Containment Plan - Quarantine File

## Containment Plan - Quarantine File This playbook is a sub-playbook within the containment plan playbook. The playbook quarantines files using core commands.

Common Playbooks · 16 tasks · 6 inputs · 1 output

Inputs

  • FileContainment — Set to 'True' to quarantine the identified file.
  • FileRemediation — Choose 'Quarantine' or 'Delete' to avoid file remediation conflicts. For example, choosing 'Quarantine' ignores the 'Delete file' task under the eradication playbook and will execute only file quarantine.
  • FilePath — The path of the file to block.
  • FileHash — The file hash to block.
  • EndpointID — The endpoint ID to run commands over.
  • AutoContainment — Whether to execute containment plan automatically.

Outputs

  • QuarantinedFilesFromEndpoints — The quarantined files from endpoint.

Commands used

core-get-quarantine-status core-quarantine-files setParentIncidentContext

Flowchart

yes yes Auto Manual yes Start Start Done Done Get file quarantine status - core-get-quarantine-status Get file quarantine status core-get-quarantine-status File quarantine - core-quarantine-files File quarantine core-quarantine-files Set quarantine files per endpoints to the Incident context - setParentIncidentContext Set quarantine files per ... setParentIncidentContext Should quarantine file? Should quarantine file? Was the file quarantined? Was the file quarantined? Set quarantine files to the context - Set Set quarantine files to t... Set Should isolate automatically? Should isolate automatica... Get file quarantine status - core-get-quarantine-status Get file quarantine status core-get-quarantine-status Should quarantine file? Should quarantine file? File quarantine - core-quarantine-files File quarantine core-quarantine-files Set file path to quarantine - Set Set file path to quarantine Set Set file hash to quarantine - Set Set file hash to quarantine Set Manual action needed – file couldn't be quarantined Manual action needed – fi... Done Done