Eradication Plan

This playbook handles all the eradication actions available with Cortex XSIAM, including the following sub-playbooks: * Eradication Plan - Reset user password * Eradication Plan - Delete file * Eradication Plan - Kill process (currently, the playbook supports terminating a process by name) Note: The playbook inputs enable manipulating the execution flow. Read the input descriptions for details.

Pack

CommonPlaybooks

Tasks

13

Inputs

• AutoEradicate — Set to True to execute the eradication playbook automatically.
• EndpointID — The endpoint ID.
• FilePath — The file path for the file deletion and for the process termination task.
• Username — The username to reset the password for.
• FileRemediation — Choose 'Quarantine' or 'Delete' to avoid file remediation conflicts. For example, choosing 'Delete' ignores the 'Quarantine file' task under the containment playbook and executes only file deletion.
• UserRemediation — Set to 'True' to reset the user's password.
• ProcessTermination — Choose 'PID' to terminate the process using the Process ID, or 'Name' to terminate the process using its name. Please note that providing the file path is mandatory for the process termination. If 'PID' is chosen, the input `ProcessID` should not be empty; otherwise, the termination will not proceed.
• ProcessID — The process ID to terminate.

Outputs

• TerminatedProcessFromEndpoints — The terminated process from endpoint