contentitemexportablefields:
  contentitemfields: {}
description: "This playbook unisolates endpoints according to the endpoint ID or host name provided in the playbook.\nIt currently supports the following integrations:\n- Carbon Black Response\n- Cortex XDR\n- Crowdstrike Falcon\n- FireEye HX \n- Cybereason\n- Microsoft Defender For Endpoint."
id: Unisolate Endpoint - Generic
inputs:
- description: The endpoint ID/device ID/sensor ID/agent ID that you want to unisolate.
  key: Endpoint_ID
  playbookInputQuery:
  required: false
  value: {}
- description: The host name of the endpoint to unisolate (using Cybereason or FireEyeHX).
  key: Hostname
  playbookInputQuery:
  required: false
  value: {}
- key: IP
  value: {}
  required: false
  description: IP address of the endpoint to unisolate. (using Defender or XDR)
  playbookInputQuery:
name: Unisolate Endpoint - Generic
outputs:
- contextPath: MicrosoftATP.MachineAction.ID
  description: The machine action ID.
  type: string
- contextPath: MicrosoftATP.NonUnisolateList
  description: The machine IDs that will not be released from isolation.
  type: string
- contextPath: MicrosoftATP.UnisolateList
  description: The machine IDs that were released from isolation.
  type: string
- contextPath: MicrosoftATP.IncorrectIDs
  description: Incorrect device IDs entered.
  type: string
- contextPath: MicrosoftATP.IncorrectHostnames
  description: Incorrect device host names entered.
  type: string
- contextPath: MicrosoftATP.IncorrectIPs
  description: Incorrect device IPs entered.
  type: string
starttaskid: '0'
tasks:
  '0':
    id: '0'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '2'
      - '1'
      - '4'
      - '5'
      - '6'
      - '7'
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      id: 2a0f3a1c-748a-4019-87d4-87a90fbe5bfb
      iscommand: false
      name: ''
      version: -1
      description: ''
    taskid: 2a0f3a1c-748a-4019-87d4-87a90fbe5bfb
    timertriggers: []
    type: start
    view: "{\n  \"position\": {\n    \"x\": 1125,\n    \"y\": 50\n  }\n}"
    continueonerrortype: ""
  '1':
    id: '1'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    loop:
      exitCondition: ''
      iscommand: false
      max: 100
      wait: 1
    nexttasks:
      '#none#':
      - '3'
    note: false
    quietmode: 0
    scriptarguments:
      Endpoint_ID:
        complex:
          root: inputs.Endpoint_ID
          transformers:
          - operator: uniq
    separatecontext: true
    skipunavailable: true
    task:
      brand: ''
      description: This playbook unisolates sensors according to the sensor ID that is provided in the playbook input.
      id: c878cab8-cdaa-407d-8b39-6cd26b7361b0
      iscommand: false
      name: Carbon Black Response - Unisolate Endpoint
      playbookName: Carbon Black Response - Unisolate Endpoint
      type: playbook
      version: -1
    taskid: c878cab8-cdaa-407d-8b39-6cd26b7361b0
    timertriggers: []
    type: playbook
    view: "{\n  \"position\": {\n    \"x\": 50,\n    \"y\": 195\n  }\n}"
    continueonerrortype: ""
  '2':
    id: '2'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    loop:
      exitCondition: ''
      iscommand: false
      max: 100
      wait: 1
    nexttasks:
      '#none#':
      - '3'
    note: false
    quietmode: 0
    scriptarguments:
      Endpoint_ID:
        complex:
          root: inputs.Endpoint_ID
          transformers:
          - operator: uniq
      Hostname:
        complex:
          root: inputs.Hostname
          transformers:
          - operator: uniq
      IP:
        complex:
          root: inputs.IP
          transformers:
          - operator: uniq
    separatecontext: true
    skipunavailable: true
    task:
      brand: ''
      description: This playbook unisolates endpoints according to the endpoint ID that is provided in the playbook input.
      id: 712259a3-c95a-423f-8639-431fb8d514c7
      iscommand: false
      name: Cortex XDR - Unisolate Endpoint
      playbookName: Cortex XDR - Unisolate Endpoint
      type: playbook
      version: -1
    taskid: 712259a3-c95a-423f-8639-431fb8d514c7
    timertriggers: []
    type: playbook
    view: "{\n  \"position\": {\n    \"x\": 480,\n    \"y\": 195\n  }\n}"
    continueonerrortype: ""
  '3':
    id: '3'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      id: a42fe062-acbe-448c-82c4-f7cdfdf15b82
      iscommand: false
      name: Done
      type: title
      version: -1
      description: ''
    taskid: a42fe062-acbe-448c-82c4-f7cdfdf15b82
    timertriggers: []
    type: title
    view: "{\n  \"position\": {\n    \"x\": 1125,\n    \"y\": 370\n  }\n}"
    continueonerrortype: ""
  '4':
    id: '4'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    loop:
      exitCondition: ''
      iscommand: false
      max: 100
      wait: 1
    nexttasks:
      '#none#':
      - '3'
    note: false
    quietmode: 0
    scriptarguments:
      Endpoint_id:
        complex:
          root: inputs.Endpoint_ID
          transformers:
          - operator: uniq
    separatecontext: true
    skipunavailable: true
    task:
      brand: ''
      description: This playbook unisolates devices according to the device ID that is provided in the playbook input.
      id: c62a1b36-38d0-4069-854c-8c5e6bdae135
      iscommand: false
      name: Crowdstrike Falcon - Unisolate Endpoint
      type: playbook
      version: -1
      playbookName: Crowdstrike Falcon - Unisolate Endpoint
    taskid: c62a1b36-38d0-4069-854c-8c5e6bdae135
    timertriggers: []
    type: playbook
    view: "{\n  \"position\": {\n    \"x\": 910,\n    \"y\": 195\n  }\n}"
    continueonerrortype: ""
  '5':
    id: '5'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    loop:
      exitCondition: ''
      iscommand: false
      max: 100
      wait: 1
    nexttasks:
      '#none#':
      - '3'
    note: false
    quietmode: 0
    scriptarguments:
      Endpoint_id:
        simple: ${inputs.Endpoint_ID}
      Hostname:
        simple: ${inputs.Hostname}
    separatecontext: true
    skipunavailable: true
    task:
      brand: ''
      description: This playbook unisolates endpoints according to the hostname/endpoint ID that is provided by the playbook input.
      id: 80b6c790-1aef-4d56-8d48-8b0446ac6e31
      iscommand: false
      name: FireEye HX - Unisolate Endpoint
      playbookName: FireEye HX - Unisolate Endpoint
      type: playbook
      version: -1
    taskid: 80b6c790-1aef-4d56-8d48-8b0446ac6e31
    timertriggers: []
    type: playbook
    view: "{\n  \"position\": {\n    \"x\": 1340,\n    \"y\": 195\n  }\n}"
    continueonerrortype: ""
  '6':
    id: '6'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    loop:
      exitCondition: ''
      iscommand: false
      max: 100
      wait: 1
    nexttasks:
      '#none#':
      - '3'
    note: false
    quietmode: 0
    scriptarguments:
      Hostname:
        complex:
          root: inputs.Hostname
          transformers:
          - operator: uniq
    separatecontext: true
    skipunavailable: true
    task:
      brand: ''
      description: This playbook unisolates a machine based on the hostname provided.
      id: b4313ff8-dec2-4f6e-8fc9-31f06e13fbc9
      iscommand: false
      name: Unisolate Endpoint - Cybereason
      playbookName: Unisolate Endpoint - Cybereason
      type: playbook
      version: -1
    taskid: b4313ff8-dec2-4f6e-8fc9-31f06e13fbc9
    timertriggers: []
    type: playbook
    view: "{\n  \"position\": {\n    \"x\": 1770,\n    \"y\": 195\n  }\n}"
    continueonerrortype: ""
  '7':
    id: '7'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    loop:
      exitCondition: ''
      iscommand: false
      max: 100
      wait: 1
    nexttasks:
      '#none#':
      - '3'
    note: false
    quietmode: 0
    scriptarguments:
      Device_id:
        complex:
          root: inputs.Endpoint_ID
          transformers:
          - operator: uniq
      Hostname:
        complex:
          root: inputs.Hostname
          transformers:
          - operator: uniq
      Device_IP:
        complex:
          root: inputs.IP
          transformers:
          - operator: uniq
    separatecontext: true
    skipunavailable: true
    task:
      brand: ''
      id: 1ecf253b-6e06-4b5e-8a05-00161e93be16
      iscommand: false
      name: Microsoft Defender For Endpoint - Unisolate Endpoint
      type: playbook
      version: -1
      description: 'This playbook accepts an endpoint ID, IP, or host name and unisolates it using the Microsoft Defender For Endpoint integration.'
      playbookName: Microsoft Defender For Endpoint - Unisolate Endpoint
    taskid: 1ecf253b-6e06-4b5e-8a05-00161e93be16
    timertriggers: []
    type: playbook
    view: "{\n  \"position\": {\n    \"x\": 2200,\n    \"y\": 195\n  }\n}"
    continueonerrortype: ""
version: -1
view: "{\n  \"linkLabelsPosition\": {},\n  \"paper\": {\n    \"dimensions\": {\n      \"height\": 385,\n      \"width\": 2530,\n      \"x\": 50,\n      \"y\": 50\n    }\n  }\n}"
tests:
- Isolate and unisolate endpoint - test
fromversion: 5.5.0