Release an isolated endpoint

Base URL
https://{kibana_url}
  • POST /api/endpoint/action/unisolate
Auth

Release an isolated endpoint, allowing it to rejoin a network.

Request body

agent_type enum

List of agent types to retrieve. Defaults to endpoint.

Values: endpoint sentinel_one crowdstrike microsoft_defender_endpoint
alert_ids string[] · min items: 1 · max items: 50

If this action is associated with any alerts, they can be specified here. The action will be logged in any cases associated with the specified alerts. Max of 50.

case_ids string[] · min items: 1 · max items: 50

The IDs of cases where the action taken will be logged. Max of 50.

comment string · max length: 30000

Optional comment

endpoint_ids string[] · min items: 1 · max items: 250 required

List of endpoint IDs (cannot contain empty strings). Max of 250.

parameters object

Parameters object

Response

Indicates a successful call.

application/json
action string

The action ID (legacy field, same as data.id).

Base URL
https://{kibana_url}