Isolate commands for Nebula and Cortex XSOAR integration – ThreatDown Support Portal

This article describes how to run Isolation actions on an endpoint based on IP address or hostname using Palo Alto Networks Cortex™ XSOAR command line interface.

Base command

Runs process, desktop, and network isolation on the endpoint

malwarebytes-isolate-endpoint

Runs process isolation on the endpoint

malwarebytes-isolate-process

Runs desktop isolation on the endpoint

malwarebytes-isolate-desktop

Runs network isolation on the endpoint

malwarebytes-isolate-network

Removes isolation from the endpoint

malwarebytes-deisolate-endpoint

Input

Argument name	Description	Required
hostname	The hostname of an endpoint in Nebula.	Optional
ip	The IP address of an endpoint in Nebula.	Optional

Context Output

Path	Type	Description
Malwarebytes.Scan.Machine_ID	string	The endpoint ID of the host.
Malwarebytes.Scan.Job_ID	string	The job ID of the scanned host.

Command examples

!malwarebytes-isolate-endpoint hostname=DESKTOP-LI4MQ7B
!malwarebytes-isolate-process hostname=DESKTOP-LI4MQ7B
!malwarebytes-isolate-desktop hostname=DESKTOP-LI4MQ7B
!malwarebytes-isolate-network hostname=DESKTOP-LI4MQ7B
!malwarebytes-deisolate-endpoint hostname=DESKTOP-LI4MQ7B

Return to the table of contents.

Base command

Input

Context Output

Command examples

Still have questions?