Containment Plan

id: Containment Plan
version: -1
contentitemexportablefields:
  contentitemfields: {}
name: Containment Plan
description: "This playbook handles the main containment actions available with Cortex XSIAM, including the following sub-playbooks:  \n* Containment Plan - Isolate endpoint\n* Containment Plan - Disable account\n* Containment Plan - Quarantine file\n* Containment Plan - Block indicators\n* Containment Plan - Clear user session (currently, the playbook supports only Okta)\n\nNote: The playbook inputs enable manipulating the execution flow. Read the input descriptions for details."
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 8aa2ff75-9b37-45eb-8c00-1233cf5410ac
    type: start
    task:
      id: 8aa2ff75-9b37-45eb-8c00-1233cf5410ac
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "150"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 60,
          "y": -1210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "48":
    id: "48"
    taskid: 585cb24c-cfe1-45cd-8c5d-370621442364
    type: title
    task:
      id: 585cb24c-cfe1-45cd-8c5d-370621442364
      version: -1
      name: Isolate Device
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "145"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -780,
          "y": 35
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "49":
    id: "49"
    taskid: abb87f28-a965-4d8d-8069-eb635815bb13
    type: title
    task:
      id: abb87f28-a965-4d8d-8069-eb635815bb13
      version: -1
      name: Disable Account
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "141"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -360,
          "y": 35
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "50":
    id: "50"
    taskid: ed18bff1-e327-4889-85e8-65d66ff9ef5a
    type: title
    task:
      id: ed18bff1-e327-4889-85e8-65d66ff9ef5a
      version: -1
      name: Quarantine File
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "142"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 60,
          "y": 35
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "51":
    id: "51"
    taskid: 1784b84c-0c06-44ae-8230-83edc6deccba
    type: title
    task:
      id: 1784b84c-0c06-44ae-8230-83edc6deccba
      version: -1
      name: Block Indicators
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "143"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 480,
          "y": 35
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "58":
    id: "58"
    taskid: f495b99b-b851-438c-8fc8-0db9145c81a2
    type: title
    task:
      id: f495b99b-b851-438c-8fc8-0db9145c81a2
      version: -1
      name: Clear User Sessions
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "144"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 900,
          "y": 35
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "138":
    id: "138"
    taskid: c69a7bbb-62d0-447a-8184-87aea4d7c440
    type: condition
    task:
      id: c69a7bbb-62d0-447a-8184-87aea4d7c440
      version: -1
      name: Should containment automatically?
      description: |+
        Whether to perform containment actions automatically or manually.

      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "139"
      "yes":
      - "147"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.AutoContainment
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 60,
          "y": -490
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "139":
    id: "139"
    taskid: 6b328ab7-5553-4c6b-86d3-ca365bf5766d
    type: collection
    task:
      id: 6b328ab7-5553-4c6b-86d3-ca365bf5766d
      version: -1
      name: Which containment actions would you like to perform?
      description: Select which indicators to block.
      type: collection
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "147"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -190,
          "y": -300
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
      subject:
      body:
      methods: []
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: true
        completeaftersla: false
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          simple: Select the Endpoint to isolate by Endpoint name
        required: false
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: Core.Endpoint
            accessor: endpoint_name
            transformers:
            - operator: uniq
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      - id: "1"
        label: ""
        labelarg:
          simple: Select Endpoint to isolate by Endpoint ID
        required: false
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: inputs.EndpointID
            transformers:
            - operator: uniq
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      - id: "2"
        label: ""
        labelarg:
          simple: Select Users to disable
        required: false
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: inputs.Username
            transformers:
            - operator: uniq
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      - id: "3"
        label: ""
        labelarg:
          simple: Select Files to quarantine
        required: false
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: FilesList
            transformers:
            - operator: uniq
            - operator: SetIfEmpty
              args:
                applyIfEmpty: {}
                defaultValue:
                  value:
                    simple: inputs.FilePath
                  iscontext: true
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      - id: "4"
        label: ""
        labelarg:
          simple: Select IPs to block
        required: false
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: inputs.IP
            transformers:
            - operator: uniq
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      - id: "5"
        label: ""
        labelarg:
          simple: Select URLs to block
        required: false
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: inputs.URL
            transformers:
            - operator: uniq
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      - id: "6"
        label: ""
        labelarg:
          simple: 'Select Files Hash to block '
        required: false
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: inputs.FileHash
            transformers:
            - operator: uniq
        - {}
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      - id: "7"
        label: ""
        labelarg:
          simple: 'Select Domains to block '
        required: false
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: inputs.Domain
            transformers:
            - operator: uniq
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      - id: "8"
        label: ""
        labelarg:
          simple: Select Users to clear their sessions
        required: false
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: inputs.Username
            transformers:
            - operator: uniq
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      title: Which containment actions would you like to perform?
      description: Select which containment actions to perform
      sender: ""
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "141":
    id: "141"
    taskid: b14b5f26-d428-4b62-8ba3-2c1253e171fc
    type: playbook
    task:
      id: b14b5f26-d428-4b62-8ba3-2c1253e171fc
      version: -1
      name: Containment Plan - Disable Account
      playbookName: Containment Plan - Disable Account
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "148"
    scriptarguments:
      UserContainment:
        complex:
          root: inputs.UserContainment
      UserVerification:
        complex:
          root: inputs.UserVerification
      Username:
        complex:
          root: inputs.AutoContainment
          transformers:
          - operator: If-Then-Else
            args:
              condition:
                value:
                  simple: lhs==rhs
              conditionB: {}
              conditionInBetween: {}
              else:
                value:
                  simple: Which containment actions would you like to perform?.Answers.2
                iscontext: true
              equals: {}
              lhs:
                value:
                  simple: inputs.AutoContainment
                iscontext: true
              lhsB: {}
              options:
                value:
                  simple: case_insensitive
              optionsB: {}
              rhs:
                value:
                  simple: "True"
              rhsB: {}
              then:
                value:
                  simple: inputs.Username
                iscontext: true
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": -360,
          "y": 170
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "142":
    id: "142"
    taskid: e302b10a-140c-4997-8584-b2dc75debb4a
    type: playbook
    task:
      id: e302b10a-140c-4997-8584-b2dc75debb4a
      version: -1
      name: Containment Plan - Quarantine File
      playbookName: Containment Plan - Quarantine File
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "148"
    scriptarguments:
      AutoContainment:
        complex:
          root: inputs.AutoContainment
      EndpointID:
        complex:
          root: inputs.EndpointID
      FileContainment:
        complex:
          root: inputs.FileContainment
      FileHash:
        complex:
          root: inputs.AutoContainment
          transformers:
          - operator: If-Then-Else
            args:
              condition:
                value:
                  simple: lhs==rhs
              conditionB: {}
              conditionInBetween: {}
              else:
                value:
                  simple: Which containment actions would you like to perform?.Answers.3
                iscontext: true
              equals: {}
              lhs:
                value:
                  simple: inputs.AutoContainment
                iscontext: true
              lhsB: {}
              options:
                value:
                  simple: case_insensitive
              optionsB: {}
              rhs:
                value:
                  simple: "True"
              rhsB: {}
              then:
                value:
                  simple: inputs.FileHash
                iscontext: true
      FilePath:
        complex:
          root: inputs.AutoContainment
          transformers:
          - operator: If-Then-Else
            args:
              condition:
                value:
                  simple: lhs==rhs
              conditionB: {}
              conditionInBetween: {}
              else:
                value:
                  simple: Which containment actions would you like to perform?.Answers.3
                iscontext: true
              equals: {}
              lhs:
                value:
                  simple: inputs.AutoContainment
                iscontext: true
              lhsB: {}
              options:
                value:
                  simple: case_insensitive
              optionsB: {}
              rhs:
                value:
                  simple: "True"
              rhsB: {}
              then:
                value:
                  simple: inputs.FilePath
                iscontext: true
      FileRemediation:
        complex:
          root: inputs.FileRemediation
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 60,
          "y": 170
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "143":
    id: "143"
    taskid: 07e811df-f4de-42bb-8910-13684b6086f1
    type: playbook
    task:
      id: 07e811df-f4de-42bb-8910-13684b6086f1
      version: -1
      name: Containment Plan - Block Indicators
      playbookName: Containment Plan - Block Indicators
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "148"
    scriptarguments:
      AutoBlockIndicators:
        complex:
          root: inputs.AutoBlockIndicators
      AutoContainment:
        complex:
          root: inputs.AutoContainment
      BlockIndicators:
        complex:
          root: inputs.BlockIndicators
      Domain:
        complex:
          root: inputs.AutoContainment
          transformers:
          - operator: If-Then-Else
            args:
              condition:
                value:
                  simple: lhs==rhs
              conditionB: {}
              conditionInBetween: {}
              else:
                value:
                  simple: Which containment actions would you like to perform?.Answers.7
                iscontext: true
              equals: {}
              lhs:
                value:
                  simple: inputs.AutoContainment
                iscontext: true
              lhsB: {}
              options: {}
              optionsB: {}
              rhs:
                value:
                  simple: "True"
              rhsB: {}
              then:
                value:
                  simple: inputs.Domain
                iscontext: true
      FileHash:
        complex:
          root: inputs.AutoContainment
          transformers:
          - operator: If-Then-Else
            args:
              condition:
                value:
                  simple: lhs==rhs
              conditionB: {}
              conditionInBetween: {}
              else:
                value:
                  simple: Which containment actions would you like to perform?.Answers.6
                iscontext: true
              equals: {}
              lhs:
                value:
                  simple: inputs.AutoContainment
                iscontext: true
              lhsB: {}
              options:
                value:
                  simple: case_insensitive
              optionsB: {}
              rhs:
                value:
                  simple: "True"
              rhsB: {}
              then:
                value:
                  simple: inputs.FileHash
                iscontext: true
      FilePath:
        complex:
          root: inputs.FilePath
      IP:
        complex:
          root: inputs.AutoContainment
          transformers:
          - operator: If-Then-Else
            args:
              condition:
                value:
                  simple: lhs==rhs
              conditionB: {}
              conditionInBetween: {}
              else:
                value:
                  simple: Which containment actions would you like to perform?.Answers.4
                iscontext: true
              equals: {}
              lhs:
                value:
                  simple: inputs.AutoContainment
                iscontext: true
              lhsB: {}
              options:
                value:
                  simple: case_insensitive
              optionsB: {}
              rhs:
                value:
                  simple: "True"
              rhsB: {}
              then:
                value:
                  simple: inputs.IP
                iscontext: true
      URL:
        complex:
          root: inputs.AutoContainment
          transformers:
          - operator: If-Then-Else
            args:
              condition:
                value:
                  simple: lhs==rhs
              conditionB: {}
              conditionInBetween: {}
              else:
                value:
                  simple: Which containment actions would you like to perform?.Answers.5
                iscontext: true
              equals: {}
              lhs:
                value:
                  simple: inputs.AutoContainment
                iscontext: true
              lhsB: {}
              options: {}
              optionsB: {}
              rhs:
                value:
                  simple: "True"
              rhsB: {}
              then:
                value:
                  simple: inputs.URL
                iscontext: true
      UserVerification:
        complex:
          root: inputs.UserVerification
      Username:
        complex:
          root: inputs.Username
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 480,
          "y": 170
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "144":
    id: "144"
    taskid: df1758c9-fbf9-4532-876f-b60ea180dcbc
    type: playbook
    task:
      id: df1758c9-fbf9-4532-876f-b60ea180dcbc
      version: -1
      name: Containment Plan - Clear User Sessions
      playbookName: Containment Plan - Clear User Sessions
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "148"
    scriptarguments:
      ClearUserSessions:
        complex:
          root: inputs.ClearUserSessions
      IAMUserDomain:
        complex:
          root: inputs.IAMUserDomain
      Username:
        complex:
          root: inputs.AutoContainment
          transformers:
          - operator: If-Then-Else
            args:
              condition:
                value:
                  simple: lhs==rhs
              conditionB: {}
              conditionInBetween: {}
              else:
                value:
                  simple: Which containment actions would you like to perform?.Answers.8
                iscontext: true
              equals: {}
              lhs:
                value:
                  simple: inputs.AutoContainment
                iscontext: true
              lhsB: {}
              options:
                value:
                  simple: case_insensitive
              optionsB: {}
              rhs:
                value:
                  simple: "True"
              rhsB: {}
              then:
                value:
                  simple: inputs.Username
                iscontext: true
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 900,
          "y": 170
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "145":
    id: "145"
    taskid: 8bd87a2a-710a-479b-8356-540bcdf010fd
    type: playbook
    task:
      id: 8bd87a2a-710a-479b-8356-540bcdf010fd
      version: -1
      name: Containment Plan - Isolate Device
      playbookName: Containment Plan - Isolate Device
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "148"
    scriptarguments:
      EndpointHostName:
        complex:
          root: inputs.AutoContainment
          transformers:
          - operator: If-Then-Else
            args:
              condition:
                value:
                  simple: lhs==rhs
              conditionB: {}
              conditionInBetween: {}
              else:
                value:
                  simple: Which containment actions would you like to perform?.Answers.0
                iscontext: true
              equals: {}
              lhs:
                value:
                  simple: inputs.AutoContainment
                iscontext: true
              lhsB: {}
              options:
                value:
                  simple: case_insensitive
              optionsB: {}
              rhs:
                value:
                  simple: "True"
              rhsB: {}
              then:
                value:
                  simple: Core.Endpoint.endpoint_name
                iscontext: true
      EndpointID:
        complex:
          root: inputs.AutoContainment
          transformers:
          - operator: If-Then-Else
            args:
              condition:
                value:
                  simple: lhs==rhs
              conditionB: {}
              conditionInBetween: {}
              else:
                value:
                  simple: Which containment actions would you like to perform?.Answers.1
                iscontext: true
              equals: {}
              lhs:
                value:
                  simple: inputs.AutoContainment
                iscontext: true
              lhsB: {}
              options:
                value:
                  simple: case_insensitive
              optionsB: {}
              rhs:
                value:
                  simple: "True"
              rhsB: {}
              then:
                value:
                  simple: inputs.EndpointID
                iscontext: true
      HostContainment:
        complex:
          root: inputs.HostContainment
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": -780,
          "y": 170
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "146":
    id: "146"
    taskid: 953056e0-a248-437e-8498-348287ca39bc
    type: regular
    task:
      id: 953056e0-a248-437e-8498-348287ca39bc
      version: -1
      name: Get endpoint info
      description: Gets a list of endpoints, according to the passed filters. If there are no filters, all endpoints are returned. Filtering by multiple fields is concatenated using the AND condition (OR is not supported). Maximum result set size is 100. Offset is the zero-based number of endpoints from the start of the result set (start by counting from 0).
      script: '|||core-get-endpoints'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "138"
    scriptarguments:
      endpoint_id_list:
        complex:
          root: inputs.EndpointID
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: No Value
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 60,
          "y": -670
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "147":
    id: "147"
    taskid: c468a69f-b7e5-4fdc-8ea5-c1b5d6710a2e
    type: title
    task:
      id: c468a69f-b7e5-4fdc-8ea5-c1b5d6710a2e
      version: -1
      name: Containment
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "50"
      - "49"
      - "48"
      - "51"
      - "58"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 60,
          "y": -120
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "148":
    id: "148"
    taskid: a8f6c601-67bc-4dfd-8c09-008797b89324
    type: title
    task:
      id: a8f6c601-67bc-4dfd-8c09-008797b89324
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 60,
          "y": 340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "149":
    id: "149"
    taskid: afefe6f1-1bc6-4c69-8fd4-7072d4fa9962
    type: regular
    task:
      id: afefe6f1-1bc6-4c69-8fd4-7072d4fa9962
      version: -1
      name: Set Process list
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "146"
    scriptarguments:
      key:
        simple: FilesList
      stringify:
        simple: "false"
      value:
        complex:
          root: inputs.FilePath
          transformers:
          - operator: MakePair
            args:
              array1_key:
                iscontext: true
              array2:
                value:
                  simple: inputs.FileHash
                iscontext: true
              array2_key: {}
              determine_output_length_by: {}
              merge_dict: {}
              output_name1:
                value:
                  simple: Path
              output_name2:
                value:
                  simple: Hash
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -190,
          "y": -870
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "150":
    id: "150"
    taskid: 4541881d-148b-4360-83d3-c66c78b3d624
    type: condition
    task:
      id: 4541881d-148b-4360-83d3-c66c78b3d624
      version: -1
      name: The file path and file hash defined?
      description: Check if the file path and file hash are defined.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "146"
      "yes":
      - "149"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.FilePath
            iscontext: true
          right:
            value: {}
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.FileHash
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 60,
          "y": -1060
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "138_139_#default#": 0.64,
      "150_146_#default#": 0.45
    },
    "paper": {
      "dimensions": {
        "height": 1615,
        "width": 2060,
        "x": -780,
        "y": -1210
      }
    }
  }
inputs:
- key: AutoContainment
  value:
    simple: "False"
  required: false
  description: |-
    Whether to execute containment plan (except isolation) automatically.
    The specific containment playbook inputs should also be set to 'True'.
  playbookInputQuery:
- key: HostContainment
  value:
    simple: "True"
  required: false
  description: Whether to execute endpoint isolation.
  playbookInputQuery:
- key: UserContainment
  value:
    simple: "True"
  required: false
  description: Set to 'True' to disable the user account.
  playbookInputQuery:
- key: BlockIndicators
  value:
    simple: "True"
  required: false
  description: Set to 'True' to block the indicators.
  playbookInputQuery:
- key: FileContainment
  value:
    simple: "True"
  required: false
  description: Set to 'True' to quarantine the identified file.
  playbookInputQuery:
- key: ClearUserSessions
  value:
    simple: "True"
  required: false
  description: Set to 'True' to clear the user active Okta sessions.
  playbookInputQuery:
- key: EndpointID
  value: {}
  required: false
  description: The endpoint ID to run commands over.
  playbookInputQuery:
- key: Username
  value: {}
  required: false
  description: The username to disable.
  playbookInputQuery:
- key: FileHash
  value: {}
  required: false
  description: The file hash to block.
  playbookInputQuery:
- key: FilePath
  value: {}
  required: false
  description: The path of the file to block.
  playbookInputQuery:
- key: IP
  value: {}
  required: false
  description: The IP indicators.
  playbookInputQuery:
- key: Domain
  value: {}
  required: false
  description: The domain indicators.
  playbookInputQuery:
- key: URL
  value: {}
  required: false
  description: The URL indicator.
  playbookInputQuery:
- key: FileRemediation
  value:
    simple: Quarantine
  required: false
  description: "Choose 'Quarantine' or 'Delete'  to avoid file remediation conflicts. \nFor example, choosing 'Quarantine' ignores the 'Delete file' task under the eradication playbook and will execute only file quarantine."
  playbookInputQuery:
- key: IAMUserDomain
  value: {}
  required: false
  description: The Okta IAM users domain. The domain will be appended to the username. e.g. username@IAMUserDomain.
  playbookInputQuery:
- key: UserVerification
  value:
    simple: "False"
  required: false
  description: "Possible values: True/False.\nWhether to provide user verification for blocking those IPs and disabling the users. \n\nFalse - No prompt will be displayed to the user.\nTrue - The server will ask the user for blocking verification and will display the blocking list."
  playbookInputQuery:
- key: AutoBlockIndicators
  value:
    simple: "True"
  required: false
  description: |-
    Possible values: True/False.  Default: True.
    Should the given indicators be automatically blocked, or should the user be given the option to choose?

    If set to True - no prompt will appear, and all provided indicators will be blocked automatically.
    If set to False - the user will be prompted to select which indicators to block.
  playbookInputQuery:
outputs:
- contextPath: Blocklist.Final
  description: The blocked accounts.
  type: unknown
- contextPath: QuarantinedFilesFromEndpoints
  description: The quarantined files from endpoint.
  type: unknown
- contextPath: Core.blocklist.added_hashes
  description: The file Hash that was added to the blocklist.
- contextPath: Core.Isolation.endpoint_id
  description: The isolated endpoint ID.
tests:
- Containment Plan - Test
- Containment_Plan_use_case_test
fromversion: 6.6.0
marketplaces:
- marketplacev2
- platform
supportedModules:
- cloud_runtime_security
- xsiam
- edr