id: Unisolate Endpoint - Cybereason
version: -1
name: Unisolate Endpoint - Cybereason
description: This playbook unisolates a machine based on the hostname provided.
starttaskid: '0'
tasks:
  '0':
    id: '0'
    taskid: 8dab4dea-7c75-49b5-8752-3e11f6a071e5
    type: start
    task:
      id: 8dab4dea-7c75-49b5-8752-3e11f6a071e5
      version: -1
      name: ''
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '1'
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 450,\n    \"y\": 50\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  '1':
    id: '1'
    taskid: 29f3ba5b-96f3-4885-8d29-39d1927feb35
    type: condition
    task:
      id: 29f3ba5b-96f3-4885-8d29-39d1927feb35
      version: -1
      name: Is Cybereason integration enabled?
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'.
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      no:
      - '2'
      yes:
      - '3'
    scriptarguments:
      brandname:
        simple: Cybereason
    results:
    - brandInstances
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 450,\n    \"y\": 240\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  '2':
    id: '2'
    taskid: 649ec0e2-13f5-4534-8e29-f052ece40603
    type: title
    task:
      id: 649ec0e2-13f5-4534-8e29-f052ece40603
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ''
      description: ''
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 450,\n    \"y\": 1030\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  '3':
    id: '3'
    taskid: d2f9f02b-0f1b-48cd-8cad-6dafd2707221
    type: condition
    task:
      id: d2f9f02b-0f1b-48cd-8cad-6dafd2707221
      version: -1
      name: Is there an endpoint to unisolate?
      type: condition
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#default#':
      - '2'
      yes:
      - '4'
    separatecontext: false
    conditions:
    - label: yes
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.Hostname
            iscontext: true
    view: "{\n  \"position\": {\n    \"x\": 750,\n    \"y\": 420\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  '4':
    id: '4'
    taskid: b7f22dfd-7f2f-4340-8246-767d4570afc8
    type: regular
    task:
      id: b7f22dfd-7f2f-4340-8246-767d4570afc8
      version: -1
      name: Unisolate endpoint
      description: Stops isolation of a machine.
      script: '|||cybereason-unisolate-machine'
      type: regular
      iscommand: true
      brand: ''
    nexttasks:
      '#none#':
      - '2'
    scriptarguments:
      machine:
        simple: ${inputs.Hostname}
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 1040,\n    \"y\": 600\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
view: "{\n  \"linkLabelsPosition\": {\n    \"3_2_#default#\": 0.37\n  },\n  \"paper\": {\n    \"dimensions\": {\n      \"height\": 1045,\n      \"width\": 970,\n      \"x\": 450,\n      \"y\": 50\n    }\n  }\n}"
inputs:
- key: Hostname
  value: {}
  required: false
  description: The hostname of the endpoint to unisolate using Cybereason.
  playbookInputQuery:
outputs: []
tests:
- Cybereason Test
fromversion: 5.5.0
contentitemexportablefields:
  contentitemfields: {}
system: true