id: Containment Plan - Isolate Device
version: -1
name: Containment Plan - Isolate Device
description: |-
  ## Containment Plan - Isolate Device

  This playbook is a sub-playbook within the containment plan playbook.
  The playbook isolates devices using core commands.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 972c3692-925c-4f6f-8d88-9f4c2598429d
    type: start
    task:
      id: 972c3692-925c-4f6f-8d88-9f4c2598429d
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "23"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 490,
          "y": -812
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: ff4cc24f-e458-4eb2-b0d1-b43e70f4504d
    type: regular
    task:
      id: ff4cc24f-e458-4eb2-b0d1-b43e70f4504d
      version: -1
      name: Auto endpoint isolation
      description: Isolates the specified endpoint.
      script: '|||core-isolate-endpoint'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      endpoint_id:
        complex:
          root: EndpointsIDToIsolate
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 490,
          "y": 80
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: f1fa1236-07c7-4291-8230-fa48fb2e2d4a
    type: regular
    task:
      id: f1fa1236-07c7-4291-8230-fa48fb2e2d4a
      version: -1
      name: Set Isolated endpoint ID to the Incident context
      description: commands.local.cmd.set.parent.incident.context
      script: Builtin|||setParentIncidentContext
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "10"
    scriptarguments:
      key:
        simple: IsolatedEndpointsID
      value:
        complex:
          root: Core.Isolation
          accessor: endpoint_id
          transformers:
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 490,
          "y": 265
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: 6c786033-9c64-4365-83af-dec8a718764c
    type: title
    task:
      id: 6c786033-9c64-4365-83af-dec8a718764c
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 490,
          "y": 444
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: a0690559-7fbb-4a1e-8eb1-051f88912afd
    type: regular
    task:
      id: a0690559-7fbb-4a1e-8eb1-051f88912afd
      version: -1
      name: Get endpoint info by endpoint ID
      description: Gets a list of endpoints, according to the passed filters. If there are no filters, all endpoints are returned. Filtering by multiple fields is concatenated using the AND condition (OR is not supported). Maximum result set size is 100. Offset is the zero-based number of endpoints from the start of the result set (start by counting from 0).
      script: '|||core-get-endpoints'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "17"
    scriptarguments:
      endpoint_id_list:
        complex:
          root: inputs.EndpointID
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: "null"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 30,
          "y": -484
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "16":
    id: "16"
    taskid: f2c0cd47-a6d1-4b54-baff-9111cc14c054
    type: regular
    task:
      id: f2c0cd47-a6d1-4b54-baff-9111cc14c054
      version: -1
      name: Set endpoint IDs to isolate
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      key:
        simple: EndpointsIDToIsolate
      value:
        complex:
          root: Core.Endpoint
          filters:
          - - operator: isNotEqualString
              left:
                value:
                  simple: Core.Endpoint.endpoint_status
                iscontext: true
              right:
                value:
                  simple: DISCONNECTED
              ignorecase: true
          - - operator: containsGeneral
              left:
                value:
                  simple: Core.Endpoint.is_isolated
                iscontext: true
              right:
                value:
                  simple: AGENT_UNISOLATED
              ignorecase: true
          - - operator: containsGeneral
              left:
                value:
                  simple: Core.Endpoint.endpoint_type
                iscontext: true
              right:
                value:
                  simple: WORKSTATION
              ignorecase: true
          accessor: endpoint_id
          transformers:
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 490,
          "y": -120
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "17":
    id: "17"
    taskid: 1b35e319-899a-4a2b-80e4-591c3b92a9ae
    type: condition
    task:
      id: 1b35e319-899a-4a2b-80e4-591c3b92a9ae
      version: -1
      name: Should isolate the device?
      description: Whether to isolate the endpoint based on the input values.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "25"
      "Yes":
      - "16"
    separatecontext: false
    conditions:
    - label: "Yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.HostContainment
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
      - - operator: containsString
          left:
            value:
              complex:
                root: Core.Endpoint
                accessor: endpoint_type
            iscontext: true
          right:
            value:
              simple: WORKSTATION
          ignorecase: true
      - - operator: isEqualString
          left:
            value:
              complex:
                root: Core.Endpoint
                accessor: is_isolated
            iscontext: true
          right:
            value:
              simple: AGENT_UNISOLATED
          ignorecase: true
      - - operator: isNotEqualString
          left:
            value:
              complex:
                root: Core.Endpoint
                accessor: endpoint_status
            iscontext: true
          right:
            value:
              simple: DISCONNECTED
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 255,
          "y": -322
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "22":
    id: "22"
    taskid: 677be289-10e0-46ea-8380-a44f18e8a047
    type: regular
    task:
      id: 677be289-10e0-46ea-8380-a44f18e8a047
      version: -1
      name: Set Isolated endpoint ID to the Incident context
      description: commands.local.cmd.set.parent.incident.context
      script: Builtin|||setParentIncidentContext
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "10"
    scriptarguments:
      key:
        simple: IsolatedEndpointsID
      value:
        complex:
          root: Core.Endpoint
          accessor: endpoint_id
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: No Values
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 30,
          "y": 80
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "23":
    id: "23"
    taskid: 65bfa257-2884-4787-8dd5-64589ea2ad55
    type: condition
    task:
      id: 65bfa257-2884-4787-8dd5-64589ea2ad55
      version: -1
      name: Is the endpoint ID or the endpoint name defined?
      description: Checks if the endpoint ID or name defined.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "10"
      Endpoint ID:
      - "13"
      Endpoint Name:
      - "24"
    separatecontext: false
    conditions:
    - label: Endpoint ID
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.EndpointID
            iscontext: true
          right:
            value: {}
    - label: Endpoint Name
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.EndpointHostName
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 490,
          "y": -683
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "24":
    id: "24"
    taskid: 6e3d0a66-444e-4d5d-803a-82f81ef2afdf
    type: regular
    task:
      id: 6e3d0a66-444e-4d5d-803a-82f81ef2afdf
      version: -1
      name: Get endpoint info by endpoint name
      description: Gets a list of endpoints, according to the passed filters. If there are no filters, all endpoints are returned. Filtering by multiple fields is concatenated using the AND condition (OR is not supported). Maximum result set size is 100. Offset is the zero-based number of endpoints from the start of the result set (start by counting from 0).
      script: '|||core-get-endpoints'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "17"
    scriptarguments:
      hostname:
        complex:
          root: inputs.EndpointHostName
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: "null"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 490,
          "y": -484
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "25":
    id: "25"
    taskid: 28a11db5-8870-402e-8fee-8d815b2fc6a9
    type: condition
    task:
      id: 28a11db5-8870-402e-8fee-8d815b2fc6a9
      version: -1
      name: is the endpoint already isolated?
      description: Checks if the endpoint is already isolated.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "10"
      "yes":
      - "22"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: containsGeneral
          left:
            value:
              complex:
                root: Core.Endpoint
                accessor: is_isolated
            iscontext: true
          right:
            value:
              simple: AGENT_ISOLATED
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 30,
          "y": -120
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "17_16_Yes": 0.55,
      "23_10_#default#": 0.11,
      "25_22_yes": 0.48
    },
    "paper": {
      "dimensions": {
        "height": 1316,
        "width": 840,
        "x": 30,
        "y": -812
      }
    }
  }
inputs:
- key: HostContainment
  value:
    simple: "True"
  required: false
  description: Whether to execute endpoint isolation.
  playbookInputQuery:
- key: EndpointID
  value: {}
  required: false
  description: The endpoint ID to run commands over.
  playbookInputQuery:
- key: EndpointHostName
  value: {}
  required: false
  description: The endpoint hostname.
  playbookInputQuery:
outputs:
- contextPath: Core.Isolation.endpoint_id
  description: The isolated endpoint ID.
tests:
- No tests (auto formatted)
fromversion: 6.6.0
marketplaces:
- marketplacev2
- platform
supportedModules:
- cloud_runtime_security
- xsiam
- edr