<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Implementing Endpoint Isolation Procedures

## Endpoint Isolation APIs

### CrowdStrike Falcon — Containment

| Endpoint | Method | Description |
|---|---|---|
| `/devices/entities/devices-actions/v2?action_name=contain` | POST | Isolate device |
| `/devices/entities/devices-actions/v2?action_name=lift_containment` | POST | Release device |
| `/devices/queries/devices/v1` | GET | Query devices by filter |

### Microsoft Defender for Endpoint — Isolation

| Endpoint | Method | Description |
|---|---|---|
| `/api/machines/{id}/isolate` | POST | Isolate machine (Full/Selective) |
| `/api/machines/{id}/unisolate` | POST | Release from isolation |
| `/api/machineactions/{id}` | GET | Check isolation status |

### SentinelOne — Network Quarantine

| Endpoint | Method | Description |
|---|---|---|
| `/web/api/v2.1/agents/actions/disconnect` | POST | Disconnect from network |
| `/web/api/v2.1/agents/actions/connect` | POST | Reconnect to network |

### Agent Script

```bash
# Isolate via Windows Firewall
node agent.js isolate-windows --management-ips "10.0.0.5,10.0.0.10"

# Isolate via iptables
node agent.js isolate-linux --management-ips "10.0.0.5,10.0.0.10"

# Verify isolation
node agent.js verify --test-target 8.8.8.8 --management-target 10.0.0.5
```
