This article describes how to initiate a Deisolation action on an endpoint based on IP address or hostname using Palo Alto Networks Cortex™ XSOAR command line interface. This action deisolates an endpoint by process, network and desktop.
Base command
malwarebytes-deisolate-endpoint
Input
Argument name | Description | Required |
hostname | The hostname of an endpoint in Nebula. | Optional |
ip | The IP address of an endpoint in Nebula. | Optional |
Context Output
Path | Type | Description |
Malwarebytes.Scan.Machine_ID | string | The endpoint ID of the host. |
Malwarebytes.Scan.Job_ID | string | The job ID of the scanned host. |
Command example
!malwarebytes-isolate-endpoint hostname=TA-AZ-CLT1
Context example
{
"Malwarebytes.Scan": {
"Machine_ID": "017febb6-ae68-4c15-9918-d911c72d062a",
"Job_ID": "7e6472a2-4157-48a9-a859-fa52474d8c5a"
}
}
Human readable output
Deisolation action has been successfully started on the Endpoint: TA-AZ-CLT1 with the job_id: 7e6472a2-4157-48a9-a859-fa52474d8c5a. Use job_id in malwarebytes-get-job-status command to view results
Return to the table of contents.