mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Eric McGinnis
31 lines
1.1 KiB
YAML
31 lines
1.1 KiB
YAML
name: CrowdStrike OAuth API Network Restore
|
|
id: 92ddd3da-02ac-40d1-84fb-1bc8c9fdc1da
|
|
version: 2
|
|
creation_date: '2025-06-20'
|
|
modification_date: '2026-05-19'
|
|
author: Christian Cloutier, Splunk
|
|
type: Response
|
|
description: "Accepts a hostname or device id as input and tries to restore access for (unquarantines) the device in Crowdstrike. We then generate an observable report as well as a Markdown formatted report of the results. Both can be customized based on user preference."
|
|
playbook: CrowdStrike_OAuth_API_Network_Restore
|
|
how_to_implement: This input playbook requires the CrowdStrike OAuth API connector to be configured. It is designed to work with an endpoint hostname or device id and remove the corresponding endpoint from containment for use in automation playbooks.
|
|
references: []
|
|
app_list:
|
|
- CrowdStrike OAuth API
|
|
platform_tags:
|
|
- "host name"
|
|
- "device id"
|
|
- "Network Restore"
|
|
- "D3-RNA"
|
|
- "CrowdStrike_OAuth_API"
|
|
playbook_type: Input
|
|
vpe_type: Modern
|
|
playbook_fields: [device]
|
|
product:
|
|
- Splunk SOAR
|
|
use_cases:
|
|
- Response
|
|
- Malware
|
|
- Endpoint
|
|
defend_technique_id:
|
|
- D3-RNA
|