Eradication Plan - Terminate Process

This playbook is one of the sub-playbooks in the eradication plan. This playbook handles the termination of the processes as a crucial step in the eradication action. The playbook executes actions of process termination, which is a crucial step in the eradication process. The process termination can be performed based on either the process ID or the process name.

Pack

CommonPlaybooks

Tasks

17

Inputs

• ProcessTermination — Choose 'PID' to terminate the process by PID or 'Name' to terminate the process by process name. Note: If neither option is selected, the process will not be terminated.
• EndpointID — The endpoint ID to run commands over.
• FilePath — The file path for the process termination.
• ProcessID — The process ID to terminate.

Outputs

• TerminatedProcessFromEndpoints — The terminated process from endpoint

Commands used

• core-get-script-execution-results
• core-run-script-execute-commands
• core-run-script-kill-process
• setParentIncidentContext