Traps Isolate Endpoint Deprecated Hidden

Deprecated. Use CortexXDR instead.

Palo Alto Networks Traps (Deprecated) · 8 tasks · 1 input · 2 outputs

Details

ID	`Traps Isolate Endpoint`
From Version	5.0.0
Tasks	8

README

Accepts an endpoint ID from the Traps integration and performs isolation on this endpoint.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

GenericPolling

Integrations

Traps

Scripts

This playbook does not use any scripts.

Commands

traps-endpoint-isolate-status
traps-endpoint-isolate

Playbook Inputs

Name	Description	Required
EndpointId	The Endpoint ID of the Endpoint to isolate, provided by the Palo Alto Networks Traps integration.	Optional

Playbook Outputs

Path	Description	Type
Traps.Isolate.EndpointID	The ID of the Endpoint.	unknown
Traps.IsolateResult.Status	The status of the isolation operation.	unknown

Playbook Image

Isolate_Endpoint_Traps

Inputs

EndpointId — Endpoint ID of the endpoint to isolate, provided by the Palo Alto Networks Traps integration.

Outputs

Traps.Isolate.EndpointID — The ID of the endpoint.
Traps.IsolateResult.Status — The status of the isolation operation.

Commands used

traps-endpoint-isolate traps-endpoint-isolate-status

Flowchart

Source

playbook-Isolate_Endpoint_-_Traps.yml

Download History Raw

id: Traps Isolate Endpoint
version: -1
fromversion: 5.0.0
name: Traps Isolate Endpoint
hidden: true
deprecated: true
description: Deprecated. Use CortexXDR instead.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: db8c61b1-9887-4c83-82f8-16e173bff1de
    type: start
    task:
      id: db8c61b1-9887-4c83-82f8-16e173bff1de
      version: -1
      name: ""
      description: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -160,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "1":
    id: "1"
    taskid: 51601fa9-ee3f-427a-84ac-aee609d05d44
    type: condition
    task:
      id: 51601fa9-ee3f-427a-84ac-aee609d05d44
      version: -1
      name: Is Traps integration enabled?
      description: ""
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "3"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Traps
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": -160,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "2":
    id: "2"
    taskid: 56243283-6b5a-4157-89f8-8c9399bac654
    type: title
    task:
      id: 56243283-6b5a-4157-89f8-8c9399bac654
      version: -1
      name: Done
      description: ""
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -160,
          "y": 1280
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "3":
    id: "3"
    taskid: 58c109ff-477c-426a-8187-465ce596ceac
    type: condition
    task:
      id: 58c109ff-477c-426a-8187-465ce596ceac
      version: -1
      name: Is there an endpoint to isolate?
      description: ""
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "4"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.EndpointId
            iscontext: true
    view: |-
      {
        "position": {
          "x": 160,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "4":
    id: "4"
    taskid: 0c995345-9005-435b-8e15-c292b8d8ddbc
    type: regular
    task:
      id: 0c995345-9005-435b-8e15-c292b8d8ddbc
      version: -1
      name: Traps - Isolate endpoint
      description: Isolates the specified endpoint.
      script: '|||traps-endpoint-isolate'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      endpoint_id:
        complex:
          root: inputs.EndpointId
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 380,
          "y": 540
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "5":
    id: "5"
    taskid: ed98f50d-188c-4323-8f95-73b6b33d6d2a
    type: regular
    task:
      id: ed98f50d-188c-4323-8f95-73b6b33d6d2a
      version: -1
      name: Traps - Isolate endpoint status
      description: Returns the status of the specified endpoint isolate operation.
      script: Traps|||traps-endpoint-isolate-status
      type: regular
      iscommand: true
      brand: Traps
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      operation_id:
        complex:
          root: Traps
          accessor: Isolate.OperationID
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 380,
          "y": 730
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "6":
    id: "6"
    taskid: 9e4dc3d8-eea9-42c6-8007-cb08582ea62c
    type: playbook
    task:
      id: 9e4dc3d8-eea9-42c6-8007-cb08582ea62c
      version: -1
      name: GenericPolling
      playbookName: GenericPolling
      description: ""
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      AdditionalPollingCommandArgNames: {}
      AdditionalPollingCommandArgValues: {}
      Ids:
        simple: ${Traps.Isolate.OperationID}
      Interval:
        simple: "1"
      PollingCommandArgName:
        simple: operation_id
      PollingCommandName:
        simple: traps-endpoint-isolate-status
      Timeout:
        simple: "10"
      dt:
        simple: Traps.IsolateResult(val.Status == 'pending' || val.Status == 'in progress').OperationID
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
    view: |-
      {
        "position": {
          "x": 380,
          "y": 920
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "7":
    id: "7"
    taskid: b82f3d33-9c95-4f34-8a2b-ef1acb0f8976
    type: regular
    task:
      id: b82f3d33-9c95-4f34-8a2b-ef1acb0f8976
      version: -1
      name: Traps - Isolate endpoint status
      description: Returns the status of the specified endpoint isolate operation.
      script: Traps|||traps-endpoint-isolate-status
      type: regular
      iscommand: true
      brand: Traps
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      operation_id:
        complex:
          root: Traps
          accessor: Isolate.OperationID
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 380,
          "y": 1110
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
view: |-
  {
    "linkLabelsPosition": {
      "1_2_#default#": 0.3,
      "3_2_#default#": 0.17
    },
    "paper": {
      "dimensions": {
        "height": 1295,
        "width": 920,
        "x": -160,
        "y": 50
      }
    }
  }
inputs:
- key: EndpointId
  value: {}
  required: false
  description: Endpoint ID of the endpoint to isolate, provided by the Palo Alto Networks Traps integration.
outputs:
- contextPath: Traps.Isolate.EndpointID
  description: The ID of the endpoint.
- contextPath: Traps.IsolateResult.Status
  description: The status of the isolation operation.
tests:
- No Test