Cortex XDR - Isolate Endpoint

This playbook accepts an XDR endpoint ID and isolates it using the 'Palo Alto Networks Cortex XDR - Investigation and Response' integration.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • GenericPolling

Integrations

This playbook does not use any integrations.

Scripts

This playbook does not use any scripts.

Commands

  • xdr-isolate-endpoint
  • xdr-get-endpoints

Playbook Inputs


NameDescriptionDefault ValueSourceRequired
endpoint_idThe endpoint ID (string) to isolate. You can retrieve the ID using the xdr-get-endpoints command.Endpoint.endpoint_idPaloAltoNetworksXDROptional
hostnameA comma-separated list of hostnames.HostnameEndpointOptional
ip_listA comma-separated list of IP addresses.AddressIPOptional

Playbook Outputs


There are no outputs for this playbook.

Playbook Image