Unisolate Endpoint - Cybereason

This playbook unisolates a machine based on the hostname provided.

Cybereason · 5 tasks · 1 input · 0 outputs

Details

ID	`Unisolate Endpoint - Cybereason`
From Version	5.5.0
Tasks	5

README

This playbook unisolates a machine based on the hostname provided.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

Cybereason

Scripts

IsIntegrationAvailable

Commands

cybereason-unisolate-machine

Playbook Inputs

Name	Description	Default Value	Required
Hostname	The hostname of the endpoint you want to unisolate.		Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Unisolate Endpoint - Cybereason

Inputs

Hostname — The hostname of the endpoint to unisolate using Cybereason.

Commands used

cybereason-unisolate-machine

Flowchart

Source

playbook-Unisolate_Endpoint_-_Cybereason.yml

Download History Raw

id: Unisolate Endpoint - Cybereason
version: -1
name: Unisolate Endpoint - Cybereason
description: This playbook unisolates a machine based on the hostname provided.
starttaskid: '0'
tasks:
  '0':
    id: '0'
    taskid: 8dab4dea-7c75-49b5-8752-3e11f6a071e5
    type: start
    task:
      id: 8dab4dea-7c75-49b5-8752-3e11f6a071e5
      version: -1
      name: ''
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '1'
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 450,\n    \"y\": 50\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  '1':
    id: '1'
    taskid: 29f3ba5b-96f3-4885-8d29-39d1927feb35
    type: condition
    task:
      id: 29f3ba5b-96f3-4885-8d29-39d1927feb35
      version: -1
      name: Is Cybereason integration enabled?
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'.
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      no:
      - '2'
      yes:
      - '3'
    scriptarguments:
      brandname:
        simple: Cybereason
    results:
    - brandInstances
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 450,\n    \"y\": 240\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  '2':
    id: '2'
    taskid: 649ec0e2-13f5-4534-8e29-f052ece40603
    type: title
    task:
      id: 649ec0e2-13f5-4534-8e29-f052ece40603
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ''
      description: ''
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 450,\n    \"y\": 1030\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  '3':
    id: '3'
    taskid: d2f9f02b-0f1b-48cd-8cad-6dafd2707221
    type: condition
    task:
      id: d2f9f02b-0f1b-48cd-8cad-6dafd2707221
      version: -1
      name: Is there an endpoint to unisolate?
      type: condition
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#default#':
      - '2'
      yes:
      - '4'
    separatecontext: false
    conditions:
    - label: yes
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.Hostname
            iscontext: true
    view: "{\n  \"position\": {\n    \"x\": 750,\n    \"y\": 420\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  '4':
    id: '4'
    taskid: b7f22dfd-7f2f-4340-8246-767d4570afc8
    type: regular
    task:
      id: b7f22dfd-7f2f-4340-8246-767d4570afc8
      version: -1
      name: Unisolate endpoint
      description: Stops isolation of a machine.
      script: '|||cybereason-unisolate-machine'
      type: regular
      iscommand: true
      brand: ''
    nexttasks:
      '#none#':
      - '2'
    scriptarguments:
      machine:
        simple: ${inputs.Hostname}
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 1040,\n    \"y\": 600\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
view: "{\n  \"linkLabelsPosition\": {\n    \"3_2_#default#\": 0.37\n  },\n  \"paper\": {\n    \"dimensions\": {\n      \"height\": 1045,\n      \"width\": 970,\n      \"x\": 450,\n      \"y\": 50\n    }\n  }\n}"
inputs:
- key: Hostname
  value: {}
  required: false
  description: The hostname of the endpoint to unisolate using Cybereason.
  playbookInputQuery:
outputs: []
tests:
- Cybereason Test
fromversion: 5.5.0
contentitemexportablefields:
  contentitemfields: {}
system: true