Security Operations Carbon Black Integration- Remove Host Isolation Flow

The Security Operations Carbon Black Integration - Remove Host Isolation flow unblocks communication with a specified host or endpoint in a Carbon Black system.

Before you begin

Role required: sn_si.analyst

About this task

This flow is not part of a capability and needs a custom orchestration in order to run.

The flow process activities include:

• Get IP from CI activity
• If successful- Collect Carbon Black Configurations Flow Action
• Get Sensor ID Flow ActionGet Sensor ID
• If- Device supports isolation- and device is not isolated to disabled.
• Update Sensor activity- returns Isolate Host result.

Figure 1. Carbon Black Integration- Remove Host Isolation