive device? Is there any inactive dev... Print incorrect Device ID - Print Print incorrect Device ID Print Check if there is any provided incorrect info Check if there is any pro... Set Incorrect ID - SetAndHandleEmpty Set Incorrect ID SetAndHandleEmpty Set Incorrect IP - SetAndHandleEmpty Set Incorrect IP SetAndHandleEmpty Set Incorrect Hostname - SetAndHandleEmpty Set Incorrect Hostname SetAndHandleEmpty Normalizing Device info Normalizing Device info Active Device Active Device Inactive Device Inactive Device Incorrect Input Incorrect Input Isolate Device Isolate Device Was any data provided? Was any data provided? Enrich Endpoint info - endpoint Enrich Endpoint info endpoint