Skip to main content

Deisolate endpoint command for Nebula and Cortex XSOAR integration

This article describes how to initiate a Deisolation action on an endpoint based on IP address or hostname using Palo Alto Networks Cortex™ XSOAR command line interface. This action deisolates an endpoint by process, network and desktop.

Base command

malwarebytes-deisolate-endpoint


Input

Argument name Description Required
hostname The hostname of an endpoint in Nebula. Optional
ip The IP address of an endpoint in Nebula. Optional


Context Output

Path Type Description
Malwarebytes.Scan.Machine_ID string The endpoint ID of the host.
Malwarebytes.Scan.Job_ID string The job ID of the scanned host.


Command example

!malwarebytes-isolate-endpoint hostname=TA-AZ-CLT1


Context example

{
 "Malwarebytes.Scan": {
     "Machine_ID": "017febb6-ae68-4c15-9918-d911c72d062a",
     "Job_ID": "7e6472a2-4157-48a9-a859-fa52474d8c5a"
  }
}


Human readable output

Deisolation action has been successfully started on the Endpoint: TA-AZ-CLT1 with the job_id: 7e6472a2-4157-48a9-a859-fa52474d8c5a. Use job_id in malwarebytes-get-job-status command to view results

 

Return to the table of contents.

Related articles