Containment Plan - Quarantine File

## Containment Plan - Quarantine File This playbook is a sub-playbook within the containment plan playbook. The playbook quarantines files using core commands.

Common Playbooks · 16 tasks · 6 inputs · 1 output

Details

IDContainment Plan - Quarantine File
From Version6.6.0
Tasks16

README

Containment Plan - Quarantine File

This playbook is a sub-playbook within the containment plan playbook.
The playbook quarantines files using core commands.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

This playbook does not use any integrations.

Scripts

  • Set

Commands

  • core-get-quarantine-status
  • core-quarantine-files
  • setParentIncidentContext

Playbook Inputs

Name Description Default Value Required
FileContainment Set to ‘True’ to quarantine the identified file. True Optional
FileRemediation Choose ‘Quarantine’ or ‘Delete’ to avoid file remediation conflicts.
For example, choosing ‘Quarantine’ ignores the ‘Delete file’ task under the eradication playbook and will execute only file quarantine.		 Quarantine Optional
FilePath The path of the file to block.   Optional
FileHash The file hash to block.   Optional
EndpointID The endpoint ID to run commands over.   Optional
AutoContainment Whether to execute containment plan automatically.   Optional

Playbook Outputs

Path Description Type
QuarantinedFilesFromEndpoints The quarantined files from endpoint. unknown

Playbook Image

Containment Plan - Quarantine File

Inputs

  • FileContainment — Set to 'True' to quarantine the identified file.
  • FileRemediation — Choose 'Quarantine' or 'Delete' to avoid file remediation conflicts. For example, choosing 'Quarantine' ignores the 'Delete file' task under the eradication playbook and will execute only file quarantine.
  • FilePath — The path of the file to block.
  • FileHash — The file hash to block.
  • EndpointID — The endpoint ID to run commands over.
  • AutoContainment — Whether to execute containment plan automatically.

Outputs

  • QuarantinedFilesFromEndpoints — The quarantined files from endpoint.

Commands used

core-get-quarantine-status core-quarantine-files setParentIncidentContext

Flowchart

yes yes Auto Manual yes Start Start Done Done Get file quarantine status - core-get-quarantine-status Get file quarantine status core-get-quarantine-status File quarantine - core-quarantine-files File quarantine core-quarantine-files Set quarantine files per endpoints to the Incident context - setParentIncidentContext Set quarantine files per ... setParentIncidentContext Should quarantine file? Should quarantine file? Was the file quarantined? Was the file quarantined? Set quarantine files to the context - Set Set quarantine files to t... Set Should isolate automatically? Should isolate automatica... Get file quarantine status - core-get-quarantine-status Get file quarantine status core-get-quarantine-status Should quarantine file? Should quarantine file? File quarantine - core-quarantine-files File quarantine core-quarantine-files Set file path to quarantine - Set Set file path to quarantine Set Set file hash to quarantine - Set Set file hash to quarantine Set Manual action needed – file couldn't be quarantined Manual action needed – fi... Done Done

Source

playbook-Containment_Plan_-_Quarantine_File.yml
Download History Raw 
id: Containment Plan - Quarantine File
version: -1
name: Containment Plan - Quarantine File
description: |-
  ## Containment Plan - Quarantine File

  This playbook is a sub-playbook within the containment plan playbook.
  The playbook quarantines files using core commands.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 0c4f76b8-840e-49d6-83ea-28853fed1128
    type: start
    task:
      id: 0c4f76b8-840e-49d6-83ea-28853fed1128
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "17"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -40,
          "y": -369
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 397f4b57-3b4f-40ed-8871-59fb281d5a77
    type: title
    task:
      id: 397f4b57-3b4f-40ed-8871-59fb281d5a77
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -254,
          "y": 1026
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: a0ceb1ef-9c66-4295-8ab8-8ff9b8cbbf2f
    type: regular
    task:
      id: a0ceb1ef-9c66-4295-8ab8-8ff9b8cbbf2f
      version: -1
      name: Get file quarantine status
      description: Retrieves the quarantine status for a selected file.
      script: '|||core-get-quarantine-status'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "13"
    scriptarguments:
      endpoint_id:
        complex:
          root: inputs.EndpointID
      file_hash:
        complex:
          root: foundIncidents.CustomFields
          accessor: initiatorsha256
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: inputs.FileHash
                iscontext: true
      file_path:
        complex:
          root: foundIncidents.CustomFields
          accessor: initiatorpath
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: inputs.FilePath
                iscontext: true
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 453,
          "y": -83
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: 30398ddb-5182-4c19-84f2-6f06e62eabca
    type: regular
    task:
      id: 30398ddb-5182-4c19-84f2-6f06e62eabca
      version: -1
      name: File quarantine
      description: Quarantines a file on selected endpoints. You can select up to 1000 endpoints.
      script: '|||core-quarantine-files'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "15"
    scriptarguments:
      endpoint_id_list:
        complex:
          root: inputs.EndpointID
      file_hash:
        complex:
          root: foundIncidents.CustomFields
          filters:
          - - operator: isNotEqualString
              left:
                value:
                  simple: foundIncidents.CustomFields.initiatorpath
                iscontext: true
              right:
                value:
                  simple: c:\windows\explorer.exe
              ignorecase: true
          accessor: initiatorsha256
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: inputs.FileHash
                iscontext: true
      file_path:
        complex:
          root: foundIncidents.CustomFields.initiatorpath
          filters:
          - - operator: isNotEqualString
              left:
                value:
                  simple: foundIncidents.CustomFields.initiatorpath
                iscontext: true
              right:
                value:
                  simple: c:\windows\explorer.exe
              ignorecase: true
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: inputs.FilePath
                iscontext: true
      interval_in_seconds:
        simple: "20"
      timeout_in_seconds:
        simple: "120"
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 453,
          "y": 184
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: 2b43ad1d-1312-47cd-87af-a0e39b15ab76
    type: regular
    task:
      id: 2b43ad1d-1312-47cd-87af-a0e39b15ab76
      version: -1
      name: Set quarantine files per endpoints to the Incident context
      description: commands.local.cmd.set.parent.incident.context
      script: Builtin|||setParentIncidentContext
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      key:
        simple: QuarantinedFilesFromEndpoints
      value:
        complex:
          root: Core.quarantineFiles
          accessor: actionIds
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 453,
          "y": 887
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: 1208d3af-a6d7-4126-86f2-1c84f8659895
    type: condition
    task:
      id: 1208d3af-a6d7-4126-86f2-1c84f8659895
      version: -1
      name: Should quarantine file?
      description: Whether to quarantine the files based on the input values and the incident context.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "26"
      "yes":
      - "8"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.FileContainment
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.FileRemediation
            iscontext: true
          right:
            value:
              simple: Quarantine
          ignorecase: true
      - - operator: isEqualString
          left:
            value:
              complex:
                root: Core.quarantineFiles.status
                accessor: status
            iscontext: true
          right:
            value:
              simple: "False"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 453,
          "y": 42
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: 410c04ef-0afc-4578-8b1b-b1a3de96debf
    type: condition
    task:
      id: 410c04ef-0afc-4578-8b1b-b1a3de96debf
      version: -1
      name: Was the file quarantined?
      description: Checks if the quarantining of the file was successful.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "25"
      "yes":
      - "16"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEqualString
          left:
            value:
              complex:
                root: Core.GetActionStatus
                accessor: status
            iscontext: true
          right:
            value:
              simple: FAILED
          ignorecase: true
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: Core.GetActionStatus
                accessor: status
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 227,
          "y": 631
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "16":
    id: "16"
    taskid: 7e2c6273-86db-4fdd-8165-79a451736b14
    type: regular
    task:
      id: 7e2c6273-86db-4fdd-8165-79a451736b14
      version: -1
      name: Set quarantine files to the context
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: Builtin
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      key:
        simple: QuarantinedFilesFromEndpoints
      value:
        complex:
          root: Core.quarantineFiles
          accessor: actionIds
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 453,
          "y": 767
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "17":
    id: "17"
    taskid: fd83526a-3995-475b-8ea6-60233a3f1636
    type: condition
    task:
      id: fd83526a-3995-475b-8ea6-60233a3f1636
      version: -1
      name: Should isolate automatically?
      description: Whether to isolate the device automatically based on the input values.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      Auto:
      - "7"
      Manual:
      - "23"
    separatecontext: false
    conditions:
    - label: Auto
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.AutoContainment
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.EndpointID
            iscontext: true
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.FilePath
            iscontext: true
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.FileHash
            iscontext: true
    - label: Manual
      condition:
      - - operator: isNotEqualString
          left:
            value:
              complex:
                root: inputs.AutoContainment
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.EndpointID
            iscontext: true
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.FilePath
            iscontext: true
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.FileHash
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -40,
          "y": -251
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "18":
    id: "18"
    taskid: 8395bf84-b9be-42af-8c0b-cdf64c82b8fa
    type: regular
    task:
      id: 8395bf84-b9be-42af-8c0b-cdf64c82b8fa
      version: -1
      name: Get file quarantine status
      description: Retrieves the quarantine status for a selected file.
      script: '|||core-get-quarantine-status'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "19"
    scriptarguments:
      endpoint_id:
        complex:
          root: inputs.EndpointID
      file_hash:
        complex:
          root: FileHash
          filters:
          - - operator: stringHasLength
              left:
                value:
                  simple: FileHash
                iscontext: true
              right:
                value:
                  simple: "64"
      file_path:
        complex:
          root: FilePath
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -40,
          "y": 184
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "19":
    id: "19"
    taskid: a04c8ae8-b9a2-4a06-8d64-8463dd6582d9
    type: condition
    task:
      id: a04c8ae8-b9a2-4a06-8d64-8463dd6582d9
      version: -1
      name: Should quarantine file?
      description: Whether to quarantine the files based on the input values and the incident context.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "20"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.FileContainment
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.FileRemediation
            iscontext: true
          right:
            value:
              simple: Quarantine
          ignorecase: true
      - - operator: isEqualString
          left:
            value:
              complex:
                root: Core.quarantineFiles.status
                accessor: status
            iscontext: true
          right:
            value:
              simple: "False"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -40,
          "y": 329
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "20":
    id: "20"
    taskid: 48f240fd-334d-4f88-8e66-726f9971ba3c
    type: regular
    task:
      id: 48f240fd-334d-4f88-8e66-726f9971ba3c
      version: -1
      name: File quarantine
      description: Quarantines a file on selected endpoints. You can select up to 1000 endpoints.
      script: '|||core-quarantine-files'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "15"
    scriptarguments:
      endpoint_id_list:
        complex:
          root: inputs.EndpointID
      file_hash:
        complex:
          root: FileHash
          filters:
          - - operator: stringHasLength
              left:
                value:
                  simple: FileHash
                iscontext: true
              right:
                value:
                  simple: "64"
      file_path:
        complex:
          root: FilePath
      interval_in_seconds:
        simple: "20"
      timeout_in_seconds:
        simple: "120"
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -40,
          "y": 497
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "23":
    id: "23"
    taskid: c4b074c0-d8a1-4ef8-80a4-0b3ba35a3e76
    type: regular
    task:
      id: c4b074c0-d8a1-4ef8-80a4-0b3ba35a3e76
      version: -1
      name: Set file path to quarantine
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "24"
    scriptarguments:
      key:
        simple: FilePath
      value:
        complex:
          root: inputs.FilePath
          transformers:
          - operator: RegexExtractAll
            args:
              error_if_no_match: {}
              ignore_case: {}
              multi_line: {}
              period_matches_newline: {}
              regex:
                value:
                  simple: Path\":\"(.+?)\"
              unpack_matches: {}
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: No value
          - operator: replace
            args:
              limit: {}
              replaceWith:
                value:
                  simple: \
              toReplace:
                value:
                  simple: \\
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -40,
          "y": -85
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "24":
    id: "24"
    taskid: e0e42cd2-c5a4-4148-855a-3f99dc7a6c91
    type: regular
    task:
      id: e0e42cd2-c5a4-4148-855a-3f99dc7a6c91
      version: -1
      name: Set file hash to quarantine
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "18"
    scriptarguments:
      key:
        simple: FileHash
      value:
        complex:
          root: inputs.FileHash
          transformers:
          - operator: RegexExtractAll
            args:
              error_if_no_match: {}
              ignore_case: {}
              multi_line: {}
              period_matches_newline: {}
              regex:
                value:
                  simple: Hash\":\"(.+?)\"
              unpack_matches: {}
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: No value
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -40,
          "y": 40
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "25":
    id: "25"
    taskid: 942487c5-0c60-4be2-aa56-4c85d6718a0f
    type: regular
    task:
      id: 942487c5-0c60-4be2-aa56-4c85d6718a0f
      version: -1
      name: Manual action needed – file couldn't be quarantined
      description: |-
        Dear Analyst,

        The playbook was unable to quarantine the file due to the following possible reasons:

        - The file is not located on the local host.
        - The endpoint is currently disconnected.

        Please take manual action to quarantine the file.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -37,
          "y": 767
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "26":
    id: "26"
    taskid: 3480aab3-067b-4479-839e-72f46bc551b1
    type: title
    task:
      id: 3480aab3-067b-4479-839e-72f46bc551b1
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 901,
          "y": 189
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
system: true
view: |-
  {
    "linkLabelsPosition": {
      "13_26_#default#": 0.54,
      "13_8_yes": 0.41,
      "15_16_yes": 0.6,
      "17_23_Manual": 0.42,
      "17_2_#default#": 0.12,
      "19_20_yes": 0.44,
      "19_2_#default#": 0.15
    },
    "paper": {
      "dimensions": {
        "height": 1455,
        "width": 1536,
        "x": -254,
        "y": -369
      }
    }
  }
inputs:
- key: FileContainment
  value:
    simple: "True"
  required: false
  description: Set to 'True' to quarantine the identified file.
  playbookInputQuery:
- key: FileRemediation
  value:
    simple: Quarantine
  required: false
  description: "Choose 'Quarantine' or 'Delete'  to avoid file remediation conflicts. \nFor example, choosing 'Quarantine' ignores the 'Delete file' task under the eradication playbook and will execute only file quarantine."
  playbookInputQuery:
- key: FilePath
  value: {}
  required: false
  description: The path of the file to block.
  playbookInputQuery:
- key: FileHash
  value: {}
  required: false
  description: The file hash to block.
  playbookInputQuery:
- key: EndpointID
  value: {}
  required: false
  description: The endpoint ID to run commands over.
  playbookInputQuery:
- key: AutoContainment
  value: {}
  required: false
  description: Whether to execute containment plan automatically.
  playbookInputQuery:
outputs:
- contextPath: QuarantinedFilesFromEndpoints
  description: The quarantined files from endpoint.
  type: unknown
tests:
- No tests (auto formatted)
fromversion: 6.6.0
marketplaces:
- marketplacev2
- platform
supportedModules:
- cloud_runtime_security
- xsiam
- edr