skills.rest
dandye
dandyeCOMMUNITY
Explore all skills by this author →
𝕏@dandyeGitHub

basic-endpoint-triage-isolation

Triages potentially compromised endpoints using SIEM and SOAR context, then executes network isolation.

85|14|Updated May 17, 2025
Search Tags:#isolation#incident response#security operations#siem#edr#soar#endpoint triage
One-click install
npx skills add https://github.com/dandye/adk_runbooks --skill basic-endpoint-triage-isolation-dandye
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: basic-endpoint-triage-isolation
Source: https://github.com/dandye/adk_runbooks/tree/main/skills/triage/basic-endpoint-triage-isolation
Command: npx skills add https://github.com/dandye/adk_runbooks --skill basic-endpoint-triage-isolation-dandye

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security analysts need a consistent, documented procedure for assessing potentially compromised endpoints and deciding whether to isolate them, without skipping enrichment steps or losing case documentation. ## Core Features & Use Cases - Context Gathering: Retrieves SOAR case details and SIEM entity summaries for the target endpoint, plus optional vulnerability and EDR posture checks. - Compromise Assessment: Analyzes recent endpoint activity (process executions, network connections, alert volume, anomalous logins) to judge compromise likelihood and isolation urgency. - Confirmed Isolation & Documentation: Prompts the analyst to confirm isolation, executes the EDR isolate action when approved, and records findings and next steps as a SOAR case comment. - Use Case: Given a hostname flagged in a SOAR case, the agent pulls 72 hours of SIEM activity, checks vulnerability findings, confirms with the analyst, isolates the host via EDR, and documents the outcome in the case. ## Quick Start Run the endpoint triage runbook for hostname WORKSTATION-42 tied to SOAR case 1234 and isolate it if compromise is confirmed.

Frequently Asked Questions about basic-endpoint-triage-isolation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I triage a potentially compromised endpoint with SIEM and SOAR?▼

Provide the endpoint identifier, its type, the SOAR case ID, and alert group identifiers. The runbook retrieves case details, looks up the entity in the SIEM, searches the last 24-72 hours of security events, assesses compromise likelihood, and documents the outcome as a case comment.

How to isolate an endpoint using EDR during incident triage?▼

After assessing compromise likelihood, the runbook asks the analyst to confirm isolation. On confirmation, it calls the EDR isolate_endpoint action for the endpoint; if no EDR integration is available, it notes that manual isolation is required.

What inputs does endpoint triage and isolation require?▼

It requires an endpoint identifier (hostname or IP), the identifier type, a SOAR case ID, and alert group identifiers. An optional reason for triage can be supplied, and vulnerability or EDR checks run only when those integrations exist.

Does this runbook perform forensic analysis or malware removal?▼

No. Its scope is limited to initial assessment and network isolation. Deep forensic analysis, malware removal, and re-imaging are handed off as documented next steps to a Tier 3 or incident response team.

What happens if no EDR isolation tool is available?▼

The isolation step is skipped or flagged for manual action, and the runbook still completes triage, records findings and the isolation status in the SOAR case, and recommends follow-up steps such as monitoring or escalation.

Related Skills

Explore More Software Engineering Skills→
dandyedandye
120

correlate-ioc

Correlate IOC lists against SIEM alerts and SOAR cases.

Community
Intermediate
xalgordxalgord
954

performing-endpoint-forensics-investigation

Performs endpoint forensics including memory acquisition, disk imaging, artifact analysis, and timeline reconstruction.

Community
Advanced
cris-mcris-m

virustotal

Analyze hashes, URLs, IPs, and domains for malware risk via VirusTotal APIs.

Community
Advanced
FuzzdkkFuzzdkk
3

alert

Generate structured SOC alert triage steps and SIEM/EDR queries.

Community
Intermediate