CrowdStrike Falcon - Isolate and Unisolate Assets

CrowdStrike Falcon - Isolate quarantines each of the assets (endpoints) retreived from the saved query supplied as a trigger (or devices that have been selected in the asset table), from the network.

CrowdStrike Falcon - Unisolate restores full network connectivity to each of the assets (endpoints) retrieved from the saved query supplied as a trigger.

See Creating Enforcement Sets to learn more about adding Enforcement Actions to Enforcement Sets.

When accessing an enforcement action using the API, you must use the backend form of field names.

Use the Syntax Helper to find the correct name. In the enforcement action, enable Configure Dynamic Values and select Syntax Helper.

📘

Note

• Not all asset types are supported for all Enforcement Actions.
• See Actions supported for Activity Logs, Adapters Fetch History, and Asset Investigation modules.
• See Actions supported for Aggregated Security Findings.
• See Actions supported for Software.

General Settings

Isolate in CrowdStrike Falcon

These fields refer to CrowdStrike Falcon - Isolate.

Required Fields

• Compute Node - The Axonius node to use when connecting to the specified host. For more details, see Working with Axonius Compute Nodes.

Required Permissions

See CrowdStrike Falcon adapter - Required Permissions.

Unisolate in CrowdStrike Falcon

These fields refer to CrowdStrike Falcon - Unisolate.

Required Fields

• Compute Node - The Axonius node to use when connecting to the specified host. For more details, see Working with Axonius Compute Nodes.

Required Permissions

See CrowdStrike Falcon adapter - Required Permissions.