Containment Plan - Block Indicators

## Containment Plan - Block Indicators This playbook is a sub-playbook within the containment plan playbook. ### Indicator Blocking The playbook block indicators by two methods: 1. It adds the malicious hashes into the XSIAM hash block list 2. It utilizes the sub-playbook "Block Indicators - Generic v3"

Common Playbooks · 15 tasks · 10 inputs · 1 output

Details

ID	`Containment Plan - Block Indicators`
From Version	6.6.0
Tasks	15

README

Containment Plan - Block Indicators

This playbook is a sub-playbook within the containment plan playbook.

Indicator Blocking

The playbook block indicators by two methods:

It adds the malicious hashes into the XSIAM hash block list
It utilizes the sub-playbook “Block Indicators - Generic v3”

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

Block Indicators - Generic v3

Integrations

This playbook does not use any integrations.

Scripts

This playbook does not use any scripts.

Commands

setParentIncidentContext
core-blocklist-files

Playbook Inputs

Name	Description	Default Value	Required
BlockIndicators	Set to ‘True’ to block the indicators.	True	Optional
UserVerification	Possible values: True/False. Whether to provide user verification for blocking those IPs. False - No prompt will be displayed to the user. True - The server will ask the user for blocking verification and will display the blocking list.	False	Optional
AutoBlockIndicators	Possible values: True/False. Default: True. Should the given indicators be automatically blocked, or should the user be given the option to choose? If set to True - no prompt will appear, and all provided indicators will be blocked automatically. If set to False - the user will be prompted to select which indicators to block.	True	Optional
FileHash	The file hash to block.		Optional
IP	The IP indicators.		Optional
Domain	The domain indicators.		Optional
URL	The URL indicator.		Optional
Username	The username to disable.		Optional
FilePath	The path of the file to block.		Optional
AutoContainment	Whether to execute containment plan automatically.		Optional

Playbook Outputs

Path	Description	Type
Core.blocklist.added_hashes	The file Hash that was added to the blocklist.	unknown

Playbook Image

Containment Plan - Block Indicators

Inputs

BlockIndicators — Set to 'True' to block the indicators.
UserVerification — Possible values: True/False. Whether to provide user verification for blocking those IPs. False - No prompt will be displayed to the user. True - The server will ask the user for blocking verification and will display the blocking list.
AutoBlockIndicators — Possible values: True/False. Default: True. Should the given indicators be automatically blocked, or should the user be given the option to choose? If set to True - no prompt will appear, and all provided indicators will be blocked automatically. If set to False - the user will be prompted to select which indicators to block.
FileHash — The file hash to block.
IP — The IP indicators.
Domain — The domain indicators.
URL — The URL indicator.
Username — The username to disable.
FilePath — The path of the file to block.
AutoContainment — Whether to execute containment plan automatically.

Outputs

Core.blocklist.added_hashes — The file Hash that was added to the blocklist.

Commands used

core-blocklist-files setParentIncidentContext

Flowchart

Source

playbook-Containment_Plan_-_Block_Indicators.yml

Download History Raw

id: Containment Plan - Block Indicators
version: -1
name: Containment Plan - Block Indicators
description: |-
  ## Containment Plan - Block Indicators

  This playbook is a sub-playbook within the containment plan playbook.

  ### Indicator Blocking

  The playbook block indicators by two methods:

  1. It adds the malicious hashes into the XSIAM hash block list
  2. It utilizes the sub-playbook "Block Indicators - Generic v3"
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 0eab88db-3b97-46e9-8040-fc0e5ccdd72b
    type: start
    task:
      id: 0eab88db-3b97-46e9-8040-fc0e5ccdd72b
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "3"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 230,
          "y": -190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 42177fdd-e676-4494-8430-473b77c4d326
    type: regular
    task:
      id: 42177fdd-e676-4494-8430-473b77c4d326
      version: -1
      name: Add to XSIAM hash block list
      description: Block lists requested files which have not already been block listed or added to allow list.
      script: '|||core-blocklist-files'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "32"
    scriptarguments:
      comment:
        complex:
          root: alert
          accessor: alertname
      hash_list:
        complex:
          root: foundIncidents.CustomFields
          filters:
          - - operator: isNotEqualString
              left:
                value:
                  simple: foundIncidents.CustomFields.initiatorpath
                iscontext: true
              right:
                value:
                  simple: c:\windows\explorer.exe
              ignorecase: true
          accessor: initiatorsha256
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: inputs.FileHash
                iscontext: true
          - operator: uniq
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 470,
          "y": 590
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 6555f437-9362-4b64-8416-9a207801acc8
    type: title
    task:
      id: 6555f437-9362-4b64-8416-9a207801acc8
      version: -1
      name: Done - Block Indicators
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 690,
          "y": 1710
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: c769a542-379a-42a7-8cb0-325e6b48e2b4
    type: condition
    task:
      id: c769a542-379a-42a7-8cb0-325e6b48e2b4
      version: -1
      name: Should block indicators?
      description: Whether to block the indicators based on the input values.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "25"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.BlockIndicators
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 230,
          "y": -50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: 58da2cac-8a9e-4f4f-88de-623361cde61f
    type: regular
    task:
      id: 58da2cac-8a9e-4f4f-88de-623361cde61f
      version: -1
      name: Set Block list files to the Incident context
      description: commands.local.cmd.set.parent.incident.context
      script: Builtin|||setParentIncidentContext
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "28"
    scriptarguments:
      key:
        simple: BlockedFilesHash
      value:
        complex:
          root: Core.blocklist.added_hashes
          accessor: fileHash
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 470,
          "y": 990
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: 4fb0cfd4-2555-4d5b-844c-c83c447c4a99
    type: regular
    task:
      id: 4fb0cfd4-2555-4d5b-844c-c83c447c4a99
      version: -1
      name: Set Blocked Indicators to the Incident context
      description: commands.local.cmd.set.parent.incident.context
      script: Builtin|||setParentIncidentContext
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      key:
        simple: IndicatorsToBlock
      value:
        complex:
          root: IndicatorsToBlock
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 230,
          "y": 1530
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "24":
    id: "24"
    taskid: df934c6a-4169-41f4-8cbe-76de251da626
    type: condition
    task:
      id: df934c6a-4169-41f4-8cbe-76de251da626
      version: -1
      name: Is file hash exist?
      description: Checks whether the file hash exists.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "28"
      "yes":
      - "1"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: foundIncidents.CustomFields
                accessor: initiatorsha256
            iscontext: true
          right:
            value: {}
        - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.FileHash
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 470,
          "y": 390
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "25":
    id: "25"
    taskid: 56214186-2922-4165-820b-062ad475cf73
    type: condition
    task:
      id: 56214186-2922-4165-820b-062ad475cf73
      version: -1
      name: Should block indicators automatically?
      description: Whether to disable the account automatically based on the input values.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "26"
      "yes":
      - "24"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.AutoContainment
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 230,
          "y": 160
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "26":
    id: "26"
    taskid: 6401c6c9-8ff7-4f49-8676-fd99f48da60f
    type: condition
    task:
      id: 6401c6c9-8ff7-4f49-8676-fd99f48da60f
      version: -1
      name: Is file hash exist?
      description: Checks whether the file hash exists.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "28"
      "yes":
      - "27"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.FileHash
                transformers:
                - operator: uniq
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -10,
          "y": 390
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "27":
    id: "27"
    taskid: fca5352e-ba68-4776-8b35-903387490051
    type: regular
    task:
      id: fca5352e-ba68-4776-8b35-903387490051
      version: -1
      name: Add to XSIAM hash block list
      description: Block lists requested files which have not already been block listed or added to allow list.
      script: '|||core-blocklist-files'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "31"
    scriptarguments:
      comment:
        complex:
          root: alert
          accessor: alertname
      hash_list:
        complex:
          root: inputs.FileHash
          filters:
          - - operator: in
              left:
                value:
                  simple: inputs.FileHash
                iscontext: true
              right:
                value:
                  simple: inputs.FileHash
                iscontext: true
          - - operator: stringHasLength
              left:
                value:
                  simple: inputs.FileHash
                iscontext: true
              right:
                value:
                  simple: "64"
          transformers:
          - operator: uniq
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -10,
          "y": 590
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "28":
    id: "28"
    taskid: 5ba573bb-fbf4-4890-8e63-15376725d187
    type: playbook
    task:
      id: 5ba573bb-fbf4-4890-8e63-15376725d187
      version: -1
      name: Block Indicators - Generic v3
      description: |+
        This playbook blocks malicious indicators using all integrations that are enabled, using the following sub-playbooks:

        - Block URL - Generic v2
        - Block Account - Generic v2
        - Block IP - Generic v3
        - Block File - Generic v2
        - Block Email - Generic v2
        - Block Domain - Generic v2

      playbookName: Block Indicators - Generic v3
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "30"
    scriptarguments:
      AutoBlockIndicators:
        complex:
          root: inputs.AutoBlockIndicators
      AutoCommit:
        simple: "No"
      CustomBlockRule:
        simple: "True"
      CustomURLCategory:
        simple: Demisto Remediation - Malicious URLs
      DomainToBlock:
        complex:
          root: inputs.Domain
      EmailToBlock:
        complex:
          root: DBotScore
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: DBotScore.Type
                iscontext: true
              right:
                value:
                  simple: email
          - - operator: greaterThanOrEqual
              left:
                value:
                  simple: DBotScore.Score
                iscontext: true
              right:
                value:
                  simple: "3"
          accessor: Indicator
          transformers:
          - operator: uniq
      FilesToBlock:
        complex:
          root: DBotScore
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: DBotScore.Type
                iscontext: true
              right:
                value:
                  simple: file
          - - operator: greaterThanOrEqual
              left:
                value:
                  simple: DBotScore.Score
                iscontext: true
              right:
                value:
                  simple: "3"
          accessor: Indicator
          transformers:
          - operator: uniq
      IP:
        complex:
          root: inputs.IP
          transformers:
          - operator: uniq
      InputEnrichment:
        simple: "False"
      MD5:
        complex:
          root: inputs.FileHash
          filters:
          - - operator: stringHasLength
              left:
                value:
                  simple: inputs.FileHash
                iscontext: true
              right:
                value:
                  simple: "32"
          transformers:
          - operator: uniq
      RuleDirection:
        simple: outbound
      RuleName:
        simple: XSOAR - Block Indicators playbook - ${incident.id}
      SHA256:
        complex:
          root: inputs.FileHash
          filters:
          - - operator: stringHasLength
              left:
                value:
                  simple: inputs.FileHash
                iscontext: true
              right:
                value:
                  simple: "64"
          transformers:
          - operator: uniq
      URL:
        complex:
          root: inputs.URL
          transformers:
          - operator: uniq
      UserVerification:
        complex:
          root: inputs.UserVerification
      Username:
        complex:
          root: inputs.Username
          transformers:
          - operator: replace
            args:
              limit: {}
              replaceWith: {}
              toReplace:
                value:
                  simple: inputs.Username
                iscontext: true
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 230,
          "y": 1170
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "29":
    id: "29"
    taskid: cb04e962-15e3-4189-8fcc-73efa9cb71fb
    type: regular
    task:
      id: cb04e962-15e3-4189-8fcc-73efa9cb71fb
      version: -1
      name: Set Block list files to the Incident context
      description: commands.local.cmd.set.parent.incident.context
      script: Builtin|||setParentIncidentContext
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "28"
    scriptarguments:
      key:
        simple: BlockedFilesHash
      value:
        complex:
          root: Core.blocklist.added_hashes
          accessor: fileHash
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -10,
          "y": 990
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "30":
    id: "30"
    taskid: 0a63acdb-6497-4f96-8318-5231aefde427
    type: condition
    task:
      id: 0a63acdb-6497-4f96-8318-5231aefde427
      version: -1
      name: Are there any indicators that are blocked?
      description: Check if there are any indicators that are blocked.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "11"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: IndicatorsToBlock
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 230,
          "y": 1340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "31":
    id: "31"
    taskid: 5e12fc6b-2fa0-43d0-8a46-d2f213525a45
    type: condition
    task:
      id: 5e12fc6b-2fa0-43d0-8a46-d2f213525a45
      version: -1
      name: Is the file hash was added to the block list?
      description: Checks whether the file hash exists.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "28"
      "yes":
      - "29"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: Core.blocklist.added_hashes.fileHash
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -10,
          "y": 780
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "32":
    id: "32"
    taskid: 5df17f17-1825-4ac0-8edf-c0e89f437551
    type: condition
    task:
      id: 5df17f17-1825-4ac0-8edf-c0e89f437551
      version: -1
      name: Is the file hash was added to the block list?
      description: Checks whether the file hash exists.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "28"
      "yes":
      - "10"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: Core.blocklist.added_hashes.fileHash
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 470,
          "y": 780
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "24_1_yes": 0.44,
      "24_28_#default#": 0.24,
      "26_28_#default#": 0.29,
      "30_11_yes": 0.52,
      "30_2_#default#": 0.38,
      "31_29_yes": 0.51,
      "32_10_yes": 0.57,
      "3_25_yes": 0.43,
      "3_2_#default#": 0.12
    },
    "paper": {
      "dimensions": {
        "height": 1965,
        "width": 1080,
        "x": -10,
        "y": -190
      }
    }
  }
inputs:
- key: BlockIndicators
  value:
    simple: "True"
  required: false
  description: Set to 'True' to block the indicators.
  playbookInputQuery:
- key: UserVerification
  value:
    simple: "False"
  required: false
  description: "Possible values: True/False.\nWhether to provide user verification for blocking those IPs. \n\nFalse - No prompt will be displayed to the user.\nTrue - The server will ask the user for blocking verification and will display the blocking list."
  playbookInputQuery:
- key: AutoBlockIndicators
  value:
    simple: "True"
  required: false
  description: |-
    Possible values: True/False.  Default: True.
    Should the given indicators be automatically blocked, or should the user be given the option to choose?

    If set to True - no prompt will appear, and all provided indicators will be blocked automatically.
    If set to False - the user will be prompted to select which indicators to block.
  playbookInputQuery:
- key: FileHash
  value: {}
  required: false
  description: The file hash to block.
  playbookInputQuery:
- key: IP
  value: {}
  required: false
  description: The IP indicators.
  playbookInputQuery:
- key: Domain
  value: {}
  required: false
  description: The domain indicators.
  playbookInputQuery:
- key: URL
  value: {}
  required: false
  description: The URL indicator.
  playbookInputQuery:
- key: Username
  value: {}
  required: false
  description: The username to disable.
  playbookInputQuery:
- key: FilePath
  value: {}
  required: false
  description: The path of the file to block.
  playbookInputQuery:
- key: AutoContainment
  value: {}
  required: false
  description: Whether to execute containment plan automatically.
  playbookInputQuery:
outputs:
- contextPath: Core.blocklist.added_hashes
  description: The file Hash that was added to the blocklist.
tests:
- No tests (auto formatted)
fromversion: 6.6.0
marketplaces:
- marketplacev2
- platform
supportedModules:
- cloud_runtime_security
- xsiam
- edr