KillProcessWrapper

A cross-vendor wrapper script that triggers a ‘process kill’ command - i.e executes the proper kill process command according to the vendor: CrowdstrikeFalcon or Cortex XDR. The script will only fail when the kill process action fails for both vendors.

Type

python

Pack

MalwareInvestigationAndResponse

Source

import demistomock as demisto  # noqa: F401
from CommonServerPython import *  # noqa: F401

"""
A cross-vendor wrapper script that triggers a `process kill` command -
i.e executes the proper kill process command according to the vendor: CrowdstrikeFalcon or Cortex XDR.
The script will only fail when the kill process action fails for both vendors.
"""


from CommonServerUserPython import *

XDR_PROCESS_KILL_COMMAND = "xdr-run-script-kill-process"
CROWDSTRIKE_PROCESS_KILL_COMMAND = "cs-falcon-rtr-kill-process"

""" STANDALONE FUNCTION """


def create_commands(endpoint_id: str, process_id: str = None, process_name: str = None) -> list[CommandRunner.Command]:
    """
    Create a list of process kill commands (of `Cortex XDR`and `CrowdstrikeFalcon`), that should be executed
    according to the given arguments.

    Args:
        endpoint_id: The Endpoint ID in which you would like to kill the given process.
        process_id: The ID of the process to kill.
        process_name: The name of the process to kill.

    Returns: A list of Commands.
    """
    commands = []

    if process_name:
        commands.append(
            CommandRunner.Command(
                commands=XDR_PROCESS_KILL_COMMAND, args_lst={"endpoint_ids": endpoint_id, "process_name": process_name}
            )
        )
    if process_id:
        commands.append(
            CommandRunner.Command(
                commands=CROWDSTRIKE_PROCESS_KILL_COMMAND, args_lst={"host_id": endpoint_id, "process_ids": process_id}
            )
        )

    return commands


""" COMMAND FUNCTION """


def run_killing_process_action(endpoint_id: str, process_id: str = None, process_name: str = None) -> CommandResults:
    """
    Given arguments to the process kill command, returns a list including the results of the commands execution.

    Args:
        endpoint_id: The Endpoint ID in which you would like to kill the given process.
        process_id: The ID of the process to kill.
        process_name: The name of the process to kill.

    Returns: A list of the kill process command results.
    """
    commands = create_commands(endpoint_id, process_id, process_name)
    return CommandRunner.run_commands_with_summary(commands)


""" MAIN FUNCTION """


def main():
    args = demisto.args()
    endpoint_id = args.get("endpoint_id")
    process_id = args.get("process_id")
    process_name = args.get("process_name")
    approve_action = args.get("approve_action")

    if approve_action == "YES":
        try:
            # Handle missing arguments:
            if not endpoint_id:
                raise Exception("Endpoint ID was not specified.")
            if not (process_id or process_name):
                raise Exception("Process information was not specified - You should provide the process ID or the process name.")
            return_results(run_killing_process_action(endpoint_id, process_id, process_name))
        except Exception as ex:
            return_error(f"Failed to execute KillProcessWrapper. Error: {ex!s}")

    else:  # killing process was not confirmed
        result = CommandResults(
            outputs_prefix="KillProcessWrapper",
            outputs_key_field="",
            readable_output="The process was not killed because no approval was given.",
        )
        return_results(result)


""" ENTRY POINT """


if __name__ in ("__main__", "__builtin__", "builtins"):
    main()

README