Microsoft Defender For Endpoint - Unisolate Endpoint

This playbook accepts an endpoint ID, IP, or host name and unisolates it using the Microsoft Defender For Endpoint integration.

Microsoft Defender for Endpoint · 23 tasks · 3 inputs · 6 outputs

Inputs

  • Device_id — The device ID to isolate. For more information about the device, you can use the following commands: !microsoft-atp-get-machine-details !microsoft-atp-get-machines
  • Hostname — The device host name you want to isolate.
  • Device_IP — The device IP you want to isolate.

Outputs

  • MicrosoftATP.MachineAction.ID — The machine action ID.
  • MicrosoftATP.NonUnisolateList — The machine IDs that will not be released from isolation.
  • MicrosoftATP.UnisolateList — The machine IDs that were released from isolation.
  • MicrosoftATP.IncorrectIDs — Incorrect device IDs entered.
  • MicrosoftATP.IncorrectHostnames — Incorrect host names entered.
  • MicrosoftATP.IncorrectIPs — Incorrect device IPs entered.

Commands used

endpoint microsoft-atp-unisolate-machine

Flowchart

yes yes yes yes yes yes Start Start Is Microsoft Defender For Endpoint Integration Enabled? - IsIntegrationAvailable Is Microsoft Defender For... IsIntegrationAvailable Done Done Is The Device Active? Is The Device Active? Unisolate Endpoint - microsoft-atp-unisolate-machine Unisolate Endpoint microsoft-atp-unisolate-machine Check if the Unisolate command succeeded - isError Check if the Unisolate co... isError Print a warning to the war room - Device already unisolated - Print Print a warning to the wa... Print Set Unisolate list - SetAndHandleEmpty Set Unisolate list SetAndHandleEmpty Set Inactive Device list - SetAndHandleEmpty Set Inactive Device list SetAndHandleEmpty Print those that can't be unisolated as are not active - Print Print those that can't be... Print Is There Inactive Device? Is There Inactive Device? Print incorrect Device ID - Print Print incorrect Device ID Print Set Incorrect IP - SetAndHandleEmpty Set Incorrect IP SetAndHandleEmpty Set Incorrect Hostname - SetAndHandleEmpty Set Incorrect Hostname SetAndHandleEmpty Set Incorrect ID - SetAndHandleEmpty Set Incorrect ID SetAndHandleEmpty Check if there is any provided incorrect info Check if there is any pro... Normalizing Device info Normalizing Device info Unisolate Device Unisolate Device Active Devices Active Devices Inactive Device Inactive Device Incorrect Input Incorrect Input Was any data provided? Was any data provided? Enrich Endpoint info - endpoint Enrich Endpoint info endpoint