Block File - Cylance Protect v2

This playbook accepts a SHA256 hash and adds the hash to the Global Quarantine list using the Cylance Protect v2 integration.

Cylance Protect · 5 tasks · 2 inputs · 3 outputs

Details

ID	`Block File - Cylance Protect v2`
From Version	5.0.0
Tasks	5

README

This playbook accepts a SHA256 hash and adds the hash to the Global Quarantine list using the Cylance Protect v2 integration.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

Cylance_Protect_v2

Scripts

This playbook does not use any scripts.

Commands

cylance-protect-add-hash-to-list

Playbook Inputs

Name	Description	Default Value	Required
SHA256	The SHA256 hash of the file to block.	File.SHA256	Optional
ListType	The list type to which the threat belongs. Can be “GlobalQuarantine” or “GlobalSafe”.	GlobalQuarantine	Optional

Playbook Outputs

Path	Description	Type
CbResponse.BlockedHashes.LastBlock.Time	Last block time.	unknown
CbResponse.BlockedHashes.LastBlock.Hostname	Last block hostname.	unknown
CbResponse.BlockedHashes.LastBlock.CbSensorID	Last block sensor ID.	unknown

Playbook Image

Block File - Cylance Protect v2

Inputs

SHA256 — The SHA256 hash of the file to block.
ListType — The list type to which the threat belongs. Can be "GlobalQuarantine" or "GlobalSafe".

Outputs

CbResponse.BlockedHashes.LastBlock.Time — Last block time
CbResponse.BlockedHashes.LastBlock.Hostname — Last block hostname
CbResponse.BlockedHashes.LastBlock.CbSensorID — Last block sensor ID

Commands used

cylance-protect-add-hash-to-list

Flowchart

Source

playbook-Block_File_-_Cylance_Protect_v2.yml

Download History Raw

id: Block File - Cylance Protect v2
version: -1
contentitemexportablefields:
  contentitemfields: {}
name: Block File - Cylance Protect v2
description: This playbook accepts a SHA256 hash and adds the hash to the Global Quarantine
  list using the Cylance Protect v2 integration.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 5e4385e3-76c2-48e2-80a4-c3798cdae027
    type: start
    task:
      id: 5e4385e3-76c2-48e2-80a4-c3798cdae027
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "6"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "6":
    id: "6"
    taskid: df41aaaa-8055-4c59-8e9e-a167a7ef7819
    type: condition
    task:
      id: df41aaaa-8055-4c59-8e9e-a167a7ef7819
      version: -1
      name: Is Cylance Protect v2 enabled?
      description: Checks if Cylance Protect is enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "8"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Cylance Protect v2
                    ignorecase: true
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                    ignorecase: true
                accessor: brand
            iscontext: true
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 265,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "8":
    id: "8"
    taskid: 9b14005e-903d-4724-80ec-84e7c42a9e7b
    type: condition
    task:
      id: 9b14005e-903d-4724-80ec-84e7c42a9e7b
      version: -1
      name: Is there a SHA256 to block?
      description: Checks if there is a value for the SHA256 input field. This task
        does not verify that the value is actually a SHA256 hash, just that the value
        for the field exists.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "10"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.SHA256
            iscontext: true
    view: |-
      {
        "position": {
          "x": 510,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "9":
    id: "9"
    taskid: 2c14bf01-7fd9-45f8-8554-86d0c1332d81
    type: title
    task:
      id: 2c14bf01-7fd9-45f8-8554-86d0c1332d81
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 710
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "10":
    id: "10"
    taskid: 4c4a1221-1c33-4b3f-8ada-96df4d7069c0
    type: regular
    task:
      id: 4c4a1221-1c33-4b3f-8ada-96df4d7069c0
      version: -1
      name: Add hash to Global Quarantine list
      description: Adds a convicted threat for a particular tenant to either the Global
        Quarantine list or the Global Safe list.
      script: '|||cylance-protect-add-hash-to-list'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      listType:
        complex:
          root: inputs.ListType
      sha256:
        complex:
          root: inputs.SHA256
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 770,
          "y": 540
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
system: true
view: |-
  {
    "linkLabelsPosition": {
      "6_9_#default#": 0.64,
      "8_9_#default#": 0.32
    },
    "paper": {
      "dimensions": {
        "height": 725,
        "width": 885,
        "x": 265,
        "y": 50
      }
    }
  }
inputs:
- key: SHA256
  value:
    complex:
      root: File
      filters:
      - - operator: isExists
          left:
            value:
              simple: File.Malicious
            iscontext: true
      accessor: SHA256
      transformers:
      - operator: uniq
  required: false
  description: The SHA256 hash of the file to block.
  playbookInputQuery:
- key: ListType
  value:
    simple: GlobalQuarantine
  required: false
  description: The list type to which the threat belongs. Can be "GlobalQuarantine" or "GlobalSafe".
  playbookInputQuery:
outputs:
- contextPath: CbResponse.BlockedHashes.LastBlock.Time
  description: Last block time
- contextPath: CbResponse.BlockedHashes.LastBlock.Hostname
  description: Last block hostname
- contextPath: CbResponse.BlockedHashes.LastBlock.CbSensorID
  description: Last block sensor ID
tests:
- No test
fromversion: 5.0.0