isolate-endpoint

This script isolates endpoints using multiple integrations and returns a success or failure message.

python · Aggregated Scripts

Details

IDisolate-endpoint
Languagepython
From Version6.10.0
Docker Imagedemisto/python3:3.12.13.10404775

README

This script isolates endpoints using multiple integrations and returns a success or failure message.
The isolation action can be executed using the next integrations:

  • Cortex Core - IR
  • CrowdstrikeFalcon
  • FireEyeHX v2
  • Microsoft Defender Advanced Threat Protection

Script Data

Name Description
Script Type python3
Cortex XSOAR Version 6.10.0

Inputs

Argument Name Description Required
endpoint_id List of agent IDs of the endpoint to isolate. False
endpoint_ip List of agent IPs of the endpoint to isolate. False
brands Specify the integration brands to run the command for. If not provided, the command will run for all available integrations. For multi-select, provide a comma-separated list. For example: ‘Active Directory Query v2, CrowdstrikeFalcon’.  

Outputs

Path Description Type
IsolateEndpointResults.Endpoint The endpoint’s id, ip or hostname. String
IsolateEndpointResults.Result The result of the isolation. String
IsolateEndpointResults.Brand The used brand for the isolation. String
IsolateEndpointResults.Message An informative message for the isolation results. String

Source

IsolateEndpoint.py IsolateEndpoint_test.py IsolateEndpoint.yml
Download History Raw 
args:
- description: List of agent IDs of the endpoint to isolate.
  name: endpoint_id
  isArray: true
- description: List of agent IPs of the endpoint to isolate.
  name: endpoint_ip
  isArray: true
- description: |-
    Specify the integration brands to run the command for. If not provided, the command will run for all available integrations.
    Default supported brands are:
    - 'Cortex Core - IR'
    - 'CrowdstrikeFalcon'
    - 'FireEyeHX v2'
    - 'Microsoft Defender Advanced Threat Protection'
     For multi-select, provide a comma-separated list. For example: 'Cortex Core - IR, CrowdstrikeFalcon, FireEyeHX v2'.
  name: brands
comment: This script isolates endpoints using multiple integrations and returns a success or failure message.
commonfields:
  id: isolate-endpoint
  version: -1
name: isolate-endpoint
supportedModules:
- agentix
- cloud
- cloud_runtime_security
- edr
- xsiam
outputs:
- contextPath: IsolateEndpoint.Endpoint
  description: The endpoint's hostname.
  type: String
- contextPath: IsolateEndpoint.Isolated
  description: Is the endpoint isolated.
  type: String
- contextPath: IsolateEndpoint.Message
  description: An informative message for the isolation results.
  type: String
- contextPath: IsolateEndpoint.Result
  description: The result of the isolation.
  type: String
- contextPath: IsolateEndpoint.Source
  description: The used brand for the isolation.
  type: String
script: '-'
timeout: '0'
type: python
compliantpolicies:
  - EndPoint Isolation
subtype: python3
dockerimage: demisto/python3:3.12.13.10404775
fromversion: 6.10.0
tests:
- IsolateEndpoint - Testplaybook