Isolate an Endpoint with tier-2 Approval

Overview

=> Goal: Trigger this workflow when you have suspicion of an endpoint being targetted in an ongoing attack.
=> Input: amp_computer_guid (Cisco Secure Endpoint identifier for a device)

Workflow Steps:

Create an approval request to isolate the target endpoint.
Send a notification to the SOC Webex Space to investigate the target endpoint further.
Waits for approval...
If approved, isolate an endpoint if given an observable that can identify an endpoint (e.g Cisco Secure Endpoint GUID) and send notification to SOC Webex Space.

Installation

Browse to your SecureX orchestration instance. This wille be a different URL depending on the region your account is in:

Click on IMPORT to import the workflow:

Click on Browse and copy paste the content of the isolate_endpoint_with_approval.json file inside of the text window.

Click on IMPORT. Open up the workflow after importing it. You will now need to update 2 values, the Webex Access Token and the Webex Room ID (pro-tip: add the Webex Room ID bot to the space you want to use to get the ID):

Note: Please retrieve your Webex key from: https://developer.webex.com/docs/api/getting-started. Please be aware that the personal token from the getting started page only works for 12 hours. Please follow these steps to request a "bot" token: https://developer.webex.com/docs/integrations.

Now it is time to test, click on RUN in the top right of your window and fill in 2 example values (e.g. observable_type: amp_computer_guid, observable_value: 123456789), and everything should be working now. The workflow will fail as this is not the correct amp_computer_guid`, but you can test the workflow.

This workflow is a so called "Response" workflow, and can be triggered from the SecureX Threat Response pivot menu, when clicking on an amp_computer_guid:

Notes

Please test this properly before implementing in a production environment. This is a sample workflow!

Author(s)

Christopher van der Made (Cisco)