id: Microsoft Defender For Endpoint - Isolate Endpoint version: -1 name: Microsoft Defender For Endpoint - Isolate Endpoint description: This playbook accepts an endpoint ID, IP, or host name and isolates it using the Microsoft Defender For Endpoint integration. starttaskid: "0" tasks: "0": id: "0" taskid: 0c9a3619-7414-4966-860a-3b83f7ae3c9a type: start task: id: 0c9a3619-7414-4966-860a-3b83f7ae3c9a version: -1 name: "" iscommand: false brand: "" description: '' nexttasks: '#none#': - "1" separatecontext: false view: |- { "position": { "x": 50, "y": -350 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "1": id: "1" taskid: f658a709-df9b-463e-8305-7c14c5b68512 type: condition task: id: f658a709-df9b-463e-8305-7c14c5b68512 version: -1 name: Is Microsoft Defender For Endpoint Integration Enabled? description: Returns 'yes' if the integration is available. scriptName: IsIntegrationAvailable type: condition iscommand: false brand: "" nexttasks: '#default#': - "2" "yes": - "32" scriptarguments: brandname: simple: Microsoft Defender Advanced Threat Protection results: - brandInstances separatecontext: false view: |- { "position": { "x": 50, "y": -230 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "2": id: "2" taskid: 2f36c13b-1511-485c-86e0-0bbf57eba943 type: title task: id: 2f36c13b-1511-485c-86e0-0bbf57eba943 version: -1 name: Done type: title iscommand: false brand: "" description: '' separatecontext: false view: |- { "position": { "x": 50, "y": 1800 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "5": id: "5" taskid: 2c229082-3fd9-43b2-83dc-5ff28a9be1b9 type: condition task: id: 2c229082-3fd9-43b2-83dc-5ff28a9be1b9 version: -1 name: Is the device ready for isolation? description: Is the device ready for isolation? type: condition iscommand: false brand: "" nexttasks: '#default#': - "2" "yes": - "31" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: simple: MicrosoftATP.IsolateList iscontext: true ignorecase: true view: |- { "position": { "x": 1160, "y": 805 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "7": id: "7" taskid: 4448d4cc-2c91-4b3a-8aa8-01705c810970 type: regular task: id: 4448d4cc-2c91-4b3a-8aa8-01705c810970 version: -1 name: Isolate endpoint description: Isolates a machine from accessing external networks. script: '|||microsoft-atp-isolate-machine' type: regular iscommand: true brand: "" nexttasks: '#none#': - "8" scriptarguments: comment: simple: 'XSOAR Microsoft Defender Isolate Endpoint - #Inc ${incident.id}' isolation_type: simple: ${inputs.Isolation_type} machine_id: simple: ${MicrosoftATP.IsolateList} continueonerror: true separatecontext: false view: |- { "position": { "x": 1160, "y": 1180 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "8": id: "8" taskid: f4b67ca6-19e6-492d-84e9-3e93ef002e3e type: condition task: id: f4b67ca6-19e6-492d-84e9-3e93ef002e3e version: -1 name: ' Check if Isolate Action Succeeded' description: Checks whether given entry/entries returned an error. Use ${lastCompletedTaskEntries} to check the previous task entries. For an array of entries, returns 'yes' if one of the entries returned an error. scriptName: isError type: condition iscommand: false brand: "" nexttasks: '#default#': - "2" "yes": - "9" scriptarguments: entryId: simple: ${lastCompletedTaskEntries} separatecontext: false view: |- { "position": { "x": 1160, "y": 1350 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "9": id: "9" taskid: 6ee8a70d-bd1a-4fe0-8e3f-2ff1a9ac9b89 type: regular task: id: 6ee8a70d-bd1a-4fe0-8e3f-2ff1a9ac9b89 version: -1 name: Print a warning to the war room - Device already isolated description: Prints a device already isolated message to the War Room (Markdown supported). scriptName: Print type: regular iscommand: false brand: "" nexttasks: '#none#': - "2" scriptarguments: value: complex: root: MicrosoftATP.IsolateList filters: - - operator: notIn left: value: simple: MicrosoftATP.IsolateList iscontext: true right: value: simple: MicrosoftATP.MachineAction.MachineID iscontext: true transformers: - operator: concat args: prefix: value: simple: | The Isolate Action did not succeed. Please validate your input or check if the machine is already in an Isolate state. The Device ID/s that were not Isolated suffix: {} separatecontext: false view: |- { "position": { "x": 1160, "y": 1630 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "10": id: "10" taskid: 913c4449-5898-4aaf-87d0-e4454d35c87b type: regular task: id: 913c4449-5898-4aaf-87d0-e4454d35c87b version: -1 name: Print inactive device description: Prints an inactive device message to the War Room (Markdown supported). scriptName: Print type: regular iscommand: false brand: "" nexttasks: '#none#': - "2" scriptarguments: value: simple: |- The following devices can't be isolated. Please validate that those devices are active in the system. ${MicrosoftATP.NonIsolateList} separatecontext: false view: |- { "position": { "x": 730, "y": 1630 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "11": id: "11" taskid: 7cc2d23d-784c-4029-8d0b-62aebc0b2abd type: regular task: id: 7cc2d23d-784c-4029-8d0b-62aebc0b2abd version: -1 name: Set Active Device description: |- Set a value in context under the key you entered. If no value is entered, the script doesn't do anything. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "5" scriptarguments: append: simple: "true" key: simple: MicrosoftATP.IsolateList value: complex: root: MicrosoftATP.Machine filters: - - operator: isEqualString left: value: simple: MicrosoftATP.Machine.HealthStatus iscontext: true right: value: simple: Active ignorecase: true accessor: ID separatecontext: false view: |- { "position": { "x": 1160, "y": 620 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "12": id: "12" taskid: 9543301b-5b6c-4bb5-864c-3d40cd4152dd type: regular task: id: 9543301b-5b6c-4bb5-864c-3d40cd4152dd version: -1 name: Set Non-valid Devices description: |- Set a value in context under the key you entered. If no value is entered, the script doesn't do anything. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "13" scriptarguments: append: simple: "true" key: simple: MicrosoftATP.NonIsolateList value: complex: root: MicrosoftATP.Machine filters: - - operator: isNotEqualString left: value: simple: MicrosoftATP.Machine.HealthStatus iscontext: true right: value: simple: Active ignorecase: true accessor: ID separatecontext: false view: |- { "position": { "x": 730, "y": 620 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "13": id: "13" taskid: ba1c6190-674a-44db-89cd-d8e982093c58 type: condition task: id: ba1c6190-674a-44db-89cd-d8e982093c58 version: -1 name: Is there any inactive device? description: Are there any inactive devices? type: condition iscommand: false brand: "" nexttasks: '#default#': - "2" "yes": - "10" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: simple: MicrosoftATP.NonIsolateList iscontext: true right: value: {} view: |- { "position": { "x": 730, "y": 805 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "17": id: "17" taskid: 30182da7-2783-468c-8d15-4305b8f01d5e type: regular task: id: 30182da7-2783-468c-8d15-4305b8f01d5e version: -1 name: Print incorrect Device ID description: Prints an incorrect device ID message to the War Room (Markdown supported). scriptName: Print type: regular iscommand: false brand: "" nexttasks: '#none#': - "2" scriptarguments: value: simple: "Please note that the following ID / Hostname / IP are incorrect. No action was taken on the following Device ID / hostname / IP: \n${MicrosoftATP.IncorrectIDs}\n${MicrosoftATP.IncorrectIPs}\n${MicrosoftATP.IncorrectHostnames}" separatecontext: false view: |- { "position": { "x": 310, "y": 1630 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "19": id: "19" taskid: 2816c649-e7c3-4f09-8730-e20eb9346ac2 type: condition task: id: 2816c649-e7c3-4f09-8730-e20eb9346ac2 version: -1 name: Check if there is any provided incorrect info description: Check if there are any incorrect device IDs. type: condition iscommand: false brand: "" nexttasks: '#default#': - "2" "yes": - "20" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: inputs.Device_id filters: - - operator: notIn left: value: simple: inputs.Device_id iscontext: true right: value: simple: MicrosoftATP.Machine.ID iscontext: true transformers: - operator: uniq iscontext: true right: value: {} - operator: isNotEmpty left: value: complex: root: inputs.Hostname filters: - - operator: notIn left: value: simple: inputs.Hostname iscontext: true right: value: simple: MicrosoftATP.Machine.ComputerDNSName iscontext: true transformers: - operator: uniq iscontext: true - operator: isNotEmpty left: value: complex: root: inputs.Device_IP filters: - - operator: notIn left: value: simple: inputs.Device_IP iscontext: true right: value: simple: MicrosoftATP.Machine.NetworkInterfaces.IPAddresses iscontext: true transformers: - operator: uniq iscontext: true view: |- { "position": { "x": 310, "y": 620 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "20": id: "20" taskid: 9b159ca4-130c-4e62-88c4-8b797db390fd type: regular task: id: 9b159ca4-130c-4e62-88c4-8b797db390fd version: -1 name: Set Incorrect ID description: |- Set a value in context under the key you entered. If no value is entered, the script doesn't do anything. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "24" scriptarguments: append: simple: "true" key: simple: MicrosoftATP.IncorrectIDs value: complex: root: inputs.Device_id filters: - - operator: notIn left: value: simple: inputs.Device_id iscontext: true right: value: simple: MicrosoftATP.Machine.ID iscontext: true separatecontext: false view: |- { "position": { "x": 310, "y": 805 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "23": id: "23" taskid: 66a8b331-c775-4263-8289-dcedbf3f2799 type: regular task: id: 66a8b331-c775-4263-8289-dcedbf3f2799 version: -1 name: Set Incorrect IP description: |- Set a value in context under the key you entered. If no value is entered, the script doesn't do anything. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "17" scriptarguments: append: simple: "true" key: simple: MicrosoftATP.IncorrectIPs value: complex: root: inputs.Device_IP filters: - - operator: isNotEmpty left: value: simple: inputs.Device_IP iscontext: true separatecontext: false view: |- { "position": { "x": 310, "y": 1350 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "24": id: "24" taskid: f95ccb2e-09b5-4ae3-88d7-802940ec7bd1 type: regular task: id: f95ccb2e-09b5-4ae3-88d7-802940ec7bd1 version: -1 name: Set Incorrect Hostname description: |- Set a value in context under the key you entered. If no value is entered, the script doesn't do anything. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "23" scriptarguments: append: simple: "true" key: simple: MicrosoftATP.IncorrectHostnames value: complex: root: inputs.Hostname filters: - - operator: notIn left: value: simple: inputs.Hostname iscontext: true right: value: simple: MicrosoftATP.Machine.ComputerDNSName iscontext: true separatecontext: false view: |- { "position": { "x": 310, "y": 1180 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "27": id: "27" taskid: 93070bb8-0dbd-4a97-842e-f851bba34472 type: title task: id: 93070bb8-0dbd-4a97-842e-f851bba34472 version: -1 name: Normalizing Device info type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "28" - "30" - "29" separatecontext: false view: |- { "position": { "x": 730, "y": 300 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "28": id: "28" taskid: 79a55f6a-7ab3-4d04-8b68-cfc13ab442dc type: title task: id: 79a55f6a-7ab3-4d04-8b68-cfc13ab442dc version: -1 name: Active Device type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "11" separatecontext: false view: |- { "position": { "x": 1160, "y": 450 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "29": id: "29" taskid: 74d28cdb-2cf4-4d2e-846c-762d094bf01f type: title task: id: 74d28cdb-2cf4-4d2e-846c-762d094bf01f version: -1 name: Inactive Device type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "12" separatecontext: false view: |- { "position": { "x": 730, "y": 450 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "30": id: "30" taskid: 59d101b0-bfca-443a-8cb7-8465d9e44521 type: title task: id: 59d101b0-bfca-443a-8cb7-8465d9e44521 version: -1 name: Incorrect Input type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "19" separatecontext: false view: |- { "position": { "x": 310, "y": 450 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "31": id: "31" taskid: 38e3795b-141d-4aba-820a-4f95e7eb47da type: title task: id: 38e3795b-141d-4aba-820a-4f95e7eb47da version: -1 name: Isolate Device type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "7" separatecontext: false view: |- { "position": { "x": 1160, "y": 1030 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "32": id: "32" taskid: 361b1e36-d71c-4128-83a8-012269159fec type: condition task: id: 361b1e36-d71c-4128-83a8-012269159fec version: -1 name: Was any data provided? type: condition iscommand: false description: 'Validate/Enrich inputs through !endpoint' brand: "" nexttasks: '#default#': - "2" "yes": - "33" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: simple: inputs.Device_id iscontext: true - operator: isNotEmpty left: value: simple: inputs.Device_IP iscontext: true - operator: isNotEmpty left: value: simple: inputs.Hostname iscontext: true view: |- { "position": { "x": 730, "y": -60 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "33": id: "33" taskid: 91926f31-cb8d-4e2a-8d36-11b6b491c6cd type: regular task: id: 91926f31-cb8d-4e2a-8d36-11b6b491c6cd version: -1 name: Enrich Endpoint info description: Returns information about an endpoint. script: '|||endpoint' type: regular iscommand: true brand: "" nexttasks: '#none#': - "27" scriptarguments: hostname: simple: ${inputs.Hostname} id: simple: ${inputs.Device_id} ip: simple: ${inputs.Device_IP} separatecontext: false view: |- { "position": { "x": 730, "y": 150 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false view: |- { "linkLabelsPosition": { "13_10_yes": 0.67, "13_2_#default#": 0.1, "19_2_#default#": 0.21, "1_2_#default#": 0.1, "5_2_#default#": 0.1, "8_2_#default#": 0.1, "8_9_yes": 0.62 }, "paper": { "dimensions": { "height": 2215, "width": 1490, "x": 50, "y": -350 } } } inputs: - key: Device_id value: {} required: false description: |- The device ID to isolate. For more information about the device, you can use the following commands: !microsoft-atp-get-machine-details !microsoft-atp-get-machines playbookInputQuery: - key: Hostname value: {} required: false description: The host name you want to isolate. playbookInputQuery: - key: Device_IP value: {} required: false description: The device IP you want to isolate. playbookInputQuery: - key: Isolation_type value: simple: Full required: false description: |- Optional Values: Full/Selective. Default is Full. For more information see Microsoft documentation: https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/respond-machine-alerts?view=o365-worldwide#isolate-devices-from-the-network playbookInputQuery: outputs: - contextPath: MicrosoftATP.MachineAction.ID description: The machine action ID. type: string - contextPath: MicrosoftATP.IsolateList description: The machine IDs that were isolated. type: string - contextPath: MicrosoftATP.NonIsolateList description: The machine IDs that will not be isolated. type: string - contextPath: MicrosoftATP.IncorrectIDs description: Incorrect device IDs entered. type: string - contextPath: MicrosoftATP.IncorrectHostnames description: Incorrect device host names entered. type: string - contextPath: MicrosoftATP.IncorrectIPs description: Incorrect device IPs entered. type: string tests: - No tests (auto formatted) fromversion: 6.2.0