stack kb security-endpoint-management-api endpoint-isolate-action cli command

elastic stack kb security-endpoint-management-api endpoint-isolate-action \
  --endpoint-ids <endpoint-ids> \
  [options]
		

Isolate an endpoint

Behaviour flags:

--dry-run — validate all inputs and exit without performing any action

--endpoint-ids string[] required

Repeatable: pass --endpoint-ids multiple times to supply more than one value

--agent-type enum

Values: endpoint, sentinel_one, crowdstrike, microsoft_defender_endpoint

--alert-ids string[]

If this action is associated with any alerts, they can be specified here. The action will be logged in any cases associated with the specified alerts. Max of 50.

Repeatable: pass --alert-ids multiple times to supply more than one value

--case-ids string[]

The IDs of cases where the action taken will be logged. Max of 50.

Repeatable: pass --case-ids multiple times to supply more than one value

--comment string

--parameters string

--input-file string

path to a JSON file to use as command input

--dry-run

validate all inputs and exit without performing any action (preview changes without applying them)

--json

output as JSON