Security Operations Carbon Black Integration - Remove Host Isolation workflow

The Security Operations Carbon Black Integration - Remove Host Isolation workflow unblocks communication with a specified host or endpoint in a Carbon Black system.

Before you begin

Role required: sn_si.analyst

About this task

This workflow is not part of a capability and needs a custom orchestration in order to run.

Workflow process activities include:

• Get IP from CI
• If successful - Collect Carbon Black configurations
• Get Sensor ID
• If - Device supports isolation - and device is not isolated -Set Network Isolation Enabled to disabled.
• Update Sensor - returns Isolate Host result.

Figure 1. Carbon Black Integration - Remove Host Isolation

• Get IP from CI Flow Action
  The Get IP from CI flow action gathers the IP address from configuration items (CIs) to use in the flow.
• Get Sensor ID Flow Action
  The Get Sensor ID flow action gathers sensor identifiers to use in the flow.
• Set Network Isolation Enabled Flow Action
  The Set Network Isolation Enabled flow action enables network isolation.
• Update Sensor Flow Action
  The Update Sensor flow action updates the sensor to isolate hosts or endpoints.