@gillesvilleneuve/crowdstrike-falcon/src/actions/hosts/lift-host-isolation.ts

CrowdStrike Falcon integration for Active Pieces with incident management, host isolation, and real-time response capabilities

import { createAction, Property } from '@activepieces/pieces-framework';
import { makeAuthenticatedApiCall, formatErrorResponse, validateRequiredParams } from '../../common/utils';
import { API_ENDPOINTS, ISOLATION_STATUSES } from '../../common/constants';

/**
 * Action to lift isolation from a host in CrowdStrike
 */
export const liftHostIsolation = createAction({
  name: 'lift_host_isolation',
  displayName: 'Lift Host Isolation',
  description: 'Remove isolation from a previously isolated host',
  
  props: {
    device_id: Property.ShortText({
      displayName: 'Device ID',
      description: 'CrowdStrike device ID to remove isolation from',
      required: true,
    }),
  },
  
  async run(context) {
    try {
      const { auth, propsValue } = context;
      
      // Validate required parameters
      validateRequiredParams(propsValue, ['device_id']);
      
      // Make API call to lift host isolation
      const response = await makeAuthenticatedApiCall(
        auth,
        API_ENDPOINTS.DEVICES_ACTIONS,
        'POST',
        {
          ids: [propsValue.device_id],
          action_parameters: [
            {
              name: 'action_name',
              value: 'lift_containment'
            }
          ]
        }
      );
      
      return {
        success: true,
        request_id: response.meta?.request_id || null,
        isolation_status: ISOLATION_STATUSES.PENDING_REMOVAL,
        device_id: propsValue.device_id,
        action_details: response.resources || [],
      };
    } catch (error) {
      return formatErrorResponse(error);
    }
  },
});