Disabling Asset Bypass (SOAR Action in ServiceNow)

This SOAR action removes an asset from Bypass mode.

• This action can be run from an alert and from a device.
• After the asset is removed from Bypass mode in Carbon Black Cloud, the status displays as REGISTERED in ServiceNow after the next device sync in the Carbon Black Cloud device table.
• If the asset associated with an alert is removed from Bypass mode, a note displays in Carbon Black Cloud for that alert.
• To directly bypass the asset, you must add configuration items (affected CIs) to the related Security Incident.