Containment Plan - Quarantine File

## Containment Plan - Quarantine File This playbook is a sub-playbook within the containment plan playbook. The playbook quarantines files using core commands.

Pack

CommonPlaybooks

Tasks

16

Inputs

• FileContainment — Set to 'True' to quarantine the identified file.
• FileRemediation — Choose 'Quarantine' or 'Delete' to avoid file remediation conflicts. For example, choosing 'Quarantine' ignores the 'Delete file' task under the eradication playbook and will execute only file quarantine.
• FilePath — The path of the file to block.
• FileHash — The file hash to block.
• EndpointID — The endpoint ID to run commands over.
• AutoContainment — Whether to execute containment plan automatically.

Outputs

• QuarantinedFilesFromEndpoints — The quarantined files from endpoint.

Commands used

• core-get-quarantine-status
• core-quarantine-files
• setParentIncidentContext