SentinelOne - Disconnect Agent from Network
Details
This workflow appears in the pivot menu and allows a user to disconnect an agent from the network in SentinelOne.
Description
This workflow appears in the pivot menu and allows a user to disconnect an agent from the network in SentinelOne. Supported observables: hostname, IP address, MAC address, SentinelOne Agent ID
Target: SentinelOne - v2.1
Steps:
- Determine which observable type was provided:
- If a SentinelOne agent ID, set the local ID variable
- If a hostname, IP, or MAC address, search for the machine and set the local ID variable (if a machine isn't found, end the workflow)
- Request the machine be disconnected from the network
Required targets
This workflow requires the following targets to be available before it can be run.
Integration targets
- SentinelOne
About
Author
Cisco
Version
v1.1
Intent
Pivot Menu
Integration
Average rating
No ratings yet
Authorship
Cisco Managed
Contact and support information
External links
Related workflows
Cisco Managed
This workflow appears in the pivot menu and allows you to add a file hash to a blocklist in SentinelOne.
Cisco Managed
This playbook task workflow can be added to an incident response playbook and allows you to add one or more SHA1 file hashes to the blocklist in SentinelOne.
Cisco Managed
This workflow appears in the pivot menu and allows a user to re-connect an agent to the network in SentinelOne.
Cisco Managed
This workflow appears in the pivot menu and allows a user to disconnect an agent from the network in SentinelOne.
Cisco Managed
This incident response workflow allows you to identify and document vulnerabilities of hosts in an incident using SentinelOne from a playbook or using an automation rule.
Cisco Managed
This workflow appears in the pivot menu and allows you to remove a file hash from the blocklist in SentinelOne.