Block File - Generic v2

This playbook is used to block files from running on endpoints. This playbook supports the following integrations: - Palo Alto Networks Traps - Palo Alto Networks Cortex XDR - Cybereason - Carbon Black Enterprise Response - Cylance Protect v2 - Crowdstrike Falcon - Microsoft Defender for Endpoint.

Common Playbooks · 14 tasks · 3 inputs · 3 outputs

Inputs

  • MD5 — The MD5 hash of the file you want to block.
  • SHA256 — The SHA256 hash of the file you want to block.
  • Hash — In this input you can insert either MD5 or SHA256 that you wish to block.

Outputs

  • CbResponse.BlockedHashes.LastBlock.Time — Last block time.
  • CbResponse.BlockedHashes.LastBlock.Hostname — Last block hostname.
  • CbResponse.BlockedHashes.LastBlock.CbSensorID — Last block sensor ID.

Flowchart

Start Start Block File - Carbon Black Response - Block File - Carbon Black Response Block File - Carbon Black... Block File - Carbon Black Res... Done Done Block File - Cybereason - Block File - Cybereason Block File - Cybereason Block File - Cybereason Block File - Cylance Protect v2 - Block File - Cylance Protect v2 Block File - Cylance Prot... Block File - Cylance Protect v2 Cybereason Cybereason Carbon Black Enterprise Response Carbon Black Enterprise R... Cylance Protect v2 Cylance Protect v2 Palo Alto Cortex XDR Palo Alto Cortex XDR Cortex XDR - Block File - Cortex XDR - Block File Cortex XDR - Block File Cortex XDR - Block File CrowdStrike Falcon CrowdStrike Falcon Microsoft Defender For Endpoint Microsoft Defender For En... CrowdStrike Falcon - Block File - CrowdStrike Falcon - Block File CrowdStrike Falcon - Bloc... CrowdStrike Falcon - Block File MDE - Block File - MDE - Block File MDE - Block File MDE - Block File