Microsoft Defender for Endpoint GCC - Un-Isolate Machine

This workflow appears in the pivot menu and allows a user to release a machine from isolation in Microsoft Defender for Endpoint GCC. Supported observables: Microsoft Defender Machine ID, hostname, IP address.

Target: Microsoft Defender for Endpoint GCC integration target

Steps:

• Determine which observable type was provided:
  • If a Microsoft Defender Machine ID, set the local ID variable
  • If a hostname or IP, search for the machine and set the local ID variable (if a machine isn't found, end the workflow)
• Request the machine be released from isolation