Cisco Secure Endpoint - Un-Isolate Hosts

This incident response workflow allows you to un-isolate hosts involved in an incident using Cisco Secure Endpoint from a playbook or using an automation rule. When using this workflow in a playbook, the user selects which hosts to un-isolate. When using this workflow with an incident automation rule, all target hosts involved in the incident are un-isolated. Supported observables: hostname, Secure Endpoint computer GUID

Targets: Secure Endpoint - v1

Steps:

• Detect the start type and extract the supported observables
• Check if any supported observables were found (if not, end the workflow)
• For each observable:
  • Check this observable's type:
    • If a hostname, search for it in Secure Endpoint and set the local GUID variable
    • If a computer GUID, set the local GUID variable
  • Fetch the endpoint and extract its hostname
  • Un-isolate the endpoint
  • Check if the endpoint was un-isolated and update the workflow result