Isolate an endpoint

Base URL
https://{kibana_url}
  • POST /api/endpoint/action/isolate
  • POST /s/{space_id}/api/endpoint/action/isolate
Auth

Isolate an endpoint from the network. The endpoint remains isolated until it's released.

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Request body

agent_type enum

List of agent types to retrieve. Defaults to endpoint.

Values: endpoint sentinel_one crowdstrike microsoft_defender_endpoint
alert_ids string[] · format: nonempty · min items: 1

A list of alerts ids.

case_ids string[] · min items: 1

Case IDs to be updated (cannot contain empty strings)

comment string

Optional comment

endpoint_ids string[] · min items: 1 required

List of endpoint IDs (cannot contain empty strings)

parameters object

Optional parameters object

Response

OK

application/json

Response Type: object

Base URL
https://{kibana_url}