Take Forensic Snapshot and Isolate

This workflow initiates a Cisco Orbital forensic snapshot for the endpoint identified by the provided observable and then attempts to enable host isolation using Cisco Secure Endpoint. Supported observables: ip, mac_address, amp_computer_guid

GitHub

---

Change Log

See the Important Notes page for more information about updating workflows

---

Requirements

• The following system atomics are used by this workflow:
  • Orbital - Query Endpoint
  • Secure Endpoint - Get Connector GUID
  • Secure Endpoint - Isolate Host
  • Threat Response - Generate Access Token
• The following atomic actions must be imported before you can import this workflow:
  • None
• The targets and account keys listed at the bottom of the page
• Cisco Secure Endpoint with Orbital

---

Workflow Steps

1. Make sure the observable is supported and set the corresponding local variable
2. If the observable wasn’t a computer GUID, try getting a GUID from Secure Endpoint
3. Generate an access token for Orbital
4. Execute a forensic snapshot
5. If a GUID was found, request host isolation

---

Configuration

• If you want to change the name of this workflow in the pivot menu, change its display name

---

Targets

Target Group: Default TargetGroup

---

Account Keys

---