AS-MDE-Unisolate-Machine
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
↑ Back to Content Index
This playbook is intended to be run from a Microsoft Sentinel Incident. It will match Microsoft Defender for Endpoint isolated machines with the host entities on the incident and then reslease them from isolation.
| Attribute |
Value |
| Type |
Playbook |
| Solution |
Standalone Content |
| Source |
View on GitHub |
Logic App Connectors
This playbook uses 3 Logic App connectors / built-in actions:
Action parameters (URLs, paths, function IDs)
| Action |
Method |
Endpoint |
Other |
| Add_comment_to_incident_(V3) |
post |
/Incidents/Comment |
— |
| Entities_-_Get_Hosts |
post |
/entities/host |
— |
| Action |
Method |
Endpoint |
Other |
| Get_Client_Secret |
get |
[concat('/secrets/@{encodeURIComponent(''', parameters('KeyVaultSecretName'), ''')}/value')] |
— |
http (Built-in)
| Action |
Method |
Endpoint |
Other |
| HTTP_-_Unisolate_Machine |
POST |
https://api.securitycenter.microsoft.com/api/machines/@{items('For_each_-_Host')?['additionalData']?['MdatpDeviceId']}/unisolate |
— |
| HTTP_-_Authenticate |
POST |
[concat('https://login.microsoftonline.com/', subscription().tenantId, '/oauth2/v2.0/token')] |
— |
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
↑ Back to Playbooks