Darktrace /NETWORK - Unquarantine Device

This workflow appears in the pivot menu and allows a user to remove a device from quarantine in Darktrace /NETWORK. Note that this will cancel all active and pending quarantine actions for the device. Supported observables: hostname, IP address, MAC address, Darktrace ID

Target: Darktrace /NETWORK

Steps:

• Determine which observable type was provided:
  • If a Darktrace ID, set the local ID variable
  • If a hostname, IP address, or MAC address, search for the device and set the local ID variable (if a device isn't found, end the workflow)
• Get a list of recent antigena actions and parse them to a table
• Loop through each action to check if it's the action we want to clear (if it is, clear it)