Cortex XDR - Isolate Endpoint

This playbook accepts an XDR endpoint ID and isolates it using the 'Palo Alto Networks Cortex XDR - Investigation and Response' integration.

Dependencies#

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks#

  • GenericPolling

Integrations#

This playbook does not use any integrations.

Scripts#

This playbook does not use any scripts.

Commands#

  • xdr-isolate-endpoint
  • xdr-get-endpoints

Playbook Inputs#


NameDescriptionDefault ValueSourceRequired
endpoint_idThe endpoint ID (string) to isolate. You can retrieve the ID using the xdr-get-endpoints command.Endpoint.endpoint_idPaloAltoNetworksXDROptional
hostnameA comma-separated list of hostnames.HostnameEndpointOptional
ip_listA comma-separated list of IP addresses.AddressIPOptional

Playbook Outputs#


There are no outputs for this playbook.

Playbook Image