Block File - Generic v2

This playbook is used to block files from running on endpoints. This playbook supports the following integrations: - Palo Alto Networks Traps - Palo Alto Networks Cortex XDR - Cybereason - Carbon Black Enterprise Response - Cylance Protect v2 - Crowdstrike Falcon - Microsoft Defender for Endpoint.

Common Playbooks · 14 tasks · 3 inputs · 3 outputs

Details

ID	`Block File - Generic v2`
From Version	5.0.0
Tasks	14

README

This playbook is used to block files from running on endpoints.
This playbook supports the following integrations:

Palo Alto Networks Traps
Palo Alto Networks Cortex XDR
Cybereason
Carbon Black Enterprise Response
Cylance Protect v2
Crowdstrike Falcon
Microsoft Defender for Endpoint.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

Cortex XDR - Block File
Block File - Carbon Black Response
MDE - Block File
Block File - Cylance Protect v2
Block File - Cybereason
CrowdStrike Falcon - Block File

Integrations

This playbook does not use any integrations.

Scripts

This playbook does not use any scripts.

Commands

This playbook does not use any commands.

Playbook Inputs

Name	Description	Default Value	Required
MD5	The MD5 hash of the file you want to block.	File.MD5	Optional
SHA256	The SHA256 hash of the file you want to block.	File.SHA256	Optional
Hash	In this input you can insert either MD5 or SHA256 that you wish to block.		Optional

Playbook Outputs

Path	Description	Type
CbResponse.BlockedHashes.LastBlock.Time	Last block time.	unknown
CbResponse.BlockedHashes.LastBlock.Hostname	Last block hostname.	unknown
CbResponse.BlockedHashes.LastBlock.CbSensorID	Last block sensor ID.	unknown

Playbook Image

Block File - Generic v2

Inputs

MD5 — The MD5 hash of the file you want to block.
SHA256 — The SHA256 hash of the file you want to block.
Hash — In this input you can insert either MD5 or SHA256 that you wish to block.

Outputs

CbResponse.BlockedHashes.LastBlock.Time — Last block time.
CbResponse.BlockedHashes.LastBlock.Hostname — Last block hostname.
CbResponse.BlockedHashes.LastBlock.CbSensorID — Last block sensor ID.

Flowchart

Source

playbook-Block_File_-_Generic_v2.yml

Download History Raw

id: Block File - Generic v2
version: -1
contentitemexportablefields:
  contentitemfields: {}
name: Block File - Generic v2
description: "This playbook is used to block files from running on endpoints. \nThis playbook supports the following integrations:\n- Palo Alto Networks Traps\n- Palo Alto Networks Cortex XDR\n- Cybereason\n- Carbon Black Enterprise Response\n- Cylance Protect v2\n- Crowdstrike Falcon\n- Microsoft Defender for Endpoint."
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 420a534c-a6e6-4cf5-8b86-ac7dd1a91441
    type: start
    task:
      id: 420a534c-a6e6-4cf5-8b86-ac7dd1a91441
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "9"
      - "10"
      - "11"
      - "12"
      - "17"
      - "18"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 695,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 5a2f437e-234a-43ef-858d-28d07fd1c7c2
    type: playbook
    task:
      id: 5a2f437e-234a-43ef-858d-28d07fd1c7c2
      version: -1
      name: Block File - Carbon Black Response
      description: |-
        This playbook receives an MD5 hash and adds it to the block list in Carbon Black Enterprise Response. Files with that MD5 hash are blocked from execution on the managed endpoints.

        If the integration is disabled at the time of running, or if the hash is already on the block list, no action is taken on the MD5.
      playbookName: Block File - Carbon Black Response
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      MD5:
        complex:
          root: inputs.Hash
          filters:
          - - operator: stringHasLength
              left:
                value:
                  simple: inputs.Hash
                iscontext: true
              right:
                value:
                  simple: "32"
          transformers:
          - operator: append
            args:
              item:
                value:
                  simple: inputs.MD5
                iscontext: true
          - operator: uniq
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 50,
          "y": 340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: c8476a84-8d87-4ff2-8d6c-1dd1cccc503a
    type: title
    task:
      id: c8476a84-8d87-4ff2-8d6c-1dd1cccc503a
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 695,
          "y": 515
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: 2efe2a1a-1d31-438c-828f-b6ae50f3899d
    type: playbook
    task:
      id: 2efe2a1a-1d31-438c-828f-b6ae50f3899d
      version: -1
      name: Block File - Cybereason
      description: This playbook accepts an MD5 hash and blocks the file using the Cybereason integration.
      playbookName: Block File - Cybereason
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      MD5:
        complex:
          root: inputs.Hash
          filters:
          - - operator: stringHasLength
              left:
                value:
                  simple: inputs.Hash
                iscontext: true
              right:
                value:
                  simple: "32"
          transformers:
          - operator: append
            args:
              item:
                value:
                  simple: inputs.MD5
                iscontext: true
          - operator: uniq
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 480,
          "y": 340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: a887370c-f94a-42f9-866f-2d80b7707f41
    type: playbook
    task:
      id: a887370c-f94a-42f9-866f-2d80b7707f41
      version: -1
      name: Block File - Cylance Protect v2
      description: This playbook accepts a SHA256 hash and adds the hash to the Global Quarantine list using the Cylance Protect v2 integration.
      playbookName: Block File - Cylance Protect v2
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      SHA256:
        complex:
          root: inputs.Hash
          filters:
          - - operator: stringHasLength
              left:
                value:
                  simple: inputs.Hash
                iscontext: true
              right:
                value:
                  simple: "64"
          transformers:
          - operator: append
            args:
              item:
                value:
                  simple: inputs.SHA256
                iscontext: true
          - operator: uniq
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 910,
          "y": 340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: 32d4b47a-e972-4e30-875b-b563130cc4ca
    type: title
    task:
      id: 32d4b47a-e972-4e30-875b-b563130cc4ca
      version: -1
      name: Cybereason
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "4"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: 0c07d0e1-59b1-436c-8e90-f2d0410df813
    type: title
    task:
      id: 0c07d0e1-59b1-436c-8e90-f2d0410df813
      version: -1
      name: Carbon Black Enterprise Response
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "2"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: dcc8e191-213c-4ffd-8bc7-a8e1bc8894d7
    type: title
    task:
      id: dcc8e191-213c-4ffd-8bc7-a8e1bc8894d7
      version: -1
      name: Cylance Protect v2
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "5"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 910,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: b42b03dd-99c1-4149-8c32-336d23b88cf0
    type: title
    task:
      id: b42b03dd-99c1-4149-8c32-336d23b88cf0
      version: -1
      name: Palo Alto Cortex XDR
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "16"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1340,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "16":
    id: "16"
    taskid: cfefcb2a-3dcf-44a5-8aed-ef231d7fe00b
    type: playbook
    task:
      id: cfefcb2a-3dcf-44a5-8aed-ef231d7fe00b
      version: -1
      name: Cortex XDR - Block File
      description: Use this playbook to add files to Cortex XDR block list with a given file SHA256 playbook input.
      playbookName: Cortex XDR - Block File
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      HashList:
        complex:
          root: inputs.Hash
          filters:
          - - operator: stringHasLength
              left:
                value:
                  simple: inputs.Hash
                iscontext: true
              right:
                value:
                  simple: "64"
          transformers:
          - operator: append
            args:
              item:
                value:
                  simple: inputs.SHA256
                iscontext: true
          - operator: uniq
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 1340,
          "y": 330
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "17":
    id: "17"
    taskid: b6a4a1eb-e837-400c-890a-aa72fdd866d2
    type: title
    task:
      id: b6a4a1eb-e837-400c-890a-aa72fdd866d2
      version: -1
      name: CrowdStrike Falcon
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "19"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1760,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "18":
    id: "18"
    taskid: c463f54e-7a18-4dba-804f-acf83e449259
    type: title
    task:
      id: c463f54e-7a18-4dba-804f-acf83e449259
      version: -1
      name: Microsoft Defender For Endpoint
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "20"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -380,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "19":
    id: "19"
    taskid: 07c049da-5bbf-4804-8b51-3b58463ce5be
    type: playbook
    task:
      id: 07c049da-5bbf-4804-8b51-3b58463ce5be
      version: -1
      name: CrowdStrike Falcon - Block File
      description: "This playbook receives an MD5 or a SHA256 hash and adds it to the block list in CrowdStrike Falcon. \nThe playbook uses the integration \"CrowdStrike Falcon\"."
      playbookName: CrowdStrike Falcon - Block File
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      Hash:
        complex:
          root: inputs.Hash
          transformers:
          - operator: append
            args:
              item:
                value:
                  simple: inputs.MD5
                iscontext: true
          - operator: append
            args:
              item:
                value:
                  simple: inputs.SHA256
                iscontext: true
          - operator: uniq
      'Severity ':
        simple: medium
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 1760,
          "y": 330
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "20":
    id: "20"
    taskid: 56668cf3-d5c5-424d-85ff-43b568a0d538
    type: playbook
    task:
      id: 56668cf3-d5c5-424d-85ff-43b568a0d538
      version: -1
      name: MDE - Block File
      description: "This playbook receives an MD5 or a SHA256 hash and adds it to the block list in Microsoft Defender for Endpoint. \nThe playbook uses the integration \"Microsoft Defender for Endpoint\"."
      playbookName: MDE - Block File
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      GenerateAlert:
        simple: "true"
      Hash:
        complex:
          root: inputs.Hash
          transformers:
          - operator: append
            args:
              item:
                value:
                  simple: inputs.MD5
                iscontext: true
          - operator: append
            args:
              item:
                value:
                  simple: inputs.SHA256
                iscontext: true
          - operator: uniq
      IndicatorDescription:
        simple: Added by Cortex XSOAR
      IndicatorTitle:
        simple: Added by Cortex XSOAR
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": -380,
          "y": 340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
system: true
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 530,
        "width": 2520,
        "x": -380,
        "y": 50
      }
    }
  }
inputs:
- key: MD5
  value:
    complex:
      root: File
      accessor: MD5
  required: false
  description: The MD5 hash of the file you want to block.
  playbookInputQuery:
- key: SHA256
  value:
    complex:
      root: File
      accessor: SHA256
  required: false
  description: The SHA256 hash of the file you want to block.
  playbookInputQuery:
- key: Hash
  value: {}
  required: false
  description: In this input you can insert either MD5 or SHA256 that you wish to block.
  playbookInputQuery:
outputs:
- contextPath: CbResponse.BlockedHashes.LastBlock.Time
  description: Last block time.
- contextPath: CbResponse.BlockedHashes.LastBlock.Hostname
  description: Last block hostname.
- contextPath: CbResponse.BlockedHashes.LastBlock.CbSensorID
  description: Last block sensor ID.
tests:
- No tests (auto formatted)
fromversion: 5.0.0