Unisolate Endpoint - Generic

This playbook unisolates endpoints according to the endpoint ID or host name provided in the playbook. It currently supports the following integrations: - Carbon Black Response - Cortex XDR - Crowdstrike Falcon - FireEye HX - Cybereason - Microsoft Defender For Endpoint.

Common Playbooks · 8 tasks · 3 inputs · 6 outputs

Details

ID	`Unisolate Endpoint - Generic`
From Version	5.5.0
Tasks	8

README

This playbook unisolates endpoints according to the endpoint ID or host name provided in the playbook.
It currently supports the following integrations:

Carbon Black Response
Cortex XDR
Crowdstrike Falcon
FireEye HX
Cybereason
Microsoft Defender For Endpoint.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

FireEye HX - Unisolate Endpoint
Cortex XDR - Unisolate Endpoint
Crowdstrike Falcon - Unisolate Endpoint
Microsoft Defender For Endpoint - Unisolate Endpoint
Unisolate Endpoint - Cybereason
Carbon Black Response - Unisolate Endpoint

Integrations

This playbook does not use any integrations.

Scripts

This playbook does not use any scripts.

Commands

This playbook does not use any commands.

Playbook Inputs

Name	Description	Required
Endpoint_ID	The endpoint ID/device ID/sensor ID/agent ID that you want to unisolate.	Optional
Hostname	The host name of the endpoint to unisolate (using Cybereason or FireEyeHX).	Optional
IP	IP address of the endpoint to unisolate. (using Defender or XDR)	Optional

Playbook Outputs

Path	Description	Type
MicrosoftATP.MachineAction.ID	The machine action ID.	string
MicrosoftATP.NonUnisolateList	The machine IDs that will not be released from isolation.	string
MicrosoftATP.UnisolateList	The machine IDs that were released from isolation.	string
MicrosoftATP.IncorrectIDs	Incorrect device IDs entered.	string
MicrosoftATP.IncorrectHostnames	Incorrect device host names entered.	string
MicrosoftATP.IncorrectIPs	Incorrect device IPs entered.	string

Playbook Image

Unisolate Endpoint - Generic

Inputs

Endpoint_ID — The endpoint ID/device ID/sensor ID/agent ID that you want to unisolate.
Hostname — The host name of the endpoint to unisolate (using Cybereason or FireEyeHX).
IP — IP address of the endpoint to unisolate. (using Defender or XDR)

Outputs

MicrosoftATP.MachineAction.ID — The machine action ID.
MicrosoftATP.NonUnisolateList — The machine IDs that will not be released from isolation.
MicrosoftATP.UnisolateList — The machine IDs that were released from isolation.
MicrosoftATP.IncorrectIDs — Incorrect device IDs entered.
MicrosoftATP.IncorrectHostnames — Incorrect device host names entered.
MicrosoftATP.IncorrectIPs — Incorrect device IPs entered.

Flowchart

Source

playbook-Unisolate_Endpoint_-_Generic.yml

Download History Raw

contentitemexportablefields:
  contentitemfields: {}
description: "This playbook unisolates endpoints according to the endpoint ID or host name provided in the playbook.\nIt currently supports the following integrations:\n- Carbon Black Response\n- Cortex XDR\n- Crowdstrike Falcon\n- FireEye HX \n- Cybereason\n- Microsoft Defender For Endpoint."
id: Unisolate Endpoint - Generic
inputs:
- description: The endpoint ID/device ID/sensor ID/agent ID that you want to unisolate.
  key: Endpoint_ID
  playbookInputQuery:
  required: false
  value: {}
- description: The host name of the endpoint to unisolate (using Cybereason or FireEyeHX).
  key: Hostname
  playbookInputQuery:
  required: false
  value: {}
- key: IP
  value: {}
  required: false
  description: IP address of the endpoint to unisolate. (using Defender or XDR)
  playbookInputQuery:
name: Unisolate Endpoint - Generic
outputs:
- contextPath: MicrosoftATP.MachineAction.ID
  description: The machine action ID.
  type: string
- contextPath: MicrosoftATP.NonUnisolateList
  description: The machine IDs that will not be released from isolation.
  type: string
- contextPath: MicrosoftATP.UnisolateList
  description: The machine IDs that were released from isolation.
  type: string
- contextPath: MicrosoftATP.IncorrectIDs
  description: Incorrect device IDs entered.
  type: string
- contextPath: MicrosoftATP.IncorrectHostnames
  description: Incorrect device host names entered.
  type: string
- contextPath: MicrosoftATP.IncorrectIPs
  description: Incorrect device IPs entered.
  type: string
starttaskid: '0'
tasks:
  '0':
    id: '0'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '2'
      - '1'
      - '4'
      - '5'
      - '6'
      - '7'
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      id: 2a0f3a1c-748a-4019-87d4-87a90fbe5bfb
      iscommand: false
      name: ''
      version: -1
      description: ''
    taskid: 2a0f3a1c-748a-4019-87d4-87a90fbe5bfb
    timertriggers: []
    type: start
    view: "{\n  \"position\": {\n    \"x\": 1125,\n    \"y\": 50\n  }\n}"
    continueonerrortype: ""
  '1':
    id: '1'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    loop:
      exitCondition: ''
      iscommand: false
      max: 100
      wait: 1
    nexttasks:
      '#none#':
      - '3'
    note: false
    quietmode: 0
    scriptarguments:
      Endpoint_ID:
        complex:
          root: inputs.Endpoint_ID
          transformers:
          - operator: uniq
    separatecontext: true
    skipunavailable: true
    task:
      brand: ''
      description: This playbook unisolates sensors according to the sensor ID that is provided in the playbook input.
      id: c878cab8-cdaa-407d-8b39-6cd26b7361b0
      iscommand: false
      name: Carbon Black Response - Unisolate Endpoint
      playbookName: Carbon Black Response - Unisolate Endpoint
      type: playbook
      version: -1
    taskid: c878cab8-cdaa-407d-8b39-6cd26b7361b0
    timertriggers: []
    type: playbook
    view: "{\n  \"position\": {\n    \"x\": 50,\n    \"y\": 195\n  }\n}"
    continueonerrortype: ""
  '2':
    id: '2'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    loop:
      exitCondition: ''
      iscommand: false
      max: 100
      wait: 1
    nexttasks:
      '#none#':
      - '3'
    note: false
    quietmode: 0
    scriptarguments:
      Endpoint_ID:
        complex:
          root: inputs.Endpoint_ID
          transformers:
          - operator: uniq
      Hostname:
        complex:
          root: inputs.Hostname
          transformers:
          - operator: uniq
      IP:
        complex:
          root: inputs.IP
          transformers:
          - operator: uniq
    separatecontext: true
    skipunavailable: true
    task:
      brand: ''
      description: This playbook unisolates endpoints according to the endpoint ID that is provided in the playbook input.
      id: 712259a3-c95a-423f-8639-431fb8d514c7
      iscommand: false
      name: Cortex XDR - Unisolate Endpoint
      playbookName: Cortex XDR - Unisolate Endpoint
      type: playbook
      version: -1
    taskid: 712259a3-c95a-423f-8639-431fb8d514c7
    timertriggers: []
    type: playbook
    view: "{\n  \"position\": {\n    \"x\": 480,\n    \"y\": 195\n  }\n}"
    continueonerrortype: ""
  '3':
    id: '3'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      id: a42fe062-acbe-448c-82c4-f7cdfdf15b82
      iscommand: false
      name: Done
      type: title
      version: -1
      description: ''
    taskid: a42fe062-acbe-448c-82c4-f7cdfdf15b82
    timertriggers: []
    type: title
    view: "{\n  \"position\": {\n    \"x\": 1125,\n    \"y\": 370\n  }\n}"
    continueonerrortype: ""
  '4':
    id: '4'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    loop:
      exitCondition: ''
      iscommand: false
      max: 100
      wait: 1
    nexttasks:
      '#none#':
      - '3'
    note: false
    quietmode: 0
    scriptarguments:
      Endpoint_id:
        complex:
          root: inputs.Endpoint_ID
          transformers:
          - operator: uniq
    separatecontext: true
    skipunavailable: true
    task:
      brand: ''
      description: This playbook unisolates devices according to the device ID that is provided in the playbook input.
      id: c62a1b36-38d0-4069-854c-8c5e6bdae135
      iscommand: false
      name: Crowdstrike Falcon - Unisolate Endpoint
      type: playbook
      version: -1
      playbookName: Crowdstrike Falcon - Unisolate Endpoint
    taskid: c62a1b36-38d0-4069-854c-8c5e6bdae135
    timertriggers: []
    type: playbook
    view: "{\n  \"position\": {\n    \"x\": 910,\n    \"y\": 195\n  }\n}"
    continueonerrortype: ""
  '5':
    id: '5'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    loop:
      exitCondition: ''
      iscommand: false
      max: 100
      wait: 1
    nexttasks:
      '#none#':
      - '3'
    note: false
    quietmode: 0
    scriptarguments:
      Endpoint_id:
        simple: ${inputs.Endpoint_ID}
      Hostname:
        simple: ${inputs.Hostname}
    separatecontext: true
    skipunavailable: true
    task:
      brand: ''
      description: This playbook unisolates endpoints according to the hostname/endpoint ID that is provided by the playbook input.
      id: 80b6c790-1aef-4d56-8d48-8b0446ac6e31
      iscommand: false
      name: FireEye HX - Unisolate Endpoint
      playbookName: FireEye HX - Unisolate Endpoint
      type: playbook
      version: -1
    taskid: 80b6c790-1aef-4d56-8d48-8b0446ac6e31
    timertriggers: []
    type: playbook
    view: "{\n  \"position\": {\n    \"x\": 1340,\n    \"y\": 195\n  }\n}"
    continueonerrortype: ""
  '6':
    id: '6'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    loop:
      exitCondition: ''
      iscommand: false
      max: 100
      wait: 1
    nexttasks:
      '#none#':
      - '3'
    note: false
    quietmode: 0
    scriptarguments:
      Hostname:
        complex:
          root: inputs.Hostname
          transformers:
          - operator: uniq
    separatecontext: true
    skipunavailable: true
    task:
      brand: ''
      description: This playbook unisolates a machine based on the hostname provided.
      id: b4313ff8-dec2-4f6e-8fc9-31f06e13fbc9
      iscommand: false
      name: Unisolate Endpoint - Cybereason
      playbookName: Unisolate Endpoint - Cybereason
      type: playbook
      version: -1
    taskid: b4313ff8-dec2-4f6e-8fc9-31f06e13fbc9
    timertriggers: []
    type: playbook
    view: "{\n  \"position\": {\n    \"x\": 1770,\n    \"y\": 195\n  }\n}"
    continueonerrortype: ""
  '7':
    id: '7'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    loop:
      exitCondition: ''
      iscommand: false
      max: 100
      wait: 1
    nexttasks:
      '#none#':
      - '3'
    note: false
    quietmode: 0
    scriptarguments:
      Device_id:
        complex:
          root: inputs.Endpoint_ID
          transformers:
          - operator: uniq
      Hostname:
        complex:
          root: inputs.Hostname
          transformers:
          - operator: uniq
      Device_IP:
        complex:
          root: inputs.IP
          transformers:
          - operator: uniq
    separatecontext: true
    skipunavailable: true
    task:
      brand: ''
      id: 1ecf253b-6e06-4b5e-8a05-00161e93be16
      iscommand: false
      name: Microsoft Defender For Endpoint - Unisolate Endpoint
      type: playbook
      version: -1
      description: 'This playbook accepts an endpoint ID, IP, or host name and unisolates it using the Microsoft Defender For Endpoint integration.'
      playbookName: Microsoft Defender For Endpoint - Unisolate Endpoint
    taskid: 1ecf253b-6e06-4b5e-8a05-00161e93be16
    timertriggers: []
    type: playbook
    view: "{\n  \"position\": {\n    \"x\": 2200,\n    \"y\": 195\n  }\n}"
    continueonerrortype: ""
version: -1
view: "{\n  \"linkLabelsPosition\": {},\n  \"paper\": {\n    \"dimensions\": {\n      \"height\": 385,\n      \"width\": 2530,\n      \"x\": 50,\n      \"y\": 50\n    }\n  }\n}"
tests:
- Isolate and unisolate endpoint - test
fromversion: 5.5.0