Remediate Host - BlinkOps Documentation

Run a remediation action on one or more endpoints, such as quarantining a host or killing a process. Creates an asynchronous job, and returns its ID.

External DocumentationTo learn more, visit the Trellix EDR documentation.

Basic Parameters

Parameter	Description
Action	The remediation action to run on the endpoints. For example: `quarantineHost` or `killProcessByName`. Custom reactions are prefixed with an underscore.
Action Inputs	A JSON array of the name-value pairs required by the action. For example: `[ { “name”: “pid”, “value”: “23451” } ]` The valid names depend on the selected action.
Host IDs	A comma-separated list of the agent GUIDs of the endpoints to run the action on.
Type	The type of the resource in the request body.

Advanced Parameters

Parameter	Description
MVEDR Source	The region or source of the event data. For Example: `xdrsoar:us-west`.
Trace ID	A tracking header, in the format: `workflow-id:task/step-id`.

Example Output

{
	"data": {
		"type": "hostRemediation",
		"id": "hr-5432",
		"attributes": {
			"success": [
				{
					"status": "200",
					"message": "in-progress",
					"hostIds": [
						"902F4237-B838-ED11-87C6-005056A4B536",
						"902F4237-B838-ED11-87C6-005056A4B537"
					]
				}
			],
			"failed": [
				{
					"status": "409",
					"message": "conflict, Either Some operation is going on Agent guid or its already inQuarantineHoststate",
					"hostIds": [
						"902F4237-B838-ED11-87C6-005056A4B534",
						"902F4237-B838-ED11-87C6-005056A4B535"
					]
				}
			]
		},
		"links": {
			"self": "/edr/v2/remediation/queue-jobs/rem-5432"
		}
	}
}

Workflow Library Example

Remediate Host with Trellix Edr and Send Results Via Email

Preview this Workflow on desktop