id: Isolate Endpoint - Generic
version: -1
name: Isolate Endpoint - Generic
deprecated: true
description: Deprecated. Use the "Isolate Endpoint - Generic V2" playbook instead.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 20f01f93-7b37-4f3f-8c17-a466dac351ef
    type: start
    task:
      id: 20f01f93-7b37-4f3f-8c17-a466dac351ef
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "3"
      - "6"
      - "7"
      - "8"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 695,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "2":
    id: "2"
    taskid: 050d36dd-0ec3-4490-827e-e210ac5e9a04
    type: title
    task:
      id: 050d36dd-0ec3-4490-827e-e210ac5e9a04
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 695,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "3":
    id: "3"
    taskid: 33a00cbb-bc23-47d0-8062-81dbcc134d25
    type: playbook
    task:
      id: 33a00cbb-bc23-47d0-8062-81dbcc134d25
      version: -1
      name: Traps Isolate Endpoint
      playbookName: Traps Isolate Endpoint
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      EndpointId:
        complex:
          root: inputs.EndpointId
          transformers:
          - operator: uniq
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  "6":
    id: "6"
    taskid: 0342c5df-d2ff-448e-8ef1-3f4674c42bff
    type: playbook
    task:
      id: 0342c5df-d2ff-448e-8ef1-3f4674c42bff
      version: -1
      name: Isolate Endpoint - Cybereason
      description: Isolate Endpoint - Cybereason
      playbookName: Isolate Endpoint - Cybereason
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      Hostname:
        complex:
          root: inputs.Hostname
          transformers:
          - operator: uniq
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 480,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  "7":
    id: "7"
    taskid: 8045389b-6e5f-406f-834d-98fc70d8421a
    type: playbook
    task:
      id: 8045389b-6e5f-406f-834d-98fc70d8421a
      version: -1
      name: Cortex XDR - Isolate Endpoint
      playbookName: Cortex XDR - Isolate Endpoint
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      endpoint_id:
        complex:
          root: inputs.xdr_endpoint_id
          transformers:
          - operator: uniq
      hostname:
        complex:
          root: inputs.Hostname
          transformers:
          - operator: uniq
      ip_list:
        complex:
          root: inputs.IP
          transformers:
          - operator: uniq
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 910,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  "8":
    id: "8"
    taskid: ed275240-5110-4452-88ba-66244c7a914a
    type: playbook
    task:
      id: ed275240-5110-4452-88ba-66244c7a914a
      version: -1
      name: Block Endpoint - Carbon Black Response
      playbookName: Block Endpoint - Carbon Black Response
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      Hostname:
        complex:
          root: inputs.Hostname
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 1340,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 385,
        "width": 1670,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: Hostname
  value:
    complex:
      root: Endpoint
      accessor: Hostname
  required: false
  description: Hostname of the endpoint for isolation.
  playbookInputQuery:
- key: EndpointId
  value:
    complex:
      root: PaloAltoNetworksXDR
      accessor: Endpoint.endpoint_id
  required: false
  description: Endpoint ID to isolate using Traps.
  playbookInputQuery:
- key: xdr_endpoint_id
  value:
    complex:
      root: PaloAltoNetworksXDR
      accessor: Endpoint.endpoint_id
  required: false
  description: The endpoint ID (string) to isolate using Cortex XDR. You can retrieve the string from the xdr-get-endpoints command.
  playbookInputQuery:
- key: IP
  value:
    complex:
      root: IP
      accessor: Address
  required: false
  description: IP address of the endpoint for isolation.
  playbookInputQuery:
outputs:
- contextPath: CbResponse.Sensors.CbSensorID
  description: Carbon Black Response Sensors ids that has been isolated.
  type: string
- contextPath: Endpoint
  description: The isolated enpoint.
  type: string
- contextPath: Traps.Isolate.EndpointID
  description: The ID of the endpoint.
  type: string
- contextPath: Traps.IsolateResult.Status
  description: The status of the isolation operation.
  type: string
- contextPath: Cybereason.Machine
  description: Cybereason Machine name.
- contextPath: Cybereason.IsIsolated
  description: Is the machine isolated.
- contextPath: Endpoint.Hostname
  description: Hostname of the endpoint.
- contextPath: PaloAltoNetworksXDR.Endpoint.endpoint_id
  description: The endpoint ID.
- contextPath: PaloAltoNetworksXDR.Endpoint.endpoint_name
  description: The endpoint name.
- contextPath: PaloAltoNetworksXDR.Endpoint.endpoint_status
  description: The status of the endpoint.
- contextPath: PaloAltoNetworksXDR.Endpoint.ip
  description: The endpoint's IP addresses.
- contextPath: PaloAltoNetworksXDR.Endpoint.is_isolated
  description: Whether the endpoint is isolated.
- contextPath: CbResponse.Sensors.Status
  description: Sensor status.
  type: unknown
- contextPath: CbResponse.Sensors.Isolated
  description: Is sensor isolated.
  type: unknown
fromversion: 5.0.0
tests:
- No Test