Cortex XDR - Block File

Use this playbook to add files to Cortex XDR block list with a given file SHA256 playbook input.

Cortex XDR by Palo Alto Networks · 5 tasks · 1 input · 0 outputs

Details

ID	`Cortex XDR - Block File`
From Version	5.0.0
Tasks	5

README

Use this playbook to add files to Cortex XDR block list with a given file SHA256 playbook input.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

CortexXDRIR

Scripts

This playbook does not use any scripts.

Commands

xdr-blacklist-files

Playbook Inputs

Name	Description	Default Value	Required
HashList	List of hashed files you want to add to block list. Must be a valid SHA256 hash.		Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Cortex XDR - Block File

Inputs

HashList — List of hashed files you want to add to block list. Must be a valid SHA256 hash.

Commands used

xdr-blocklist-files

Flowchart

Source

playbook-Cortex_XDR_-_Block_File.yml

Download History Raw

id: Cortex XDR - Block File
version: -1
name: Cortex XDR - Block File
description: Use this playbook to add files to Cortex XDR block list with a given
  file SHA256 playbook input.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 3a09e0a4-a49a-40f4-82df-b9385f001af5
    type: start
    task:
      id: 3a09e0a4-a49a-40f4-82df-b9385f001af5
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "4"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 150,
          "y": -180
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "1":
    id: "1"
    taskid: 1aa731f4-ad09-4978-8271-2160c2ffde04
    type: regular
    task:
      id: 1aa731f4-ad09-4978-8271-2160c2ffde04
      version: -1
      name: Cortex XDR add a file SHA256 to block list
      description: Adds requested files to block list if they are not already on block list
        or allow list.
      script: '|||xdr-blocklist-files'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      comment: {}
      hash_list:
        complex:
          root: inputs.HashList
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 630,
          "y": 300
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  "2":
    id: "2"
    taskid: e318e098-905f-4d7a-8c8c-857c5cd58729
    type: condition
    task:
      id: e318e098-905f-4d7a-8c8c-857c5cd58729
      version: -1
      name: Is there a file to block?
      description: ''''''
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "1"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.HashList
            iscontext: true
    view: |-
      {
        "position": {
          "x": 390,
          "y": 130
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "3":
    id: "3"
    taskid: 080983ed-7a0c-4c19-8f9b-a81f6c1b682b
    type: title
    task:
      id: 080983ed-7a0c-4c19-8f9b-a81f6c1b682b
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 150,
          "y": 470
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "4":
    id: "4"
    taskid: 8191db29-4004-4baf-81dd-f81fa58040c1
    type: condition
    task:
      id: 8191db29-4004-4baf-81dd-f81fa58040c1
      version: -1
      name: Is Cortex XDR integration enabled?
      description: Returns 'yes' if Cortex XDR integration brand is available. Otherwise
        returns 'no'
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "2"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                    ignorecase: true
                accessor: brand
            iscontext: true
          right:
            value:
              simple: Cortex XDR - IR
    view: |-
      {
        "position": {
          "x": 150,
          "y": -40
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
system: true
view: |-
  {
    "linkLabelsPosition": {
      "2_1_yes": 0.64,
      "2_3_#default#": 0.26
    },
    "paper": {
      "dimensions": {
        "height": 715,
        "width": 860,
        "x": 150,
        "y": -180
      }
    }
  }
inputs:
- key: HashList
  value: {}
  required: false
  description: List of hashed files you want to add to block list. Must be a valid SHA256
    hash.
  playbookInputQuery:
outputs: []
tests:
- No tests (auto formatted)
fromversion: 5.0.0