args:
- description: List of agent IDs of the endpoint to isolate.
  name: endpoint_id
  isArray: true
- description: List of agent IPs of the endpoint to isolate.
  name: endpoint_ip
  isArray: true
- description: |-
    Specify the integration brands to run the command for. If not provided, the command will run for all available integrations.
    Default supported brands are:
    - 'Cortex Core - IR'
    - 'CrowdstrikeFalcon'
    - 'FireEyeHX v2'
    - 'Microsoft Defender Advanced Threat Protection'
     For multi-select, provide a comma-separated list. For example: 'Cortex Core - IR, CrowdstrikeFalcon, FireEyeHX v2'.
  name: brands
comment: This script isolates endpoints using multiple integrations and returns a success or failure message.
commonfields:
  id: isolate-endpoint
  version: -1
name: isolate-endpoint
supportedModules:
- agentix
- cloud
- cloud_runtime_security
- edr
- xsiam
outputs:
- contextPath: IsolateEndpoint.Endpoint
  description: The endpoint's hostname.
  type: String
- contextPath: IsolateEndpoint.Isolated
  description: Is the endpoint isolated.
  type: String
- contextPath: IsolateEndpoint.Message
  description: An informative message for the isolation results.
  type: String
- contextPath: IsolateEndpoint.Result
  description: The result of the isolation.
  type: String
- contextPath: IsolateEndpoint.Source
  description: The used brand for the isolation.
  type: String
script: '-'
timeout: '0'
type: python
compliantpolicies:
  - EndPoint Isolation
subtype: python3
dockerimage: demisto/python3:3.12.13.10404775
fromversion: 6.10.0
tests:
- IsolateEndpoint - Testplaybook