Containment Plan

This playbook handles the main containment actions available with Cortex XSIAM, including the following sub-playbooks: * Containment Plan - Isolate endpoint * Containment Plan - Disable account * Containment Plan - Quarantine file * Containment Plan - Block indicators * Containment Plan - Clear user session (currently, the playbook supports only Okta) Note: The playbook inputs enable manipulating the execution flow. Read the input descriptions for details.

Common Playbooks · 18 tasks · 17 inputs · 4 outputs

Details

ID	`Containment Plan`
From Version	6.6.0
Tasks	18

README

This playbook handles the main containment actions available with Cortex XSIAM, including the following sub-playbooks:

Containment Plan - Isolate endpoint
Containment Plan - Disable account
Containment Plan - Quarantine file
Containment Plan - Block indicators
Containment Plan - Clear user session (currently, the playbook supports only Okta)

Note: The playbook inputs enable manipulating the execution flow. Read the input descriptions for details.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

Containment Plan - Block Indicators
Containment Plan - Isolate Device
Containment Plan - Clear User Sessions
Containment Plan - Disable Account
Containment Plan - Quarantine File

Integrations

This playbook does not use any integrations.

Scripts

Commands

core-get-endpoints

Playbook Inputs

Name	Description	Default Value	Required
AutoContainment	Whether to execute containment plan (except isolation) automatically. The specific containment playbook inputs should also be set to ‘True’.	False	Optional
HostContainment	Whether to execute endpoint isolation.	True	Optional
UserContainment	Set to ‘True’ to disable the user account.	True	Optional
BlockIndicators	Set to ‘True’ to block the indicators.	True	Optional
FileContainment	Set to ‘True’ to quarantine the identified file.	True	Optional
ClearUserSessions	Set to ‘True’ to clear the user active Okta sessions.	True	Optional
EndpointID	The endpoint ID to run commands over.		Optional
Username	The username to disable.		Optional
FileHash	The file hash to block.		Optional
FilePath	The path of the file to block.		Optional
IP	The IP indicators.		Optional
Domain	The domain indicators.		Optional
URL	The URL indicator.		Optional
FileRemediation	Choose ‘Quarantine’ or ‘Delete’ to avoid file remediation conflicts. For example, choosing ‘Quarantine’ ignores the ‘Delete file’ task under the eradication playbook and will execute only file quarantine.	Quarantine	Optional
IAMUserDomain	The Okta IAM users domain. The domain will be appended to the username. e.g. username@IAMUserDomain.		Optional
UserVerification	Possible values: True/False. Whether to provide user verification for blocking those IPs and disabling the users. False - No prompt will be displayed to the user. True - The server will ask the user for blocking verification and will display the blocking list.	False	Optional
AutoBlockIndicators	Possible values: True/False. Default: True. Should the given indicators be automatically blocked, or should the user be given the option to choose? If set to True - no prompt will appear, and all provided indicators will be blocked automatically. If set to False - the user will be prompted to select which indicators to block.	True	Optional

Playbook Outputs

Path	Description	Type
Blocklist.Final	The blocked accounts.	unknown
QuarantinedFilesFromEndpoints	The quarantined files from endpoint.	unknown
Core.blocklist.added_hashes	The file Hash that was added to the blocklist.	unknown
Core.Isolation.endpoint_id	The isolated endpoint ID.	unknown

Playbook Image

Containment Plan

Inputs

AutoContainment — Whether to execute containment plan (except isolation) automatically. The specific containment playbook inputs should also be set to 'True'.
HostContainment — Whether to execute endpoint isolation.
UserContainment — Set to 'True' to disable the user account.
BlockIndicators — Set to 'True' to block the indicators.
FileContainment — Set to 'True' to quarantine the identified file.
ClearUserSessions — Set to 'True' to clear the user active Okta sessions.
EndpointID — The endpoint ID to run commands over.
Username — The username to disable.
FileHash — The file hash to block.
FilePath — The path of the file to block.
IP — The IP indicators.
Domain — The domain indicators.
URL — The URL indicator.
FileRemediation — Choose 'Quarantine' or 'Delete' to avoid file remediation conflicts. For example, choosing 'Quarantine' ignores the 'Delete file' task under the eradication playbook and will execute only file quarantine.
IAMUserDomain — The Okta IAM users domain. The domain will be appended to the username. e.g. username@IAMUserDomain.
UserVerification — Possible values: True/False. Whether to provide user verification for blocking those IPs and disabling the users. False - No prompt will be displayed to the user. True - The server will ask the user for blocking verification and will display the blocking list.
AutoBlockIndicators — Possible values: True/False. Default: True. Should the given indicators be automatically blocked, or should the user be given the option to choose? If set to True - no prompt will appear, and all provided indicators will be blocked automatically. If set to False - the user will be prompted to select which indicators to block.

Outputs

Blocklist.Final — The blocked accounts.
QuarantinedFilesFromEndpoints — The quarantined files from endpoint.
Core.blocklist.added_hashes — The file Hash that was added to the blocklist.
Core.Isolation.endpoint_id — The isolated endpoint ID.

Commands used

core-get-endpoints

Flowchart

Source

Download History Raw

id: Containment Plan - Quarantine File
version: -1
name: Containment Plan - Quarantine File
description: |-
  ## Containment Plan - Quarantine File

  This playbook is a sub-playbook within the containment plan playbook.
  The playbook quarantines files using core commands.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 0c4f76b8-840e-49d6-83ea-28853fed1128
    type: start
    task:
      id: 0c4f76b8-840e-49d6-83ea-28853fed1128
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "17"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -40,
          "y": -369
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 397f4b57-3b4f-40ed-8871-59fb281d5a77
    type: title
    task:
      id: 397f4b57-3b4f-40ed-8871-59fb281d5a77
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -254,
          "y": 1026
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: a0ceb1ef-9c66-4295-8ab8-8ff9b8cbbf2f
    type: regular
    task:
      id: a0ceb1ef-9c66-4295-8ab8-8ff9b8cbbf2f
      version: -1
      name: Get file quarantine status
      description: Retrieves the quarantine status for a selected file.
      script: '|||core-get-quarantine-status'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "13"
    scriptarguments:
      endpoint_id:
        complex:
          root: inputs.EndpointID
      file_hash:
        complex:
          root: foundIncidents.CustomFields
          accessor: initiatorsha256
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: inputs.FileHash
                iscontext: true
      file_path:
        complex:
          root: foundIncidents.CustomFields
          accessor: initiatorpath
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: inputs.FilePath
                iscontext: true
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 453,
          "y": -83
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: 30398ddb-5182-4c19-84f2-6f06e62eabca
    type: regular
    task:
      id: 30398ddb-5182-4c19-84f2-6f06e62eabca
      version: -1
      name: File quarantine
      description: Quarantines a file on selected endpoints. You can select up to 1000 endpoints.
      script: '|||core-quarantine-files'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "15"
    scriptarguments:
      endpoint_id_list:
        complex:
          root: inputs.EndpointID
      file_hash:
        complex:
          root: foundIncidents.CustomFields
          filters:
          - - operator: isNotEqualString
              left:
                value:
                  simple: foundIncidents.CustomFields.initiatorpath
                iscontext: true
              right:
                value:
                  simple: c:\windows\explorer.exe
              ignorecase: true
          accessor: initiatorsha256
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: inputs.FileHash
                iscontext: true
      file_path:
        complex:
          root: foundIncidents.CustomFields.initiatorpath
          filters:
          - - operator: isNotEqualString
              left:
                value:
                  simple: foundIncidents.CustomFields.initiatorpath
                iscontext: true
              right:
                value:
                  simple: c:\windows\explorer.exe
              ignorecase: true
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: inputs.FilePath
                iscontext: true
      interval_in_seconds:
        simple: "20"
      timeout_in_seconds:
        simple: "120"
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 453,
          "y": 184
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: 2b43ad1d-1312-47cd-87af-a0e39b15ab76
    type: regular
    task:
      id: 2b43ad1d-1312-47cd-87af-a0e39b15ab76
      version: -1
      name: Set quarantine files per endpoints to the Incident context
      description: commands.local.cmd.set.parent.incident.context
      script: Builtin|||setParentIncidentContext
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      key:
        simple: QuarantinedFilesFromEndpoints
      value:
        complex:
          root: Core.quarantineFiles
          accessor: actionIds
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 453,
          "y": 887
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: 1208d3af-a6d7-4126-86f2-1c84f8659895
    type: condition
    task:
      id: 1208d3af-a6d7-4126-86f2-1c84f8659895
      version: -1
      name: Should quarantine file?
      description: Whether to quarantine the files based on the input values and the incident context.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "26"
      "yes":
      - "8"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.FileContainment
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.FileRemediation
            iscontext: true
          right:
            value:
              simple: Quarantine
          ignorecase: true
      - - operator: isEqualString
          left:
            value:
              complex:
                root: Core.quarantineFiles.status
                accessor: status
            iscontext: true
          right:
            value:
              simple: "False"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 453,
          "y": 42
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: 410c04ef-0afc-4578-8b1b-b1a3de96debf
    type: condition
    task:
      id: 410c04ef-0afc-4578-8b1b-b1a3de96debf
      version: -1
      name: Was the file quarantined?
      description: Checks if the quarantining of the file was successful.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "25"
      "yes":
      - "16"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEqualString
          left:
            value:
              complex:
                root: Core.GetActionStatus
                accessor: status
            iscontext: true
          right:
            value:
              simple: FAILED
          ignorecase: true
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: Core.GetActionStatus
                accessor: status
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 227,
          "y": 631
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "16":
    id: "16"
    taskid: 7e2c6273-86db-4fdd-8165-79a451736b14
    type: regular
    task:
      id: 7e2c6273-86db-4fdd-8165-79a451736b14
      version: -1
      name: Set quarantine files to the context
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: Builtin
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      key:
        simple: QuarantinedFilesFromEndpoints
      value:
        complex:
          root: Core.quarantineFiles
          accessor: actionIds
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 453,
          "y": 767
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "17":
    id: "17"
    taskid: fd83526a-3995-475b-8ea6-60233a3f1636
    type: condition
    task:
      id: fd83526a-3995-475b-8ea6-60233a3f1636
      version: -1
      name: Should isolate automatically?
      description: Whether to isolate the device automatically based on the input values.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      Auto:
      - "7"
      Manual:
      - "23"
    separatecontext: false
    conditions:
    - label: Auto
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.AutoContainment
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.EndpointID
            iscontext: true
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.FilePath
            iscontext: true
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.FileHash
            iscontext: true
    - label: Manual
      condition:
      - - operator: isNotEqualString
          left:
            value:
              complex:
                root: inputs.AutoContainment
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.EndpointID
            iscontext: true
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.FilePath
            iscontext: true
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.FileHash
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -40,
          "y": -251
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "18":
    id: "18"
    taskid: 8395bf84-b9be-42af-8c0b-cdf64c82b8fa
    type: regular
    task:
      id: 8395bf84-b9be-42af-8c0b-cdf64c82b8fa
      version: -1
      name: Get file quarantine status
      description: Retrieves the quarantine status for a selected file.
      script: '|||core-get-quarantine-status'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "19"
    scriptarguments:
      endpoint_id:
        complex:
          root: inputs.EndpointID
      file_hash:
        complex:
          root: FileHash
          filters:
          - - operator: stringHasLength
              left:
                value:
                  simple: FileHash
                iscontext: true
              right:
                value:
                  simple: "64"
      file_path:
        complex:
          root: FilePath
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -40,
          "y": 184
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "19":
    id: "19"
    taskid: a04c8ae8-b9a2-4a06-8d64-8463dd6582d9
    type: condition
    task:
      id: a04c8ae8-b9a2-4a06-8d64-8463dd6582d9
      version: -1
      name: Should quarantine file?
      description: Whether to quarantine the files based on the input values and the incident context.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "20"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.FileContainment
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.FileRemediation
            iscontext: true
          right:
            value:
              simple: Quarantine
          ignorecase: true
      - - operator: isEqualString
          left:
            value:
              complex:
                root: Core.quarantineFiles.status
                accessor: status
            iscontext: true
          right:
            value:
              simple: "False"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -40,
          "y": 329
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "20":
    id: "20"
    taskid: 48f240fd-334d-4f88-8e66-726f9971ba3c
    type: regular
    task:
      id: 48f240fd-334d-4f88-8e66-726f9971ba3c
      version: -1
      name: File quarantine
      description: Quarantines a file on selected endpoints. You can select up to 1000 endpoints.
      script: '|||core-quarantine-files'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "15"
    scriptarguments:
      endpoint_id_list:
        complex:
          root: inputs.EndpointID
      file_hash:
        complex:
          root: FileHash
          filters:
          - - operator: stringHasLength
              left:
                value:
                  simple: FileHash
                iscontext: true
              right:
                value:
                  simple: "64"
      file_path:
        complex:
          root: FilePath
      interval_in_seconds:
        simple: "20"
      timeout_in_seconds:
        simple: "120"
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -40,
          "y": 497
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "23":
    id: "23"
    taskid: c4b074c0-d8a1-4ef8-80a4-0b3ba35a3e76
    type: regular
    task:
      id: c4b074c0-d8a1-4ef8-80a4-0b3ba35a3e76
      version: -1
      name: Set file path to quarantine
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "24"
    scriptarguments:
      key:
        simple: FilePath
      value:
        complex:
          root: inputs.FilePath
          transformers:
          - operator: RegexExtractAll
            args:
              error_if_no_match: {}
              ignore_case: {}
              multi_line: {}
              period_matches_newline: {}
              regex:
                value:
                  simple: Path\":\"(.+?)\"
              unpack_matches: {}
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: No value
          - operator: replace
            args:
              limit: {}
              replaceWith:
                value:
                  simple: \
              toReplace:
                value:
                  simple: \\
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -40,
          "y": -85
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "24":
    id: "24"
    taskid: e0e42cd2-c5a4-4148-855a-3f99dc7a6c91
    type: regular
    task:
      id: e0e42cd2-c5a4-4148-855a-3f99dc7a6c91
      version: -1
      name: Set file hash to quarantine
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "18"
    scriptarguments:
      key:
        simple: FileHash
      value:
        complex:
          root: inputs.FileHash
          transformers:
          - operator: RegexExtractAll
            args:
              error_if_no_match: {}
              ignore_case: {}
              multi_line: {}
              period_matches_newline: {}
              regex:
                value:
                  simple: Hash\":\"(.+?)\"
              unpack_matches: {}
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: No value
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -40,
          "y": 40
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "25":
    id: "25"
    taskid: 942487c5-0c60-4be2-aa56-4c85d6718a0f
    type: regular
    task:
      id: 942487c5-0c60-4be2-aa56-4c85d6718a0f
      version: -1
      name: Manual action needed – file couldn't be quarantined
      description: |-
        Dear Analyst,

        The playbook was unable to quarantine the file due to the following possible reasons:

        - The file is not located on the local host.
        - The endpoint is currently disconnected.

        Please take manual action to quarantine the file.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -37,
          "y": 767
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "26":
    id: "26"
    taskid: 3480aab3-067b-4479-839e-72f46bc551b1
    type: title
    task:
      id: 3480aab3-067b-4479-839e-72f46bc551b1
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 901,
          "y": 189
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
system: true
view: |-
  {
    "linkLabelsPosition": {
      "13_26_#default#": 0.54,
      "13_8_yes": 0.41,
      "15_16_yes": 0.6,
      "17_23_Manual": 0.42,
      "17_2_#default#": 0.12,
      "19_20_yes": 0.44,
      "19_2_#default#": 0.15
    },
    "paper": {
      "dimensions": {
        "height": 1455,
        "width": 1536,
        "x": -254,
        "y": -369
      }
    }
  }
inputs:
- key: FileContainment
  value:
    simple: "True"
  required: false
  description: Set to 'True' to quarantine the identified file.
  playbookInputQuery:
- key: FileRemediation
  value:
    simple: Quarantine
  required: false
  description: "Choose 'Quarantine' or 'Delete'  to avoid file remediation conflicts. \nFor example, choosing 'Quarantine' ignores the 'Delete file' task under the eradication playbook and will execute only file quarantine."
  playbookInputQuery:
- key: FilePath
  value: {}
  required: false
  description: The path of the file to block.
  playbookInputQuery:
- key: FileHash
  value: {}
  required: false
  description: The file hash to block.
  playbookInputQuery:
- key: EndpointID
  value: {}
  required: false
  description: The endpoint ID to run commands over.
  playbookInputQuery:
- key: AutoContainment
  value: {}
  required: false
  description: Whether to execute containment plan automatically.
  playbookInputQuery:
outputs:
- contextPath: QuarantinedFilesFromEndpoints
  description: The quarantined files from endpoint.
  type: unknown
tests:
- No tests (auto formatted)
fromversion: 6.6.0
marketplaces:
- marketplacev2
- platform
supportedModules:
- cloud_runtime_security
- xsiam
- edr