Cisco Secure Endpoint - Move Computers to Group

This incident response workflow allows you to move computers to a group in Cisco Secure Endpoint from a playbook or using an automation rule. When using this workflow in a playbook, the user selects which endpoints to move. When using this workflow with an incident automation rule, all assets involved in the incident are moved. Supported observables: hostname, Secure Endpoint Computer GUID

Target: Secure Endpoint - v1

Steps:

• Fetch the group from Secure Endpoint (if this fails, end the workflow)
• Detect the start type and compile the observables
• For each observable:
  • If a hostname, search for it in Secure Endpoint and add its GUID to the list
  • If a computer GUID, add it to the GUID list
• Check if any GUIDs were found:
  • If not, end the workflow
  • If GUIDs were found:
    • Split the GUID list and loop through each one:
      • Fetch the endpoint and extract its hostname
      • Attempt to move the computer and update the workflow results