Cisco Secure Endpoint - Isolate Hosts

This incident response workflow allows you to isolate hosts involved in an incident using Cisco Secure Endpoint from a playbook or using an automation rule. When using this workflow in a playbook, the user selects which hosts to isolate. When using this workflow with an incident automation rule, all target hosts involved in the incident are isolated.

Description

Targets: Secure Endpoint - v1

Steps:

Detect the start type and extract the supported observables
Check if any supported observables were found (if not, end the workflow)
For each observable:
- Check this observable's type:
  - If a hostname, search for it in Secure Endpoint and set the local GUID variable
  - If a computer GUID, set the local GUID variable
- Fetch the endpoint and extract its hostname
- Isolate the endpoint
- Check if the endpoint was isolated and update the workflow result

This workflow requires the following targets to be available before it can be run.

Integration targets

Secure Endpoint

Author

Cisco

Version

v1.1

Intent

Incident Response

Integration

Secure Endpoint

Average rating

5.0 out of 5

Authorship

Cisco Managed

https://support.cisco.com

Content Licensing

Developer Community

Cisco Managed

This incident response workflow allows you to add hashes involved in an incident to a simple custom detection list in Cisco Secure Endpoint through a playbook or using an automation rule.

Community

# Cisco Secure Endpoint Exclusion List Export Workflow The Workflow will list exclusion lists of Cisco Secure Endpoint for validating and review.

Community

This workflow will list duplicate GUIDs in Cisco Secure Endpoint for validation and review.

Cisco Managed

This incident response workflow fetches vulnerability information from Cisco Secure Endpoint for assets involved in an incident when triggered from a playbook or using an automation rule.

Cisco Managed

This workflow appears in the pivot menu and allows you to request approval to isolate a host using Cisco Secure Endpoint.

Cisco Managed

This incident response workflow allows you to isolate hosts involved in an incident using Cisco Secure Endpoint from a playbook or using an automation rule.

Cisco Managed

This workflow appears in the pivot menu and will move the endpoint identified by the provided observable to a device group in Cisco Secure Endpoint.

Cisco Managed

This incident response workflow allows you to move computers to a group in Cisco Secure Endpoint from a playbook or using an automation rule.