Endpoint Proactive Response Example Playbook
Important
When configuring playbooks for Proactive Response, the playbook name must match the trigger name and follow the Proactive Response Naming Convention.
Host Isolation and Restoration Playbook Configuration ⫘
- Configure a Taegis Agent - Isolate playbook for the Isolate action using the trigger parameters shown below. For more information about adding a new playbook, see Create a New Playbook.
- Enter
MXDR_ISOLATEin the Playbook Details Name field. - Select User Initiated for the Trigger Type.
- Select Response Action for the Category.
- Select Asset for the Context.
- Enter
MXDR_ISOLATEin the Trigger Source Name field. - Under When does this playbook run?, select Only When and then enter
inputs.asset.endpointType == 'ENDPOINT_TAEGIS'in the Trigger Filter field.
Playbook for isolating endpoints with the Taegis Agent installed
Note
Each playbook has built-in documentation that walks through the steps to create a new playbook. Select Documentation from a playbook template or configured playbook in XDR to open this in a new tab and follow the guidance there.
- Configure a Taegis Agent - Restore playbook for the Restore action using the trigger parameters shown below. For more information about adding a new playbook, see Create a New Playbook.
- Enter
MXDR_RESTOREin the Playbook Details Name field. - Select User Initiated for the Trigger Type.
- Select Response Action for the Category.
- Select Asset for the Context.
- Enter
MXDR_RESTOREin the Trigger Source Name field. - Under When does this playbook run?, select Only When and then enter
inputs.asset.endpointType == 'ENDPOINT_TAEGIS'in the Trigger Filter field.
Playbook for restoring endpoints with the Taegis Agent installed
Note
Each playbook has built-in documentation that walks through the steps to create a new playbook. Select Documentation from a playbook template or configured playbook in XDR to open this in a new tab and follow the guidance there.
- Now that you have created the Isolate and Restore playbooks, they appear in the ACTIONS menu for Taegis Agent assets. For example,
MXDR_ISOLATEandMXDR_RESTORE.
Response Actions for the Taegis Agent