Microsoft Defender For Endpoint - Unisolate Endpoint

This playbook accepts an endpoint ID, IP, or host name and unisolates it using the Microsoft Defender For Endpoint integration.
Microsoft Defender for Endpoint · 23 tasks · 3 inputs · 6 outputs
Details

ID	`Microsoft Defender For Endpoint - Unisolate Endpoint`
From Version	6.2.0
Tasks	23
README

This playbook accepts an endpoint ID, IP, or host name and unisolates it using the Microsoft Defender For Endpoint integration.
Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.
Sub-playbooks

This playbook does not use any sub-playbooks.
Integrations

MicrosoftDefenderAdvancedThreatProtection
Scripts

SetAndHandleEmpty
isError
IsIntegrationAvailable
Print
Commands

endpoint
microsoft-atp-unisolate-machine
Playbook Inputs

Name	Description	Required
Device_id	The device ID to isolate. For more information about the device, you can use the following commands: !microsoft-atp-get-machine-details !microsoft-atp-get-machines	Optional
Hostname	The device host name you want to isolate.	Optional
Device_IP	The device IP you want to isolate.	Optional
Playbook Outputs

Path	Description	Type
MicrosoftATP.MachineAction.ID	The machine action ID.	string
MicrosoftATP.NonUnisolateList	The machine IDs that will not be released from isolation.	string
MicrosoftATP.UnisolateList	The machine IDs that were released from isolation.	string
MicrosoftATP.IncorrectIDs	Incorrect device IDs entered.	string
MicrosoftATP.IncorrectHostnames	Incorrect host names entered.	string
MicrosoftATP.IncorrectIPs	Incorrect device IPs entered.	string
Playbook Image

Microsoft Defender For Endpoint - Unisolate Endpoint
Inputs

Device_id — The device ID to isolate. For more information about the device, you can use the following commands: !microsoft-atp-get-machine-details !microsoft-atp-get-machines
Hostname — The device host name you want to isolate.
Device_IP — The device IP you want to isolate.
Outputs

MicrosoftATP.MachineAction.ID — The machine action ID.
MicrosoftATP.NonUnisolateList — The machine IDs that will not be released from isolation.
MicrosoftATP.UnisolateList — The machine IDs that were released from isolation.
MicrosoftATP.IncorrectIDs — Incorrect device IDs entered.
MicrosoftATP.IncorrectHostnames — Incorrect host names entered.
MicrosoftATP.IncorrectIPs — Incorrect device IPs entered.
Commands used

endpoint microsoft-atp-unisolate-machine
Flowchart

Source

playbook-Microsoft_Defender_For_Endpoint_-_Unisolate_Endpoint.yml
Download History Raw
id: Microsoft Defender For Endpoint - Unisolate Endpoint
version: -1
name: Microsoft Defender For Endpoint - Unisolate Endpoint
description: This playbook accepts an endpoint ID, IP, or host name and unisolates it using the Microsoft Defender For Endpoint integration.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: f9d910fa-6833-4a21-85cb-06a5d1bfcfce
    type: start
    task:
      id: f9d910fa-6833-4a21-85cb-06a5d1bfcfce
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": -400
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 5716f9b9-d904-4ffd-8d95-bfc68b484f07
    type: condition
    task:
      id: 5716f9b9-d904-4ffd-8d95-bfc68b484f07
      version: -1
      name: Is Microsoft Defender For Endpoint Integration Enabled?
      description: Returns 'yes' if the integration is available.
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "36"
    scriptarguments:
      brandname:
        simple: Microsoft Defender Advanced Threat Protection
    results:
    - brandInstances
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": -275
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: e05ad26a-f769-482c-8525-43956fbe657e
    type: title
    task:
      id: e05ad26a-f769-482c-8525-43956fbe657e
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1620
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: ed776d4f-060c-444f-846d-d07748b26de6
    type: condition
    task:
      id: ed776d4f-060c-444f-846d-d07748b26de6
      version: -1
      name: Is The Device Active?
      description: Is the device ready for isolation?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "32"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: MicrosoftATP.UnisolateList
            iscontext: true
          right:
            value: {}
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 1180,
          "y": 695
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: d82be97d-6429-43d9-8acb-a054c091f3eb
    type: regular
    task:
      id: d82be97d-6429-43d9-8acb-a054c091f3eb
      version: -1
      name: Unisolate Endpoint
      description: Undo an isolation of a machine.
      script: '|||microsoft-atp-unisolate-machine'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      comment:
        simple: 'XSOAR Microsoft Defender Unisolate Endpoint - #Inc ${incident.id}'
      machine_id:
        simple: ${MicrosoftATP.UnisolateList}
    continueonerror: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1180,
          "y": 1045
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: 97b52579-d382-4054-8efb-50c10002f9dd
    type: condition
    task:
      id: 97b52579-d382-4054-8efb-50c10002f9dd
      version: -1
      name: Check if the Unisolate command succeeded
      description: Checks whether given entry/entries returned an error. Use ${lastCompletedTaskEntries} to check the previous task entries. For an array of entries, returns 'yes' if one of the entries returned an error.
      scriptName: isError
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "9"
    scriptarguments:
      entryId:
        simple: ${lastCompletedTaskEntries}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1180,
          "y": 1210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: e080dd2a-b70a-4fbc-8cb3-caa10bc4cdec
    type: regular
    task:
      id: e080dd2a-b70a-4fbc-8cb3-caa10bc4cdec
      version: -1
      name: Print a warning to the war room - Device already unisolated
      description: Prints a device already unisolated message to the War Room (Markdown supported).
      scriptName: Print
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      value:
        complex:
          root: MicrosoftATP.UnisolateList
          filters:
          - - operator: notIn
              left:
                value:
                  simple: MicrosoftATP.UnisolateList
                iscontext: true
              right:
                value:
                  simple: MicrosoftATP.MachineAction.MachineID
                iscontext: true
          transformers:
          - operator: concat
            args:
              prefix:
                value:
                  simple: |
                    The un-isolate action did not succeed. Please validate your input or check if the machine is already in a non-isolated state. Device ID list:
              suffix: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1180,
          "y": 1450
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: fee89135-4019-46e2-8011-0d45ccb1ccb2
    type: regular
    task:
      id: fee89135-4019-46e2-8011-0d45ccb1ccb2
      version: -1
      name: Set Unisolate list
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: MicrosoftATP.UnisolateList
      value:
        complex:
          root: MicrosoftATP.Machine
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: MicrosoftATP.Machine.HealthStatus
                iscontext: true
              right:
                value:
                  simple: Active
              ignorecase: true
          accessor: ID
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1180,
          "y": 530
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: 9d32cb38-f88a-473d-8e5d-02885e958128
    type: regular
    task:
      id: 9d32cb38-f88a-473d-8e5d-02885e958128
      version: -1
      name: Set Inactive Device list
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "13"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: MicrosoftATP.NonUnisolateList
      value:
        complex:
          root: MicrosoftATP.Machine
          filters:
          - - operator: isNotEqualString
              left:
                value:
                  simple: MicrosoftATP.Machine.HealthStatus
                iscontext: true
              right:
                value:
                  simple: Active
              ignorecase: true
          accessor: ID
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 750,
          "y": 530
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: 5d184293-53f5-4545-82b4-078e6e0bab66
    type: regular
    task:
      id: 5d184293-53f5-4545-82b4-078e6e0bab66
      version: -1
      name: Print those that can't be unisolated as are not active
      description: Prints an inactive device message to the War Room (Markdown supported).
      scriptName: Print
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      value:
        simple: |-
          The following devices can't be isolated. Please validate that those devices are active in the system
          ${MicrosoftATP.NonUnisolateList}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 750,
          "y": 1450
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: 505f3eac-974c-4d87-86e8-3958eb0e30d4
    type: condition
    task:
      id: 505f3eac-974c-4d87-86e8-3958eb0e30d4
      version: -1
      name: Is There Inactive Device?
      description: Are there any inactive devices?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "12"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: MicrosoftATP.NonUnisolateList
            iscontext: true
          right:
            value: {}
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 750,
          "y": 695
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "22":
    id: "22"
    taskid: 08261d13-dd3f-4b84-8779-d3a7b2a22e59
    type: regular
    task:
      id: 08261d13-dd3f-4b84-8779-d3a7b2a22e59
      version: -1
      name: Print incorrect Device ID
      description: Prints an incorrect device ID message to the War Room (Markdown supported).
      scriptName: Print
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      value:
        simple: "Please note that the following IDs are incorrect. No action was taken on the following Device ID: \n${MicrosoftATP.IncorrectIDs}\n${MicrosoftATP.IncorrectIPs}\n${MicrosoftATP.IncorrectHostnames}"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 330,
          "y": 1450
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "23":
    id: "23"
    taskid: 1757b5c4-0a1b-4fa9-8106-8369d732c17f
    type: regular
    task:
      id: 1757b5c4-0a1b-4fa9-8106-8369d732c17f
      version: -1
      name: Set Incorrect IP
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "22"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: MicrosoftATP.IncorrectIPs
      value:
        complex:
          root: inputs.Device_IP
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.Device_IP
                iscontext: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 330,
          "y": 1220
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "24":
    id: "24"
    taskid: e4946b41-ec64-4883-818c-fa254c69c36c
    type: regular
    task:
      id: e4946b41-ec64-4883-818c-fa254c69c36c
      version: -1
      name: Set Incorrect Hostname
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "23"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: MicrosoftATP.IncorrectHostnames
      value:
        complex:
          root: inputs.Hostname
          filters:
          - - operator: notIn
              left:
                value:
                  simple: inputs.Hostname
                iscontext: true
              right:
                value:
                  simple: MicrosoftATP.Machine.ComputerDNSName
                iscontext: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 330,
          "y": 1045
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "25":
    id: "25"
    taskid: ca909de6-b90a-4ded-81b1-2195f6504ce4
    type: regular
    task:
      id: ca909de6-b90a-4ded-81b1-2195f6504ce4
      version: -1
      name: Set Incorrect ID
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "24"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: MicrosoftATP.IncorrectIDs
      value:
        complex:
          root: inputs.Device_id
          filters:
          - - operator: notIn
              left:
                value:
                  simple: inputs.Device_id
                iscontext: true
              right:
                value:
                  simple: MicrosoftATP.Machine.ID
                iscontext: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 330,
          "y": 695
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "26":
    id: "26"
    taskid: 1a7c9aed-209c-46ca-82d3-0aaadf72d82d
    type: condition
    task:
      id: 1a7c9aed-209c-46ca-82d3-0aaadf72d82d
      version: -1
      name: Check if there is any provided incorrect info
      description: Check if there are any incorrect device IDs.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "25"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.Device_id
                filters:
                - - operator: notIn
                    left:
                      value:
                        simple: inputs.Device_id
                      iscontext: true
                    right:
                      value:
                        simple: MicrosoftATP.Machine.ID
                      iscontext: true
                transformers:
                - operator: uniq
            iscontext: true
          right:
            value: {}
        - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.Hostname
                filters:
                - - operator: notIn
                    left:
                      value:
                        simple: inputs.Hostname
                      iscontext: true
                    right:
                      value:
                        simple: MicrosoftATP.Machine.ComputerDNSName
                      iscontext: true
                transformers:
                - operator: uniq
            iscontext: true
        - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.Device_IP
                filters:
                - - operator: notIn
                    left:
                      value:
                        simple: inputs.Device_IP
                      iscontext: true
                    right:
                      value:
                        simple: MicrosoftATP.Machine.NetworkInterfaces.IPAddresses
                      iscontext: true
                transformers:
                - operator: uniq
            iscontext: true
    view: |-
      {
        "position": {
          "x": 330,
          "y": 530
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "31":
    id: "31"
    taskid: 7c1ec123-fa09-4829-8ef5-81fc689e2fbb
    type: title
    task:
      id: 7c1ec123-fa09-4829-8ef5-81fc689e2fbb
      version: -1
      name: Normalizing Device info
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "33"
      - "35"
      - "34"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 750,
          "y": 270
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "32":
    id: "32"
    taskid: 7a15344c-2373-4a41-8219-0b62f42504e2
    type: title
    task:
      id: 7a15344c-2373-4a41-8219-0b62f42504e2
      version: -1
      name: Unisolate Device
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "7"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1180,
          "y": 900
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "33":
    id: "33"
    taskid: 55071917-0ecf-4fc4-8e90-8c76aa7a3bc1
    type: title
    task:
      id: 55071917-0ecf-4fc4-8e90-8c76aa7a3bc1
      version: -1
      name: Active Devices
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "10"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1180,
          "y": 410
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "34":
    id: "34"
    taskid: 575f8c79-4956-4262-8f02-8f68eafcf0f5
    type: title
    task:
      id: 575f8c79-4956-4262-8f02-8f68eafcf0f5
      version: -1
      name: Inactive Device
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "11"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 750,
          "y": 410
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "35":
    id: "35"
    taskid: 6972b54a-0602-402c-83c1-a15efbd654d1
    type: title
    task:
      id: 6972b54a-0602-402c-83c1-a15efbd654d1
      version: -1
      name: Incorrect Input
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "26"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 330,
          "y": 410
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "36":
    id: "36"
    taskid: 24525b6d-8d9b-47b4-8ca2-e528d8723f11
    type: condition
    task:
      id: 24525b6d-8d9b-47b4-8ca2-e528d8723f11
      version: -1
      name: Was any data provided?
      type: condition
      iscommand: false
      description: 'Validate/Enrich inputs through !endpoint'
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "37"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.Device_id
            iscontext: true
        - operator: isNotEmpty
          left:
            value:
              simple: inputs.Device_IP
            iscontext: true
        - operator: isNotEmpty
          left:
            value:
              simple: inputs.Hostname
            iscontext: true
    view: |-
      {
        "position": {
          "x": 750,
          "y": -100
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "37":
    id: "37"
    taskid: 6ed55b95-b352-47ca-80c3-1897e0b2ab00
    type: regular
    task:
      id: 6ed55b95-b352-47ca-80c3-1897e0b2ab00
      version: -1
      name: Enrich Endpoint info
      description: Returns information about an endpoint.
      script: '|||endpoint'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "31"
    scriptarguments:
      hostname:
        simple: ${inputs.Hostname}
      id:
        simple: ${inputs.Device_id}
      ip:
        simple: ${inputs.Device_IP}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 750,
          "y": 100
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "13_12_yes": 0.52,
      "13_2_#default#": 0.18,
      "1_2_#default#": 0.1,
      "5_2_#default#": 0.1,
      "8_2_#default#": 0.1
    },
    "paper": {
      "dimensions": {
        "height": 2085,
        "width": 1510,
        "x": 50,
        "y": -400
      }
    }
  }
inputs:
- key: Device_id
  value: {}
  required: false
  description: |-
    The device ID to isolate.
    For more information about the device, you can use the following commands:
    !microsoft-atp-get-machine-details
    !microsoft-atp-get-machines
  playbookInputQuery:
- key: Hostname
  value: {}
  required: false
  description: The device host name you want to isolate.
  playbookInputQuery:
- key: Device_IP
  value: {}
  required: false
  description: The device IP you want to isolate.
  playbookInputQuery:
outputs:
- contextPath: MicrosoftATP.MachineAction.ID
  description: The machine action ID.
  type: string
- contextPath: MicrosoftATP.NonUnisolateList
  description: The machine IDs that will not be released from isolation.
  type: string
- contextPath: MicrosoftATP.UnisolateList
  description: The machine IDs that were released from isolation.
  type: string
- contextPath: MicrosoftATP.IncorrectIDs
  description: Incorrect device IDs entered.
  type: string
- contextPath: MicrosoftATP.IncorrectHostnames
  description: Incorrect host names entered.
  type: string
- contextPath: MicrosoftATP.IncorrectIPs
  description: Incorrect device IPs entered.
  type: string
tests:
- No tests (auto formatted)
fromversion: 6.2.0