Block Endpoint - Carbon Black Response Deprecated

Deprecated. Use the `Block Endpoint - Carbon Black Response V2.1` playbook instead. Carbon Black Response - isolate an endpoint, given a hostname.

Carbon Black Enterprise Response · 6 tasks · 1 input · 5 outputs

Details

ID	`block_endpoint_-_carbon_black_response`
From Version	5.0.0
Tasks	6

README

Deprecated. Use the Block Endpoint - Carbon Black Response V2.1 playbook instead. Carbon Black Response - isolate an endpoint, given a hostname.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

carbonblack

Scripts

This playbook does not use any scripts.

Commands

cb-quarantine-device
cb-sensor-info

Playbook Inputs

Name	Description	Default Value	Required
Hostname	The hostname to isolate.	${Endpoint.Hostname}	Optional

Playbook Outputs

Path	Description	Type
CbResponse.Sensors.CbSensorID	Carbon Black Response sensor IDs that have been isolated.	unknown
Endpoint	The isolated enpoint.	unknown
CbResponse.Sensors.Status	Sensor status.	unknown
CbResponse.Sensors.Isolated	Is sensor isolated.	unknown
Endpoint.Hostname	Endpoint hostname.	unknown

Playbook Image

Block Endpoint - Carbon Black Response

Inputs

Hostname — The hostname to isolate.

Outputs

CbResponse.Sensors.CbSensorID — Carbon Black Response Sensors ids that has been isolated.
Endpoint — The isolated enpoint.
CbResponse.Sensors.Status — Sensor status.
CbResponse.Sensors.Isolated — Is sensor isolated.
Endpoint.Hostname — Endpoint hostname.

Commands used

cb-quarantine-device cb-sensor-info

Flowchart

Source

playbook-Block_Endpoint_-_Carbon_Black_Response.yml playbook-Block_Endpoint_-_Carbon_Black_Response_V2.1.yml playbook-Block_Endpoint_-_Carbon_Black_Response_V2.1_README.md playbook-Block_Endpoint_-_Carbon_Black_Response_V2.yml playbook-Block_Endpoint_-_Carbon_Black_Response_V2_README.md

Download History Raw

deprecated: true
id: block_endpoint_-_carbon_black_response
version: -1
name: Block Endpoint - Carbon Black Response
fromversion: "5.0.0"
description: Deprecated. Use the `Block Endpoint - Carbon Black Response V2.1` playbook instead. Carbon Black Response - isolate an endpoint, given a hostname.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 73040a0e-cca5-4197-8089-f46650317040
    type: start
    task:
      id: 73040a0e-cca5-4197-8089-f46650317040
      version: -1
      description: ""
      name: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 50
        }
      }
  "2":
    id: "2"
    taskid: 81cfb3e4-cb04-4c91-8bc7-d23980939d7e
    type: regular
    task:
      id: 81cfb3e4-cb04-4c91-8bc7-d23980939d7e
      version: -1
      name: Get host information from Carbon Black Enterprise Response
      description: Query  Carbon Black Enterprise Response for the host
      script: carbonblack|||cb-sensor-info
      type: regular
      iscommand: true
      brand: carbonblack
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      groupid: {}
      hostname:
        simple: ${inputs.Hostname}
      ip: {}
      sensor: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -180,
          "y": 380
        }
      }
  "3":
    id: "3"
    taskid: 36d3a39d-ae26-4db6-8ed5-228172276852
    type: regular
    task:
      id: 36d3a39d-ae26-4db6-8ed5-228172276852
      version: -1
      name: Isolate hostname
      description: Carbon Black Response - isolate the host
      script: carbonblack|||cb-quarantine-device
      type: regular
      iscommand: true
      brand: carbonblack
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      sensor:
        simple: ${CbResponse.Sensors.CbSensorID}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -180,
          "y": 585
        }
      }
  "4":
    id: "4"
    taskid: d35be2d6-6709-40d0-846e-dc9aef142e30
    type: title
    task:
      id: d35be2d6-6709-40d0-846e-dc9aef142e30
      version: -1
      description: ""
      name: Done
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 960
        }
      }
  "5":
    id: "5"
    taskid: 27405cc3-bf4c-4879-87ad-880b99941e9a
    type: condition
    task:
      id: 27405cc3-bf4c-4879-87ad-880b99941e9a
      version: -1
      name: Is Carbon Black Enterprise Response enabled?
      description: Check if Carbon black active in the system.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "4"
      "yes":
      - "2"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: general.isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: string.isEqual
                    left:
                      value:
                        simple: brand
                      iscontext: true
                    right:
                      value:
                        simple: carbonblack
                - - operator: string.isEqual
                    left:
                      value:
                        simple: state
                      iscontext: true
                    right:
                      value:
                        simple: active
            iscontext: true
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "6":
    id: "6"
    taskid: 5c297191-5859-4f5a-8d26-f5f1818c00aa
    type: regular
    task:
      id: 5c297191-5859-4f5a-8d26-f5f1818c00aa
      version: -1
      name: Get host information from Carbon Black Enterprise Response
      description: Query  Carbon Black Enterprise Response for the host
      script: carbonblack|||cb-sensor-info
      type: regular
      iscommand: true
      brand: carbonblack
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      groupid: {}
      hostname:
        simple: ${inputs.Hostname}
      ip: {}
      sensor: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -180,
          "y": 785
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 975,
        "width": 722.5,
        "x": -180,
        "y": 50
      }
    }
  }
inputs:
- key: Hostname
  value:
    simple: ${Endpoint.Hostname}
  required: false
  description: The hostname to isolate.
outputs:
- contextPath: CbResponse.Sensors.CbSensorID
  description: Carbon Black Response Sensors ids that has been isolated.
- contextPath: Endpoint
  description: The isolated enpoint.
- contextPath: CbResponse.Sensors.Status
  description: Sensor status.
  type: unknown
- contextPath: CbResponse.Sensors.Isolated
  description: Is sensor isolated.
  type: unknown
- contextPath: Endpoint.Hostname
  description: Endpoint hostname.
  type: unknown
tests:
- no test