Cybereason - Unisolate Host

This workflow appears in the pivot menu and allows a user to unisolate a host in Cybereason. Supported observables: hostname, IP address, Cybereason ID

Target: Cybereason

Steps:

• Determine which observable type was provided:
  • If a Cybereason ID, set the local ID variable
  • If a hostname or IP, search for the host and set the local ID variable (if a host isn't found, end the workflow)
• Request the host be removed from isolation