Containment Plan

This playbook handles the main containment actions available with Cortex XSIAM, including the following sub-playbooks: * Containment Plan - Isolate endpoint * Containment Plan - Disable account * Containment Plan - Quarantine file * Containment Plan - Block indicators * Containment Plan - Clear user session (currently, the playbook supports only Okta) Note: The playbook inputs enable manipulating the execution flow. Read the input descriptions for details.

Common Playbooks · 18 tasks · 17 inputs · 4 outputs

Details

ID	`Containment Plan`
From Version	6.6.0
Tasks	18

README

This playbook handles the main containment actions available with Cortex XSIAM, including the following sub-playbooks:

Containment Plan - Isolate endpoint
Containment Plan - Disable account
Containment Plan - Quarantine file
Containment Plan - Block indicators
Containment Plan - Clear user session (currently, the playbook supports only Okta)

Note: The playbook inputs enable manipulating the execution flow. Read the input descriptions for details.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

Containment Plan - Block Indicators
Containment Plan - Isolate Device
Containment Plan - Clear User Sessions
Containment Plan - Disable Account
Containment Plan - Quarantine File

Integrations

This playbook does not use any integrations.

Scripts

Commands

core-get-endpoints

Playbook Inputs

Name	Description	Default Value	Required
AutoContainment	Whether to execute containment plan (except isolation) automatically. The specific containment playbook inputs should also be set to ‘True’.	False	Optional
HostContainment	Whether to execute endpoint isolation.	True	Optional
UserContainment	Set to ‘True’ to disable the user account.	True	Optional
BlockIndicators	Set to ‘True’ to block the indicators.	True	Optional
FileContainment	Set to ‘True’ to quarantine the identified file.	True	Optional
ClearUserSessions	Set to ‘True’ to clear the user active Okta sessions.	True	Optional
EndpointID	The endpoint ID to run commands over.		Optional
Username	The username to disable.		Optional
FileHash	The file hash to block.		Optional
FilePath	The path of the file to block.		Optional
IP	The IP indicators.		Optional
Domain	The domain indicators.		Optional
URL	The URL indicator.		Optional
FileRemediation	Choose ‘Quarantine’ or ‘Delete’ to avoid file remediation conflicts. For example, choosing ‘Quarantine’ ignores the ‘Delete file’ task under the eradication playbook and will execute only file quarantine.	Quarantine	Optional
IAMUserDomain	The Okta IAM users domain. The domain will be appended to the username. e.g. username@IAMUserDomain.		Optional
UserVerification	Possible values: True/False. Whether to provide user verification for blocking those IPs and disabling the users. False - No prompt will be displayed to the user. True - The server will ask the user for blocking verification and will display the blocking list.	False	Optional
AutoBlockIndicators	Possible values: True/False. Default: True. Should the given indicators be automatically blocked, or should the user be given the option to choose? If set to True - no prompt will appear, and all provided indicators will be blocked automatically. If set to False - the user will be prompted to select which indicators to block.	True	Optional

Playbook Outputs

Path	Description	Type
Blocklist.Final	The blocked accounts.	unknown
QuarantinedFilesFromEndpoints	The quarantined files from endpoint.	unknown
Core.blocklist.added_hashes	The file Hash that was added to the blocklist.	unknown
Core.Isolation.endpoint_id	The isolated endpoint ID.	unknown

Playbook Image

Containment Plan

Inputs

AutoContainment — Whether to execute containment plan (except isolation) automatically. The specific containment playbook inputs should also be set to 'True'.
HostContainment — Whether to execute endpoint isolation.
UserContainment — Set to 'True' to disable the user account.
BlockIndicators — Set to 'True' to block the indicators.
FileContainment — Set to 'True' to quarantine the identified file.
ClearUserSessions — Set to 'True' to clear the user active Okta sessions.
EndpointID — The endpoint ID to run commands over.
Username — The username to disable.
FileHash — The file hash to block.
FilePath — The path of the file to block.
IP — The IP indicators.
Domain — The domain indicators.
URL — The URL indicator.
FileRemediation — Choose 'Quarantine' or 'Delete' to avoid file remediation conflicts. For example, choosing 'Quarantine' ignores the 'Delete file' task under the eradication playbook and will execute only file quarantine.
IAMUserDomain — The Okta IAM users domain. The domain will be appended to the username. e.g. username@IAMUserDomain.
UserVerification — Possible values: True/False. Whether to provide user verification for blocking those IPs and disabling the users. False - No prompt will be displayed to the user. True - The server will ask the user for blocking verification and will display the blocking list.
AutoBlockIndicators — Possible values: True/False. Default: True. Should the given indicators be automatically blocked, or should the user be given the option to choose? If set to True - no prompt will appear, and all provided indicators will be blocked automatically. If set to False - the user will be prompted to select which indicators to block.

Outputs

Blocklist.Final — The blocked accounts.
QuarantinedFilesFromEndpoints — The quarantined files from endpoint.
Core.blocklist.added_hashes — The file Hash that was added to the blocklist.
Core.Isolation.endpoint_id — The isolated endpoint ID.

Commands used

core-get-endpoints

Flowchart

Source

Download History Raw

id: Containment Plan - Block Indicators
version: -1
name: Containment Plan - Block Indicators
description: |-
  ## Containment Plan - Block Indicators

  This playbook is a sub-playbook within the containment plan playbook.

  ### Indicator Blocking

  The playbook block indicators by two methods:

  1. It adds the malicious hashes into the XSIAM hash block list
  2. It utilizes the sub-playbook "Block Indicators - Generic v3"
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 0eab88db-3b97-46e9-8040-fc0e5ccdd72b
    type: start
    task:
      id: 0eab88db-3b97-46e9-8040-fc0e5ccdd72b
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "3"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 230,
          "y": -190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 42177fdd-e676-4494-8430-473b77c4d326
    type: regular
    task:
      id: 42177fdd-e676-4494-8430-473b77c4d326
      version: -1
      name: Add to XSIAM hash block list
      description: Block lists requested files which have not already been block listed or added to allow list.
      script: '|||core-blocklist-files'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "32"
    scriptarguments:
      comment:
        complex:
          root: alert
          accessor: alertname
      hash_list:
        complex:
          root: foundIncidents.CustomFields
          filters:
          - - operator: isNotEqualString
              left:
                value:
                  simple: foundIncidents.CustomFields.initiatorpath
                iscontext: true
              right:
                value:
                  simple: c:\windows\explorer.exe
              ignorecase: true
          accessor: initiatorsha256
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: inputs.FileHash
                iscontext: true
          - operator: uniq
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 470,
          "y": 590
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 6555f437-9362-4b64-8416-9a207801acc8
    type: title
    task:
      id: 6555f437-9362-4b64-8416-9a207801acc8
      version: -1
      name: Done - Block Indicators
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 690,
          "y": 1710
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: c769a542-379a-42a7-8cb0-325e6b48e2b4
    type: condition
    task:
      id: c769a542-379a-42a7-8cb0-325e6b48e2b4
      version: -1
      name: Should block indicators?
      description: Whether to block the indicators based on the input values.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "25"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.BlockIndicators
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 230,
          "y": -50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: 58da2cac-8a9e-4f4f-88de-623361cde61f
    type: regular
    task:
      id: 58da2cac-8a9e-4f4f-88de-623361cde61f
      version: -1
      name: Set Block list files to the Incident context
      description: commands.local.cmd.set.parent.incident.context
      script: Builtin|||setParentIncidentContext
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "28"
    scriptarguments:
      key:
        simple: BlockedFilesHash
      value:
        complex:
          root: Core.blocklist.added_hashes
          accessor: fileHash
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 470,
          "y": 990
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: 4fb0cfd4-2555-4d5b-844c-c83c447c4a99
    type: regular
    task:
      id: 4fb0cfd4-2555-4d5b-844c-c83c447c4a99
      version: -1
      name: Set Blocked Indicators to the Incident context
      description: commands.local.cmd.set.parent.incident.context
      script: Builtin|||setParentIncidentContext
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      key:
        simple: IndicatorsToBlock
      value:
        complex:
          root: IndicatorsToBlock
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 230,
          "y": 1530
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "24":
    id: "24"
    taskid: df934c6a-4169-41f4-8cbe-76de251da626
    type: condition
    task:
      id: df934c6a-4169-41f4-8cbe-76de251da626
      version: -1
      name: Is file hash exist?
      description: Checks whether the file hash exists.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "28"
      "yes":
      - "1"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: foundIncidents.CustomFields
                accessor: initiatorsha256
            iscontext: true
          right:
            value: {}
        - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.FileHash
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 470,
          "y": 390
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "25":
    id: "25"
    taskid: 56214186-2922-4165-820b-062ad475cf73
    type: condition
    task:
      id: 56214186-2922-4165-820b-062ad475cf73
      version: -1
      name: Should block indicators automatically?
      description: Whether to disable the account automatically based on the input values.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "26"
      "yes":
      - "24"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.AutoContainment
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 230,
          "y": 160
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "26":
    id: "26"
    taskid: 6401c6c9-8ff7-4f49-8676-fd99f48da60f
    type: condition
    task:
      id: 6401c6c9-8ff7-4f49-8676-fd99f48da60f
      version: -1
      name: Is file hash exist?
      description: Checks whether the file hash exists.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "28"
      "yes":
      - "27"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.FileHash
                transformers:
                - operator: uniq
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -10,
          "y": 390
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "27":
    id: "27"
    taskid: fca5352e-ba68-4776-8b35-903387490051
    type: regular
    task:
      id: fca5352e-ba68-4776-8b35-903387490051
      version: -1
      name: Add to XSIAM hash block list
      description: Block lists requested files which have not already been block listed or added to allow list.
      script: '|||core-blocklist-files'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "31"
    scriptarguments:
      comment:
        complex:
          root: alert
          accessor: alertname
      hash_list:
        complex:
          root: inputs.FileHash
          filters:
          - - operator: in
              left:
                value:
                  simple: inputs.FileHash
                iscontext: true
              right:
                value:
                  simple: inputs.FileHash
                iscontext: true
          - - operator: stringHasLength
              left:
                value:
                  simple: inputs.FileHash
                iscontext: true
              right:
                value:
                  simple: "64"
          transformers:
          - operator: uniq
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -10,
          "y": 590
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "28":
    id: "28"
    taskid: 5ba573bb-fbf4-4890-8e63-15376725d187
    type: playbook
    task:
      id: 5ba573bb-fbf4-4890-8e63-15376725d187
      version: -1
      name: Block Indicators - Generic v3
      description: |+
        This playbook blocks malicious indicators using all integrations that are enabled, using the following sub-playbooks:

        - Block URL - Generic v2
        - Block Account - Generic v2
        - Block IP - Generic v3
        - Block File - Generic v2
        - Block Email - Generic v2
        - Block Domain - Generic v2

      playbookName: Block Indicators - Generic v3
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "30"
    scriptarguments:
      AutoBlockIndicators:
        complex:
          root: inputs.AutoBlockIndicators
      AutoCommit:
        simple: "No"
      CustomBlockRule:
        simple: "True"
      CustomURLCategory:
        simple: Demisto Remediation - Malicious URLs
      DomainToBlock:
        complex:
          root: inputs.Domain
      EmailToBlock:
        complex:
          root: DBotScore
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: DBotScore.Type
                iscontext: true
              right:
                value:
                  simple: email
          - - operator: greaterThanOrEqual
              left:
                value:
                  simple: DBotScore.Score
                iscontext: true
              right:
                value:
                  simple: "3"
          accessor: Indicator
          transformers:
          - operator: uniq
      FilesToBlock:
        complex:
          root: DBotScore
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: DBotScore.Type
                iscontext: true
              right:
                value:
                  simple: file
          - - operator: greaterThanOrEqual
              left:
                value:
                  simple: DBotScore.Score
                iscontext: true
              right:
                value:
                  simple: "3"
          accessor: Indicator
          transformers:
          - operator: uniq
      IP:
        complex:
          root: inputs.IP
          transformers:
          - operator: uniq
      InputEnrichment:
        simple: "False"
      MD5:
        complex:
          root: inputs.FileHash
          filters:
          - - operator: stringHasLength
              left:
                value:
                  simple: inputs.FileHash
                iscontext: true
              right:
                value:
                  simple: "32"
          transformers:
          - operator: uniq
      RuleDirection:
        simple: outbound
      RuleName:
        simple: XSOAR - Block Indicators playbook - ${incident.id}
      SHA256:
        complex:
          root: inputs.FileHash
          filters:
          - - operator: stringHasLength
              left:
                value:
                  simple: inputs.FileHash
                iscontext: true
              right:
                value:
                  simple: "64"
          transformers:
          - operator: uniq
      URL:
        complex:
          root: inputs.URL
          transformers:
          - operator: uniq
      UserVerification:
        complex:
          root: inputs.UserVerification
      Username:
        complex:
          root: inputs.Username
          transformers:
          - operator: replace
            args:
              limit: {}
              replaceWith: {}
              toReplace:
                value:
                  simple: inputs.Username
                iscontext: true
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 230,
          "y": 1170
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "29":
    id: "29"
    taskid: cb04e962-15e3-4189-8fcc-73efa9cb71fb
    type: regular
    task:
      id: cb04e962-15e3-4189-8fcc-73efa9cb71fb
      version: -1
      name: Set Block list files to the Incident context
      description: commands.local.cmd.set.parent.incident.context
      script: Builtin|||setParentIncidentContext
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "28"
    scriptarguments:
      key:
        simple: BlockedFilesHash
      value:
        complex:
          root: Core.blocklist.added_hashes
          accessor: fileHash
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -10,
          "y": 990
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "30":
    id: "30"
    taskid: 0a63acdb-6497-4f96-8318-5231aefde427
    type: condition
    task:
      id: 0a63acdb-6497-4f96-8318-5231aefde427
      version: -1
      name: Are there any indicators that are blocked?
      description: Check if there are any indicators that are blocked.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "11"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: IndicatorsToBlock
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 230,
          "y": 1340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "31":
    id: "31"
    taskid: 5e12fc6b-2fa0-43d0-8a46-d2f213525a45
    type: condition
    task:
      id: 5e12fc6b-2fa0-43d0-8a46-d2f213525a45
      version: -1
      name: Is the file hash was added to the block list?
      description: Checks whether the file hash exists.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "28"
      "yes":
      - "29"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: Core.blocklist.added_hashes.fileHash
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -10,
          "y": 780
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "32":
    id: "32"
    taskid: 5df17f17-1825-4ac0-8edf-c0e89f437551
    type: condition
    task:
      id: 5df17f17-1825-4ac0-8edf-c0e89f437551
      version: -1
      name: Is the file hash was added to the block list?
      description: Checks whether the file hash exists.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "28"
      "yes":
      - "10"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: Core.blocklist.added_hashes.fileHash
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 470,
          "y": 780
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "24_1_yes": 0.44,
      "24_28_#default#": 0.24,
      "26_28_#default#": 0.29,
      "30_11_yes": 0.52,
      "30_2_#default#": 0.38,
      "31_29_yes": 0.51,
      "32_10_yes": 0.57,
      "3_25_yes": 0.43,
      "3_2_#default#": 0.12
    },
    "paper": {
      "dimensions": {
        "height": 1965,
        "width": 1080,
        "x": -10,
        "y": -190
      }
    }
  }
inputs:
- key: BlockIndicators
  value:
    simple: "True"
  required: false
  description: Set to 'True' to block the indicators.
  playbookInputQuery:
- key: UserVerification
  value:
    simple: "False"
  required: false
  description: "Possible values: True/False.\nWhether to provide user verification for blocking those IPs. \n\nFalse - No prompt will be displayed to the user.\nTrue - The server will ask the user for blocking verification and will display the blocking list."
  playbookInputQuery:
- key: AutoBlockIndicators
  value:
    simple: "True"
  required: false
  description: |-
    Possible values: True/False.  Default: True.
    Should the given indicators be automatically blocked, or should the user be given the option to choose?

    If set to True - no prompt will appear, and all provided indicators will be blocked automatically.
    If set to False - the user will be prompted to select which indicators to block.
  playbookInputQuery:
- key: FileHash
  value: {}
  required: false
  description: The file hash to block.
  playbookInputQuery:
- key: IP
  value: {}
  required: false
  description: The IP indicators.
  playbookInputQuery:
- key: Domain
  value: {}
  required: false
  description: The domain indicators.
  playbookInputQuery:
- key: URL
  value: {}
  required: false
  description: The URL indicator.
  playbookInputQuery:
- key: Username
  value: {}
  required: false
  description: The username to disable.
  playbookInputQuery:
- key: FilePath
  value: {}
  required: false
  description: The path of the file to block.
  playbookInputQuery:
- key: AutoContainment
  value: {}
  required: false
  description: Whether to execute containment plan automatically.
  playbookInputQuery:
outputs:
- contextPath: Core.blocklist.added_hashes
  description: The file Hash that was added to the blocklist.
tests:
- No tests (auto formatted)
fromversion: 6.6.0
marketplaces:
- marketplacev2
- platform
supportedModules:
- cloud_runtime_security
- xsiam
- edr