Cisco Secure Endpoint - Host Isolation with Tier 2 Approval
Details
This workflow appears in the pivot menu and allows you to request approval to isolate a host using Cisco Secure Endpoint.
Description
This workflow appears in the pivot menu and allows you to request approval to isolate a host using Cisco Secure Endpoint. If approved, host isolation is enabled for the endpoint. If rejected, the workflow does nothing. Supported observables: hostname, IP address, Secure Endpoint computer GUID.
Target: Secure Endpoint - v1 integration target
Steps:
- Determine which observable type was provided:
- If a Secure Endpoint computer GUID, set the local ID variable
- If a hostname or IP, search for the host and set the local ID variable (if a host isn't found, end the workflow)
- Fetch the host's details
- Check if the host is already isolated (if so, end the workflow)
- Request approval and wait for the approval to be acted upon
- If the approval task was approved, isolate the host
Required targets
This workflow requires the following targets to be available before it can be run.
Integration targets
- Secure Endpoint
About
Author
Cisco
Version
v1.3
Intent
Pivot Menu
Integration
Average rating
No ratings yet
Authorship
Cisco Managed
Contact and support information
External links
Related workflows
Cisco Managed
This incident response workflow allows you to add hashes involved in an incident to a simple custom detection list in Cisco Secure Endpoint through a playbook or using an automation rule.
Community
# Cisco Secure Endpoint Exclusion List Export Workflow
The Workflow will list exclusion lists of Cisco Secure Endpoint for validating and review.
Community
This workflow will list duplicate GUIDs in Cisco Secure Endpoint for validation and review.
Cisco Managed
This incident response workflow fetches vulnerability information from Cisco Secure Endpoint for assets involved in an incident when triggered from a playbook or using an automation rule.
Cisco Managed
This workflow appears in the pivot menu and allows you to request approval to isolate a host using Cisco Secure Endpoint.
Cisco Managed
This incident response workflow allows you to isolate hosts involved in an incident using Cisco Secure Endpoint from a playbook or using an automation rule.
Cisco Managed
This workflow appears in the pivot menu and will move the endpoint identified by the provided observable to a device group in Cisco Secure Endpoint.
Cisco Managed
This incident response workflow allows you to move computers to a group in Cisco Secure Endpoint from a playbook or using an automation rule.