Skip to main content

Cortex XDR - Isolate Endpoint

This Playbook is part of the Cortex XDR by Palo Alto Networks Pack.#

Supported versions

Supported Cortex XSOAR versions: 6.2.0 and later.

This playbook accepts an XDR endpoint ID and isolates it using the 'Palo Alto Networks Cortex XDR - Investigation and Response' integration.


This playbook uses the following sub-playbooks, integrations, and scripts.


This playbook does not use any sub-playbooks.


  • CortexXDRIR


This playbook does not use any scripts.


  • xdr-endpoint-isolate
  • xdr-get-endpoints

Playbook Inputs#

NameDescriptionDefault ValueRequired
endpoint_idThe endpoint ID (string) to isolate. You can retrieve the ID using the xdr-get-endpoints command.Optional
hostnameA comma-separated list of hostnames.Endpoint.HostnameOptional
ip_listA comma-separated list of IP addresses.IP.AddressOptional

Playbook Outputs#

PaloAltoNetworksXDR.Endpoint.endpoint_idThe endpoint ID.unknown
PaloAltoNetworksXDR.Endpoint.endpoint_nameThe endpoint name.unknown
PaloAltoNetworksXDR.Endpoint.endpoint_statusThe status of the endpoint.unknown
PaloAltoNetworksXDR.Endpoint.ipA list of IP addresses.unknown
PaloAltoNetworksXDR.Endpoint.is_isolatedWhether the endpoint is isolated.unknown
Endpoint.HostnameThe hostname that is mapped to this endpoint.unknown

Playbook Image#

Cortex XDR - Isolate Endpoint