Proactive Threat Hunting - Endpoint Isolation

This playbook will be executed from the "Proactive Threat Hunting" layout button with the objective of isolating a host specified by the analyst.

Proactive Threat Hunting · 8 tasks · 0 inputs · 0 outputs

Details

IDProactive Threat Hunting - Endpoint Isolation
From Version6.9.0
Tasks8

README

This playbook will be executed from the “Proactive Threat Hunting” layout button with the objective of isolating a host specified by the analyst.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

Isolate Endpoint - Generic V2

Integrations

This playbook does not use any integrations.

Scripts

Print

Commands

This playbook does not use any commands.

Playbook Inputs

There are no inputs for this playbook.

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Proactive Threat Hunting - Endpoint Isolation

Flowchart

yes yes Start Start Isolate Endpoint - Generic V2 - Isolate Endpoint - Generic V2 Isolate Endpoint - Generi... Isolate Endpoint - Generic V2 Print update to notes - Print Print update to notes Print Select endpoint to isolate Select endpoint to isolate Has endpoint to isolate? Has endpoint to isolate? Done Done Executed from freestyle hunt? Executed from freestyle h... Enter endpoint name to isolate Enter endpoint name to is...

Source

playbook-Proactive_Threat_Hunting_-_Endpoint_Isolation.yml
Download History Raw 
id: Proactive Threat Hunting - Endpoint Isolation
version: -1
name: Proactive Threat Hunting - Endpoint Isolation
description: |
  This playbook will be executed from the "Proactive Threat Hunting" layout button with the objective of isolating a host specified by the analyst.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: d8cb08d9-07e7-4890-8e1d-d62d3e3dee96
    type: start
    task:
      id: d8cb08d9-07e7-4890-8e1d-d62d3e3dee96
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "2"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": -130
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: aebc98b0-46ba-46e0-8239-b2b67e256c9b
    type: playbook
    task:
      id: aebc98b0-46ba-46e0-8239-b2b67e256c9b
      version: -1
      name: Isolate Endpoint - Generic V2
      description: |-
        This playbook isolates a given endpoint using various endpoint product integrations.
        Make sure to provide valid playbook inputs for the integration you are using.
      playbookName: Isolate Endpoint - Generic V2
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      Endpoint_hostname:
        complex:
          root: Select Endpoint To Isolate.Answers
          accessor: "0"
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: Select Endpoint To Isolate.Answers.0
                iscontext: true
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 860,
          "y": 670
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 66dba88b-62e6-42e7-83a7-c27389fdb346
    type: regular
    task:
      id: 66dba88b-62e6-42e7-83a7-c27389fdb346
      version: -1
      name: Print update to notes
      description: Prints text to the War Room. (Markdown supported).
      scriptName: Print
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      value:
        simple: Endpoint isolation procedure has executed. Follow the work plan to continue.
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 0
        }
      }
    note: true
    timertriggers: []
    ignoreworker: false
    fieldMapping:
    - incidentfield: Endpoint Isolation Status
      output:
        simple: Executed
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 27544442-9757-4523-84f4-49181805f501
    type: collection
    task:
      id: 27544442-9757-4523-84f4-49181805f501
      version: -1
      name: Select endpoint to isolate
      description: Asking the user to select an endpoint to isolate.
      type: collection
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
      subject:
      body:
      methods: []
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: true
        completeaftersla: false
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          simple: Select Endpoint To Isolate
        required: false
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - {}
        - complex:
            root: incident
            accessor: affectedhosts
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      title: Select Endpoint To Isolate
      description: ""
      sender: ""
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: 671ae69a-9ca5-438c-8dc0-e2ddd4b4a743
    type: condition
    task:
      id: 671ae69a-9ca5-438c-8dc0-e2ddd4b4a743
      version: -1
      name: Has endpoint to isolate?
      description: Checks the user's choice in the collection task "Select endpoint to isolate".
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "1"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: Select Endpoint To Isolate.Answers
                accessor: "0"
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 500
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: cde3f3de-0a07-487e-8107-9ebb7fd0cdf2
    type: title
    task:
      id: cde3f3de-0a07-487e-8107-9ebb7fd0cdf2
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 840
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: c921585f-9766-41de-840d-3b0674bd438e
    type: condition
    task:
      id: c921585f-9766-41de-840d-3b0674bd438e
      version: -1
      name: Executed from freestyle hunt?
      description: Checks if the playbook was executed from the Freestyle Hunt tab.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "7"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: incident
                accessor: freestylehunt
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 160
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: f765e0c8-4332-4b21-8571-7cf1268938e5
    type: collection
    task:
      id: f765e0c8-4332-4b21-8571-7cf1268938e5
      version: -1
      name: Enter endpoint name to isolate
      description: Asking the user to select an endpoint to isolate.
      type: collection
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 860,
          "y": 340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
      subject:
      body:
      methods: []
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: true
        completeaftersla: false
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          simple: Enter Endpoint Name To Isolate
        required: false
        gridcolumns: []
        defaultrows: []
        type: shortText
        options: []
        optionsarg:
        - {}
        - simple: "No"
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      title: Enter Endpoint Name To Isolate
      description: ""
      sender: ""
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "4_5_#default#": 0.55,
      "6_3_#default#": 0.53
    },
    "paper": {
      "dimensions": {
        "height": 1035,
        "width": 790,
        "x": 450,
        "y": -130
      }
    }
  }
inputs: []
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.9.0