Basic Endpoint Triage & Isolation Runbook

Basic Endpoint Triage & Isolation Runbook#

Objective#

Perform initial triage on a potentially compromised endpoint identified during an investigation, gather context from SIEM and other available tools (Vulnerability Management, EDR), and isolate the endpoint if necessary and confirmed.

Scope#

This runbook covers the initial assessment and potential network isolation of an endpoint. It does not cover deep forensic analysis or malware removal, which would typically follow in a more detailed incident response process.

Inputs#

  • ${ENDPOINT_ID}: The identifier of the potentially compromised endpoint (e.g., hostname, IP address).

  • ${ENDPOINT_TYPE}: The type of identifier provided (e.g., “Hostname”, “IP Address”).

  • ${CASE_ID}: The relevant SOAR case ID for documentation.

  • ${ALERT_GROUP_IDENTIFIERS}: Relevant alert group identifiers from the SOAR case.

  • (Optional) ${REASON_FOR_TRIAGE}: Brief description why this endpoint is being triaged.

Tools#

  • secops-mcp: search_security_events, lookup_entity

  • secops-soar: post_case_comment, get_case_full_details

  • scc-mcp: top_vulnerability_findings (if cloud resource), get_finding_remediation

  • (Potentially EDR tools if available via MCP: e.g., get_endpoint_details, isolate_endpoint)

  • (Potentially Vulnerability Scanner tools if available via MCP)

  • You may ask follow up question (To confirm isolation)

Workflow Steps & Diagram#

  1. Receive Input: Obtain ${ENDPOINT_ID}, ${ENDPOINT_TYPE}, ${CASE_ID}, ${ALERT_GROUP_IDENTIFIERS}, and optionally ${REASON_FOR_TRIAGE}.

  2. Gather Initial Context:

    • Retrieve full case details using soar-mcp_get_case_full_details for ${CASE_ID}.

    • Use secops-mcp_lookup_entity for ${ENDPOINT_ID} to get a SIEM activity summary.

  3. Check Endpoint Posture & Activity:

    • Search SIEM using secops-mcp_search_security_events for recent activity related to ${ENDPOINT_ID} (e.g., last 24-72 hours). Look for:

      • Suspicious process executions.

      • Anomalous network connections (especially outbound to known bad IPs/domains).

      • Significant alert volume associated with the endpoint.

      • Logins from unusual users or locations.

    • (Optional) Check Vulnerability Status:

      • If cloud resource, use scc-mcp.top_vulnerability_findings filtering for the resource name.

      • (If on-prem/other VM scanner integrated: Query scanner for critical/high vulnerabilities).

    • (Optional) Check EDR Status:

      • (Use EDR integration tool get_endpoint_details for ${ENDPOINT_ID} to check agent status, recent EDR alerts, running processes).

  4. Assess Compromise Likelihood & Need for Isolation: Based on the gathered context, SIEM activity, vulnerability/EDR status, determine the likelihood of compromise and the urgency for isolation.

  5. Confirm Isolation Action: You may ask follow up question to confirm with the analyst whether network isolation should be performed for ${ENDPOINT_ID}.

  6. Execute Isolation:

    • (Requires specific EDR integration tool with isolation capability)

    • If confirmed “Yes”:

      • Execute the EDR isolate_endpoint action for ${ENDPOINT_ID}.

  7. Document Findings & Actions: Record the triage findings, assessment, and isolation status/action taken for ${ENDPOINT_ID} in the SOAR case using soar-mcp_post_case_comment.

  8. Next Steps / Handover:

    • If isolated or confirmed compromise, determine next steps: deeper forensic analysis, malware removal, re-imaging, handover to Tier 3/IR team.

    • Document recommended next steps in the case comment.

  9. Completion: Conclude the runbook execution.

ADK Graph-Based Workflow Diagram#

        graph TD
    START(["START"]) --> extract_endpoint_node["1. extract_endpoint_node<br/><i>(Extract & Normalize Metadata)</i>"]
    extract_endpoint_node --> gather_siem_and_posture_node["2. gather_siem_and_posture_node<br/><i>(SIEM Activity & Vuln Posture Check)</i>"]
    gather_siem_and_posture_node --> assess_compromise_likelihood_node["3. assess_compromise_likelihood_node<br/><i>(Assess Compromise & Urgency)</i>"]
    assess_compromise_likelihood_node --> isolation_router{"4. isolation_router<br/><i>(Event.actions.route)</i>"}

    isolation_router -- "EXECUTE_ISOLATION" --> handle_execute_isolation_branch["5a. handle_execute_isolation_branch<br/><i>(Execute EDR Host Isolation)</i>"]
    isolation_router -- "SKIP_ISOLATION" --> handle_skip_isolation_branch["5b. handle_skip_isolation_branch<br/><i>(Skip Isolation & Monitor)</i>"]

    handle_execute_isolation_branch --> document_endpoint_report_node["6. document_endpoint_report_node<br/><i>(SOAR Comment & Report Summary)</i>"]
    handle_skip_isolation_branch --> document_endpoint_report_node

Sequence Diagram#

        sequenceDiagram
    participant Analyst
    participant AutomatedAgent as Automated Agent (MCP Client)
    participant SOAR as secops-soar
    participant SIEM as secops-mcp
    participant SCC as scc-mcp %% Cloud Vuln Check
    participant EDR as EDR (Conceptual) %% EDR Tool
    participant VulnScanner as VulnScanner (Conceptual) %% VM Tool

    Analyst->>AutomatedAgent: Start Endpoint Triage & Isolation\nInput: ENDPOINT_ID, ENDPOINT_TYPE, CASE_ID, ALERT_GROUP_IDS

    %% Step 2: Gather Initial Context
    AutomatedAgent->>SOAR: get_case_full_details(case_id=CASE_ID)
    SOAR-->>AutomatedAgent: Case Details
    AutomatedAgent->>SIEM: lookup_entity(entity_value=ENDPOINT_ID)
    SIEM-->>AutomatedAgent: SIEM Endpoint Summary

    %% Step 3: Check Posture & Activity
    AutomatedAgent->>SIEM: search_security_events(text="Activity for endpoint ENDPOINT_ID", hours_back=72)
    SIEM-->>AutomatedAgent: Detailed Endpoint Events
    opt Check Vulnerabilities
        alt Endpoint is Cloud Resource
            AutomatedAgent->>SCC: top_vulnerability_findings(project_id=..., filter="resourceName=ENDPOINT_ID")
            SCC-->>AutomatedAgent: Vulnerability Findings
        else On-Prem/Other VM
            AutomatedAgent->>VulnScanner: (Conceptual) get_vulns(target=ENDPOINT_ID)
            VulnScanner-->>AutomatedAgent: Vulnerability List
        end
    end
    opt Check EDR Status
        AutomatedAgent->>EDR: (Conceptual) get_endpoint_details(endpoint=ENDPOINT_ID)
        EDR-->>AutomatedAgent: EDR Status, Alerts, Processes
    end

    %% Step 4: Assess Likelihood
    Note over AutomatedAgent: Analyze findings, assess compromise likelihood & need for isolation

    %% Step 5: Confirm Isolation
    AutomatedAgent->>Analyst: Confirm: "Isolate endpoint ENDPOINT_ID? (Yes/No)"
    Analyst->>AutomatedAgent: Confirmation (e.g., "Yes")

    %% Step 6: Execute Isolation
    alt Confirmation is "Yes"
        opt EDR Tool Available
            AutomatedAgent->>EDR: (Conceptual) isolate_endpoint(endpoint=ENDPOINT_ID)
            EDR-->>AutomatedAgent: Isolation Confirmation/Status
        else EDR Tool Not Available
            Note over AutomatedAgent: Manual isolation required
        end
    end

    %% Step 7 & 8: Document & Next Steps
    AutomatedAgent->>SOAR: post_case_comment(case_id=CASE_ID, comment="Endpoint ENDPOINT_ID triage: Findings [...]. Assessment: [...]. Isolation Action: [Yes/No/Manual]. Next Steps: [Forensics/Reimage/Monitor]")
    SOAR-->>AutomatedAgent: Comment Confirmation

    %% Step 9: Completion
    AutomatedAgent->>Analyst: attempt_completion(result="Basic Endpoint Triage & Isolation runbook complete for ENDPOINT_ID.")

Rubrics#

The following rubric is used to evaluate the execution of this Triage/Response runbook by an LLM agent.

Grading Scale (0-100 Points)#

Criteria

Points

Description

Context & Enrichment

25

Correctly extracted entities and enriched them with relevant context (GTI, SIEM).

Analysis & Decision

25

Analyzed the enriched data to make a sound decision (FP/TP, Escalate/Close).

Action Execution

20

Performed the required response actions (e.g., isolation, containment) correctly.

Documentation

15

Clearly documented findings and actions in the case/ticket.

Operational Artifacts

15

Produced required artifacts: Sequence diagram, execution metadata (date/cost), and summary.

Evaluation Criteria Details#

1. Context & Enrichment (25 Points)#

  • 10 pts: Accurately extracted key entities (IPs, users, hashes) from the input.

  • 15 pts: Performed necessary enrichment (e.g., enrich_ioc) to gather reputation and history.

2. Analysis & Decision (25 Points)#

  • 15 pts: Interpreted the context correctly to determine the nature of the alert.

  • 10 pts: Reached a logical conclusion or next step (e.g., “Escalate to Tier 2” or “Isolate Host”).

3. Action Execution (20 Points)#

  • 10 pts: Called the correct tools to perform response actions (if applicable) or investigative steps.

  • 10 pts: Verified the success of actions or handled errors appropriately.

4. Documentation (15 Points)#

  • 15 pts: Posted a comprehensive comment or update to the SOAR case summarizing the triage.

5. Operational Artifacts (15 Points)#

  • 5 pts: Sequence Diagram: Produced a Mermaid sequence diagram visualizing the steps taken.

  • 5 pts: Execution Metadata: Recorded the date, duration, and estimated token cost.

  • 5 pts: Summary Report: Generated a concise summary of the actions and outcomes.