- 15 Feb 2024
- 1 Minute to read
- Print
- DarkLight
- PDF
CrowdStrike Falcon - Isolate and Unisolate Assets
- Updated on 15 Feb 2024
- 1 Minute to read
- Print
- DarkLight
- PDF
CrowdStrike Falcon - Isolate quarantines each of the assets (endpoints) retreived from the saved query supplied as a trigger (or devices that have been selected in the asset table), from the network.
CrowdStrike Falcon -Unisolate restores full network connectivity to each of the assets (endpoints) retreived from the saved query supplied as a trigger.
See Creating Enforcement Sets to learn more about adding Enforcement Actions to Enforcement Sets.
General Settings
- Enforcement Set name (required) - The name of the Enforcement Set. A default value is added by Axonius. You can change the name according to your needs.
- Add description - Click to add a description of the Enforcement Set. It is recommended to describe what the Enforcement Set does.
- Run action on assets matching following query (required) - Select an asset category and a query. The Enforcement Action will be run on the assets that match the query parameters.
- A query only returns results for the asset type it was created for.
- Not all asset categories are supported for all Enforcement Actions.
- See Actions supported for Activity Logs, Adapters Fetch History, and Asset Investigation modules.
- See Actions supported for Vulnerabilities.
- See Actions supported for Software.
- Action name (required) - The name of the Main action. A default value is added by Axonius. You can change the name according to your needs.
- Configure Dynamic Values - Toggle on to enter a Dynamic Value statement. See Creating Enforcement Action Dynamic Value Statements to learn more about Dynamic Value statement syntax.
Isolate in CrowdStrike Falcon
These fields refer to CrowdStrike Falcon - Isolate.
Required Fields
Compute Node - The Axonius node to use when connecting to the specified host. For more details, see Connecting Additional Axonius Nodes.
Required Permissions
See CrowdStrike Falcon adapter - Required Permissions.
Unisolate in CrowdStrike Falcon
These fields refer to CrowdStrike Falcon - Unisolate.
Required Fields
Compute Node - The Axonius node to use when connecting to the specified host. For more details, see Connecting Additional Axonius Nodes.
Required Permissions
See CrowdStrike Falcon adapter - Required Permissions.
For more details about other Enforcement Actions available, see Action Library.