Endpoint Enrichment - Generic Deprecated Hidden

Deprecated. Use "Endpoint Enrichment - Generic v2.1" playbook instead. Enrich an Endpoint Hostname using one or more integrations

Deprecated Content (Deprecated) · 22 tasks · 1 input · 6 outputs

Details

IDendpoint_enrichment_-_generic
From Version5.0.0
Tasks22

README

DEPRECATED. Use “Endpoint Enrichment - Generic v2.1” playbook instead. Enriches an Endpoint hostname using one or more integrations.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • CrowdStrike Endpoint Enrichment

Integrations

  • carbonblack
  • SentinelOne
  • Cylance Protect

Scripts

  • Exists
  • ADGetComputer
  • EPOFindSystem

Commands

  • so-agents-query
  • cb-sensor-info
  • cylance-protect-get-devices

Playbook Inputs

Name Description Default Value Required
Hostname The hostname to enrich. ${Endpoint.Hostname} Optional

Playbook Outputs

Path Description Type
Endpoint The Endpoint’s object. unknown
Endpoint.Hostname The hostname to enrich. string
Endpoint.OS The Endpoint OS. string
Endpoint.IP The list of Endpoint IP addresses. unknown
Endpoint.MAC The list of Endpoint MAC addresses. unknown
Endpoint.Domain The Endpoint domain name. string

Playbook Image

Endpoint_Enrichment_Generic

Inputs

  • Hostname — The hostname to enrich

Outputs

  • Endpoint — The Endpoint's object
  • Endpoint.Hostname — The hostname to enrich
  • Endpoint.OS — Endpoint OS
  • Endpoint.IP — List of endpoint IP addresses
  • Endpoint.MAC — List of endpoint MAC addresses
  • Endpoint.Domain — Endpoint domain name

Commands used

cb-sensor-info cylance-protect-get-devices so-agents-query

Flowchart

yes yes yes yes yes yes yes yes Start Start Endpoint Products Endpoint Products Is ePO enabled? - Exists Is ePO enabled? Exists Is there an Endpoint Hostname to run on? Is there an Endpoint Host... Done Done Get host information from ePO - EPOFindSystem Get host information from... EPOFindSystem Is SentinelOne enabled? - Exists Is SentinelOne enabled? Exists Get host information from SentinelOne - so-agents-query Get host information from... so-agents-query Is Carbon Black Enterprise Response enabled? - Exists Is Carbon Black Enterpris... Exists Get host information from Carbon Black Enterprise Response - cb-sensor-info Get host information from... cb-sensor-info Is CrowdStrike Falcon Host enabled? - Exists Is CrowdStrike Falcon Hos... Exists Is Cylance Protect enabled? - Exists Is Cylance Protect enabled? Exists Get host information from Cylance Protect - cylance-protect-get-devices Get host information from... cylance-protect-get-devices ePO ePO Sentinel One Sentinel One Carbon Black Enterprise Response Carbon Black Enterprise R... Cylance Protect Cylance Protect CrowdStrike Falcon Host CrowdStrike Falcon Host Is Active Directory enabled? - Exists Is Active Directory enabled? Exists Get host information from Active Directory - ADGetComputer Get host information from... ADGetComputer Active Directory Active Directory CrowdStrike Endpoint Enrichment - CrowdStrike Endpoint Enrichment CrowdStrike Endpoint Enri... CrowdStrike Endpoint Enrichment

Source

playbook-Endpoint_Enrichment_-_Generic.yml playbook-Endpoint_Enrichment_-_Generic_v2.yml playbook-Endpoint_Enrichment_-_Generic_v2_README.md
Download History Raw 
DEPRECATED. Use "Endpoint Enrichment - Generic v2.1" playbook instead. Enriches an endpoint by hostname using one or more integrations.

Currently, the following integrations are supported:
- Active Directory
- McAfee ePolicy Orchestrator
- Carbon Black Enterprise Response
- Cylance Protect
- CrowdStrike Falcon Host

## Dependencies
This playbook uses the following sub-playbooks, integrations, and scripts.

### Sub-playbooks
* CrowdStrike Endpoint Enrichment

### Integrations
* Cylance Protect
* epo
* carbonblack

### Scripts
* ADGetComputer
* Exists

### Commands
* cb-sensor-info
* epo-find-system
* cylance-protect-get-devices

## Playbook Inputs
---

| **Name** | **Description** | **Default Value** | **Source** | **Required** |
| --- | --- | --- | --- | --- |
| Hostname | The hostname of the endpoint to enrich. | Hostname | Endpoint | Optional |

## Playbook Outputs
---

| **Path** | **Description** | **Type** |
| --- | --- | --- |
| Endpoint | The endpoint object of the endpoint that was enriched. | unknown |
| Endpoint.Hostname | The hostnames of the endpoints that were enriched. | string |
| Endpoint.OS | The operating systems running on the endpoints that were enriched. | string |
| Endpoint.IP | A list of the IP addresses of the endpoints. | unknown |
| Endpoint.MAC | A list of the MAC addresses of the endpoints that were enriched. | unknown |
| Endpoint.Domain | The domain names of the endpoints that were enriched. | string |

## Playbook Image
---
![Endpoint_Enrichment_Generic_v2](https://raw.githubusercontent.com/demisto/content/1bdd5229392bd86f0cc58265a24df23ee3f7e662/docs/images/playbooks/Endpoint_Enrichment_Generic_v2.png)