Sign in

v53

latestOpenAPI 3.0.3raw.githubusercontent.com2026-08-076771,7565.2 MB
Security Endpoint Management API

Isolate an endpoint

Spaces method and path for this operation:

<div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/action/isolate</span></div>

Refer to Spaces for more information.

Isolate an endpoint from the network. The endpoint remains isolated until it's released.

post/api/endpoint/action/isolate

Request body

agent_type'endpoint' | 'sentinel_one' | 'crowdstrike' | 'microsoft_defender_endpoint'

List of agent types to retrieve. Defaults to endpoint.

alert_idsstring[]

If this action is associated with any alerts, they can be specified here. The action will be logged in any cases associated with the specified alerts. Max of 50.

case_idsstring[]

The IDs of cases where the action taken will be logged. Max of 50.

commentstring

Optional comment

endpoint_idsstring[] required

List of endpoint IDs (cannot contain empty strings). Max of 250.

parametersSecurityEndpointManagementAPIParameters

Parameters object

Example request

{
  "agent_type": "endpoint",
  "alert_ids": [
    "alert-id-1",
    "alert-id-2"
  ],
  "case_ids": [
    "case-id-1",
    "case-id-2"
  ],
  "comment": "This is a comment",
  "endpoint_ids": [
    "endpoint-id-1",
    "endpoint-id-2"
  ]
}

Response

Indicates a successful call.

actionstring

The action ID (legacy field, same as data.id).

Example response

{
  "data": {
    "agentType": "endpoint"
  }
}