Block File - Carbon Black Response

This playbook receives an MD5 hash and adds it to the block list in Carbon Black Enterprise Response. Files with that MD5 hash are blocked from execution on the managed endpoints. If the hash is already on the block list, no action is taken on the MD5. The playbook uses the integration ''VMware Carbon Black EDR v2".

Carbon Black Enterprise Response · 5 tasks · 2 inputs · 3 outputs

Details

ID	`Block File - Carbon Black Response`
From Version	5.0.0
Tasks	5

README

The playbook uses the integration ‘‘VMware Carbon Black EDR v2”.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

CarbonBlackResponseV2

Scripts

This playbook does not use any scripts.

Commands

cb-edr-binary-ban

Playbook Inputs

Name	Description	Default Value	Required
MD5	The MD5 hash of the file you want to block.	File.MD5	Optional
Text	Text description of block list.	Blocked by XSOAR	Optional

Playbook Outputs

Path	Description	Type
CbResponse.BlockedHashes.LastBlock.Time	Last block time.	unknown
CbResponse.BlockedHashes.LastBlock.Hostname	Last block hostname.	unknown
CbResponse.BlockedHashes.LastBlock.CbSensorID	Last block sensor ID.	unknown

Playbook Image

Block File - Carbon Black Response

Inputs

MD5 — The MD5 hash of the file you want to block.
Text — Text description of block list.

Outputs

CbResponse.BlockedHashes.LastBlock.Time — Last block time
CbResponse.BlockedHashes.LastBlock.Hostname — Last block hostname
CbResponse.BlockedHashes.LastBlock.CbSensorID — Last block sensor ID

Commands used

cb-edr-binary-ban

Flowchart

Source

playbook-Block_File_-_Carbon_Black_Response.yml

Download History Raw

id: Block File - Carbon Black Response
version: -1
contentitemexportablefields:
  contentitemfields: {}
name: Block File - Carbon Black Response
fromversion: 5.0.0
description: |-
  This playbook receives an MD5 hash and adds it to the block list in Carbon Black Enterprise Response. Files with that MD5 hash are blocked from execution on the managed endpoints. If the hash is already on the block list, no action is taken on the MD5.

  The playbook uses the integration ''VMware Carbon Black EDR v2".
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 5e4385e3-76c2-48e2-80a4-c3798cdae027
    type: start
    task:
      id: 5e4385e3-76c2-48e2-80a4-c3798cdae027
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "8"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": -340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: c86f4a68-540e-4816-8aca-460b5c897b6d
    type: regular
    task:
      id: c86f4a68-540e-4816-8aca-460b5c897b6d
      version: -1
      name: Get a list of blacklisted hashes
      description: Prevent execution of a specified md5 hash
      script: '|||cb-edr-binary-ban'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      md5:
        complex:
          root: inputs.MD5
      text:
        complex:
          root: inputs.Text
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 920,
          "y": 140
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: 83cd8bdb-894a-436d-87df-45889e52da88
    type: condition
    task:
      id: 83cd8bdb-894a-436d-87df-45889e52da88
      version: -1
      name: Is Carbon Black Enterprise Response enabled?
      description: Checks if Carbon Black Enterprise Response integration is enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "2"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: VMware Carbon Black EDR v2
                    ignorecase: true
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                    ignorecase: true
                accessor: brand
            iscontext: true
          right:
            value: {}
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 710,
          "y": -30
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: ff0935b7-054b-4729-82a3-5588d553d9d0
    type: condition
    task:
      id: ff0935b7-054b-4729-82a3-5588d553d9d0
      version: -1
      name: Is there an MD5 to block?
      description: Checks if there is a value for the MD5 input field. This task does not verify that the value is actually an MD5 hash, just that the value for the MD5 field exists.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "6"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: inputs.MD5
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": -200
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: 2c14bf01-7fd9-45f8-8554-86d0c1332d81
    type: title
    task:
      id: 2c14bf01-7fd9-45f8-8554-86d0c1332d81
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 310
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
system: true
view: |-
  {
    "linkLabelsPosition": {
      "6_9_#default#": 0.19,
      "8_9_#default#": 0.16
    },
    "paper": {
      "dimensions": {
        "height": 715,
        "width": 850,
        "x": 450,
        "y": -340
      }
    }
  }
inputs:
- key: MD5
  value:
    complex:
      root: File
      accessor: MD5
  required: false
  description: The MD5 hash of the file you want to block.
  playbookInputQuery:
- key: Text
  value:
    simple: Blocked by XSOAR
  required: false
  description: Text description of block list.
  playbookInputQuery:
outputs:
- contextPath: CbResponse.BlockedHashes.LastBlock.Time
  description: Last block time
- contextPath: CbResponse.BlockedHashes.LastBlock.Hostname
  description: Last block hostname
- contextPath: CbResponse.BlockedHashes.LastBlock.CbSensorID
  description: Last block sensor ID
tests:
- No tests (auto formatted)