capabilities.work

Cortex XDR Endpoint Isolation and Verification

A 3-step recipe with Palo Alto Networks. We can help you get access.

Recipe · 3 steps

Cortex XDR Endpoint Isolation and Verification

with Palo Alto Networks · Threat Detection & Response Management

Isolate a Cortex XDR endpoint and verify the isolation took effect.

  1. Return endpoints matching the filter so a target can be selected for isolation.
  2. Issue a network isolation action for the resolved endpoint and capture the action id.
  3. Re-read the endpoint to confirm its isolation state. Repeat the read while the endpoint is still pending isolation, and end once it reports isolated.
What you'll need to have ready
  • filterField: Endpoint field to filter on (e.g. endpoint_name, ip, endpoint_id).
  • filterOperator: Comparison operator for the filter (e.g. eq, in).
  • filterValue: Value the filter field is compared against.
For your developer

Arazzo workflow palo-alto-networks:isolate-endpoint, 3 operations: getEndpoints → isolateEndpoints → getEndpoints. Specs on APIs.io.

More recipes with Palo Alto Networks

Cortex XDR Incident Triage and ResolutionCortex XDR Script Remediation with Result PollingCortex XDR XQL Threat HuntCortex XSIAM Incident-Driven Asset and XQL HuntCortex XSOAR Incident Response OrchestrationIoT Security Alert Investigation and ResolutionIoT Security Device Risk and Policy RecommendationPrisma Cloud Alert Triage and DismissalPrisma Cloud Policy Review and UpdatePrisma Cloud RQL Configuration and Asset Search