<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Automated Containment — API Reference

## EDR Isolation APIs

### CrowdStrike — Contain Host

```bash
curl -X POST "https://api.crowdstrike.com/devices/entities/devices-actions/v2?action_name=contain" \
  -H "Authorization: Bearer $CS_TOKEN" \
  -d '{"ids":["DEVICE_ID"]}'
```

### CrowdStrike — Lift Containment

```bash
curl -X POST "https://api.crowdstrike.com/devices/entities/devices-actions/v2?action_name=lift_containment" \
  -H "Authorization: Bearer $CS_TOKEN" \
  -d '{"ids":["DEVICE_ID"]}'
```

### Microsoft Defender — Isolate

```bash
curl -X POST "https://api.securitycenter.microsoft.com/api/machines/$MACHINE_ID/isolate" \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"Comment":"Auto-containment","IsolationType":"Full"}'
```

### Microsoft Defender — Release

```bash
curl -X POST "https://api.securitycenter.microsoft.com/api/machines/$MACHINE_ID/unisolate" \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"Comment":"Containment lifted"}'
```

## Identity Provider APIs

### Azure AD — Disable Account

```bash
curl -X PATCH "https://graph.microsoft.com/v1.0/users/$USER_ID" \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"accountEnabled":false}'
```

### Azure AD — Revoke Sessions

```bash
curl -X POST "https://graph.microsoft.com/v1.0/users/$USER_ID/revokeSignInSessions" \
  -H "Authorization: Bearer $TOKEN"
```

### Okta — Suspend User

```bash
curl -X POST "https://company.okta.com/api/v1/users/$USER_ID/lifecycle/suspend" \
  -H "Authorization: SSWS $OKTA_TOKEN"
```

## Firewall APIs

### Palo Alto PAN-OS — Add Address Object

```bash
curl -X POST "https://firewall/api/?type=config&action=set" \
  -d "xpath=/config/devices/entry/vsys/entry/address/entry[@name='block-$IP']" \
  -d "element=<ip-netmask>$IP/32</ip-netmask>" \
  -d "key=$PANOS_KEY"
```

## Key Parameters

| Parameter | Description | Example |
|-----------|-------------|---------|
| `action_name` | CrowdStrike action | `contain`, `lift_containment` |
| `IsolationType` | Defender isolation level | `Full`, `Selective` |
| `accountEnabled` | Azure AD account state | `false` |
| `lifecycle/suspend` | Okta user state change | Suspend user |
| `--dry-run` | Simulate without executing | N/A |
