SOAR App : Carbon Black Response : Can't quarantine/unquarantine if device offline

[PeterL]

The Carbon Black Response app for SOAR doesn't allow you to quarantine/unquarantine if the device is offline. In the Carbon Black interface/api this is just a flag that is set, so if they are offline it prevents them from re-connecting. This is the desired behaviour but seems from the Carbon Black Response app code that a check to see if online has been added. Can this be removed?

[marnall]

Certainly, you can edit the app code by cloning the app into a draft and then editing the carbonblack_connector.py file.