CrowdStrike Falcon Malware - Verify Containment Actions

This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. This playbook verifies and sets the policy actions applied by CrowdStrike Falcon.
CrowdStrike Falcon · 20 tasks · 1 input · 3 outputs
Details

ID	`CrowdStrike Falcon Malware - Verify Containment Actions`
From Version	6.5.0
Tasks	20
README

This playbook is part of the ‘Malware Investigation And Response’ pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response.
This playbook verifies and sets the policy actions applied by CrowdStrike Falcon.
Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.
Sub-playbooks

This playbook does not use any sub-playbooks.
Integrations

This playbook does not use any integrations.
Scripts

Commands

This playbook does not use any commands.
Playbook Inputs

Name	Description	Default Value	Required
PolicyBehaviourDetails	The path that contains the detection results.		Optional
Playbook Outputs

Path	Description	Type
Policy.State	Is the policy active?	string
Host.State	Is the host isolated?	string
Process.State	Was the process contained?	string
Playbook Image

CrowdStrike Falcon Malware - Verify Containment Actions
Inputs

PolicyBehaviourDetails — The path that contains the detection results.
Outputs

Policy.State — Is the policy active?
Host.State — Is the host isolated?
Process.State — Was the process contained?
Flowchart

Source

playbook-CrowdStrike_Falcon_Malware_-_Verify_Containment_Actions.yml
Download History Raw
id: CrowdStrike Falcon Malware - Verify Containment Actions
version: -1
name: CrowdStrike Falcon Malware - Verify Containment Actions
description: |-
  This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response.
  This playbook verifies and sets the policy actions applied by CrowdStrike Falcon.
starttaskid: '0'
tasks:
  '0':
    id: '0'
    taskid: e7c7d902-36bd-4b88-8ef6-c3e596be918a
    type: start
    task:
      id: e7c7d902-36bd-4b88-8ef6-c3e596be918a
      version: -1
      name: ''
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - "20"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 200,
          "y": -380
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '1':
    id: '1'
    taskid: 15d703b6-7cd5-4a4e-856d-11141cec0875
    type: condition
    task:
      id: 15d703b6-7cd5-4a4e-856d-11141cec0875
      version: -1
      name: Is policy enabled?
      type: condition
      iscommand: false
      brand: ''
      description: 'Is policy enabled?'
    nexttasks:
      '#default#':
      - '2'
      yes:
      - '3'
    separatecontext: false
    conditions:
    - label: yes
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: Detection.Behavior.policy_disabled
            iscontext: true
          right:
            value:
              simple: 'false'
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 450,
          "y": 200
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '2':
    id: '2'
    taskid: 0aed7220-4345-4618-884a-e09854131ef8
    type: regular
    task:
      id: 0aed7220-4345-4618-884a-e09854131ef8
      version: -1
      name: Set policy status not active
      description: Sets a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '4'
    scriptarguments:
      key:
        simple: Policy.State
      value:
        simple: Not Active
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 380
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '3':
    id: '3'
    taskid: 76f47710-f7d5-477e-8580-796e1083c4fd
    type: regular
    task:
      id: 76f47710-f7d5-477e-8580-796e1083c4fd
      version: -1
      name: Set policy status active
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '10'
      - '12'
    scriptarguments:
      key:
        simple: Policy.State
      value:
        simple: Active
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1170,
          "y": 380
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '4':
    id: '4'
    taskid: be369256-7e95-4bf2-81b6-3cf05ceb26c8
    type: title
    task:
      id: be369256-7e95-4bf2-81b6-3cf05ceb26c8
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ''
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 200,
          "y": 1180
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '5':
    id: '5'
    taskid: 498d0b00-bd30-4bb8-8e24-ecf6d97e8e5d
    type: condition
    task:
      id: 498d0b00-bd30-4bb8-8e24-ecf6d97e8e5d
      version: -1
      name: Was host isolated?
      type: condition
      iscommand: false
      brand: ''
      description: 'Was host isolated?'
    nexttasks:
      '#default#':
      - '8'
      yes:
      - '7'
    separatecontext: false
    conditions:
    - label: yes
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: Detection.Behavior.quarantine_machine
            iscontext: true
          right:
            value:
              simple: 'true'
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 830,
          "y": 680
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '7':
    id: '7'
    taskid: 2ddbc174-fc63-4b7c-8a86-282ca82d80c2
    type: regular
    task:
      id: 2ddbc174-fc63-4b7c-8a86-282ca82d80c2
      version: -1
      name: Set host isolated
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '11'
    scriptarguments:
      key:
        simple: Host.State
      value:
        simple: Isolated
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1030,
          "y": 860
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '8':
    id: '8'
    taskid: efd68ab1-05fb-479b-8b00-dfd720f014b9
    type: regular
    task:
      id: efd68ab1-05fb-479b-8b00-dfd720f014b9
      version: -1
      name: Set host no isolated
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '11'
    scriptarguments:
      key:
        simple: Host.State
      value:
        simple: Not Isolated
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 630,
          "y": 860
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '9':
    id: '9'
    taskid: d71558d5-a17b-4077-856b-e2c7819cb716
    type: title
    task:
      id: d71558d5-a17b-4077-856b-e2c7819cb716
      version: -1
      name: Policy State
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '19'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": -75
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '10':
    id: '10'
    taskid: 7259fb74-92b6-4084-8f04-ee58d84a0671
    type: title
    task:
      id: 7259fb74-92b6-4084-8f04-ee58d84a0671
      version: -1
      name: Host State
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '5'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 830,
          "y": 555
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '11':
    id: '11'
    taskid: 15f02b8f-ff2c-46ca-8f8d-87958f36e139
    type: title
    task:
      id: 15f02b8f-ff2c-46ca-8f8d-87958f36e139
      version: -1
      name: Done Host State
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '4'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 840,
          "y": 1030
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '12':
    id: '12'
    taskid: 64484bbc-8000-46e9-8d21-4f8a06eb8d75
    type: title
    task:
      id: 64484bbc-8000-46e9-8d21-4f8a06eb8d75
      version: -1
      name: Process State
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '13'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1930,
          "y": 555
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '13':
    id: '13'
    taskid: 748be87f-33af-415f-8b5a-3fe0bed1677e
    type: condition
    task:
      id: 748be87f-33af-415f-8b5a-3fe0bed1677e
      version: -1
      name: Was process handled?
      type: condition
      iscommand: false
      brand: ''
      description: 'Was process handled?'
    nexttasks:
      '#default#':
      - '17'
      Process blocked:
      - '18'
      process killed:
      - '15'
      process suspended:
      - '14'
    separatecontext: false
    conditions:
    - label: process killed
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: Detection.Behavior.kill_process
            iscontext: true
          right:
            value:
              simple: 'true'
          ignorecase: true
    - label: process suspended
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: Detection.Behavior.suspend_process
            iscontext: true
          right:
            value:
              simple: 'true'
          ignorecase: true
    - label: Process blocked
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: Detection.Behavior.process_blocked
            iscontext: true
          right:
            value:
              simple: 'true'
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 1930,
          "y": 670
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '14':
    id: '14'
    taskid: a5b33061-f3d9-4eb1-8459-c00fc5978435
    type: regular
    task:
      id: a5b33061-f3d9-4eb1-8459-c00fc5978435
      version: -1
      name: Set process suspended
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '16'
    scriptarguments:
      key:
        simple: Process.State
      value:
        simple: Suspended
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1930,
          "y": 860
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '15':
    id: '15'
    taskid: dd702688-dfae-4463-8e0f-8d5e8ae552cc
    type: regular
    task:
      id: dd702688-dfae-4463-8e0f-8d5e8ae552cc
      version: -1
      name: Set process killed
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '16'
    scriptarguments:
      key:
        simple: Process.State
      value:
        simple: Killed
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1530,
          "y": 860
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '16':
    id: '16'
    taskid: b87386a4-4266-425b-868f-7da9bcedcf8c
    type: title
    task:
      id: b87386a4-4266-425b-868f-7da9bcedcf8c
      version: -1
      name: Done Host State
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '4'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1740,
          "y": 1030
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '17':
    id: '17'
    taskid: f20c30ab-2b68-4522-830c-79b4c8f53253
    type: regular
    task:
      id: f20c30ab-2b68-4522-830c-79b4c8f53253
      version: -1
      name: Set no action taken
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '16'
    scriptarguments:
      key:
        simple: Process.State
      value:
        simple: No Action Taken
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2730,
          "y": 860
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '18':
    id: '18'
    taskid: 53a03f32-0e2a-44c4-8511-9569737270b2
    type: regular
    task:
      id: 53a03f32-0e2a-44c4-8511-9569737270b2
      version: -1
      name: Set process blocked
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '16'
    scriptarguments:
      key:
        simple: Process.State
      value:
        simple: Blocked
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2330,
          "y": 860
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '19':
    id: '19'
    taskid: 282d6e1e-fc71-4571-8089-0ebc1404c838
    type: regular
    task:
      id: 282d6e1e-fc71-4571-8089-0ebc1404c838
      version: -1
      name: Get full detection details
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '1'
    scriptarguments:
      key:
        simple: Detection.Behavior
      value:
        complex:
          root: inputs.PolicyBehaviourDetails
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 45
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "20":
    id: "20"
    taskid: e5ba8aa5-c0b8-4a58-85fe-7566ede7a5a3
    type: condition
    task:
      id: e5ba8aa5-c0b8-4a58-85fe-7566ede7a5a3
      version: -1
      name: Is there a policy object?
      description: Is there a policy object?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "4"
      "yes":
      - "9"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.PolicyBehaviourDetails
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 200,
          "y": -250
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1625,
        "width": 2910,
        "x": 200,
        "y": -380
      }
    }
  }
inputs:
- key: PolicyBehaviourDetails
  value: {}
  required: false
  description: The path that contains the detection results.
  playbookInputQuery:
outputs:
- contextPath: Policy.State
  description: Is the policy active?
  type: string
- contextPath: Host.State
  description: Is the host isolated?
  type: string
- contextPath: Process.State
  description: Was the process contained?
  type: string
tests:
- Test Playbook - CrowdStrike Falcon Malware - Verify Containment Actions
fromversion: 6.5.0
contentitemexportablefields:
  contentitemfields: {}
system: true
marketplaces:
- xsoar
# Should not appear in marketplacev2