Eradication Plan

This playbook handles all the eradication actions available with Cortex XSIAM, including the following sub-playbooks: * Eradication Plan - Reset user password * Eradication Plan - Delete file * Eradication Plan - Kill process (currently, the playbook supports terminating a process by name) Note: The playbook inputs enable manipulating the execution flow. Read the input descriptions for details.

Common Playbooks · 13 tasks · 8 inputs · 1 output

Details

ID	`Eradication Plan`
From Version	6.6.0
Tasks	13

README

This playbook handles all the eradication actions available with Cortex XSIAM, including the following sub-playbooks:

Eradication Plan - Reset user password
Eradication Plan - Delete file
Eradication Plan - Kill process (currently, the playbook supports terminating a process by name)

Note: The playbook inputs enable manipulating the execution flow. Read the input descriptions for details.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

Eradication Plan - Terminate Process
Eradication Plan - Reset Password
Eradication Plan - Delete File

Integrations

This playbook does not use any integrations.

Scripts

Commands

This playbook does not use any commands.

Playbook Inputs

Name	Description	Default Value	Required
AutoEradicate	Set to True to execute the eradication playbook automatically.	True	Optional
EndpointID	The endpoint ID.	alert.agentid	Optional
FilePath	The file path for the file deletion and for the process termination task.	foundIncidents.CustomFields.initiatorpath	Optional
Username	The username to reset the password for.	foundIncidents.CustomFields.username	Optional
FileRemediation	Choose ‘Quarantine’ or ‘Delete’ to avoid file remediation conflicts. For example, choosing ‘Delete’ ignores the ‘Quarantine file’ task under the containment playbook and executes only file deletion.	Delete	Optional
UserRemediation	Set to ‘True’ to reset the user’s password.	True	Optional
ProcessTermination	Choose ‘PID’ to terminate the process using the Process ID, or ‘Name’ to terminate the process using its name. Please note that providing the file path is mandatory for the process termination. If ‘PID’ is chosen, the input `ProcessID` should not be empty; otherwise, the termination will not proceed.	Name	Optional
ProcessID	The process ID to terminate.		Optional

Playbook Outputs

Path	Description	Type
TerminatedProcessFromEndpoints	The terminated process from endpoint	unknown

Playbook Image

Eradication Plan

Inputs

AutoEradicate — Set to True to execute the eradication playbook automatically.
EndpointID — The endpoint ID.
FilePath — The file path for the file deletion and for the process termination task.
Username — The username to reset the password for.
FileRemediation — Choose 'Quarantine' or 'Delete' to avoid file remediation conflicts. For example, choosing 'Delete' ignores the 'Quarantine file' task under the containment playbook and executes only file deletion.
UserRemediation — Set to 'True' to reset the user's password.
ProcessTermination — Choose 'PID' to terminate the process using the Process ID, or 'Name' to terminate the process using its name. Please note that providing the file path is mandatory for the process termination. If 'PID' is chosen, the input `ProcessID` should not be empty; otherwise, the termination will not proceed.
ProcessID — The process ID to terminate.

Outputs

TerminatedProcessFromEndpoints — The terminated process from endpoint

Flowchart

Source

playbook-Eradication_Plan.yml playbook-Eradication_Plan_-_Delete_File.yml playbook-Eradication_Plan_-_Delete_File_README.md playbook-Eradication_Plan_-_Reset_Password.yml playbook-Eradication_Plan_-_Reset_Password_README.md playbook-Eradication_Plan_-_Terminate_Process.yml playbook-Eradication_Plan_-_Terminate_Process_README.md

Download History Raw

id: Eradication Plan
version: -1
contentitemexportablefields:
  contentitemfields: {}
name: Eradication Plan
description: "This playbook handles all the eradication actions available with Cortex XSIAM, including the following sub-playbooks:\n* Eradication Plan - Reset user password\n* Eradication Plan - Delete file\n* Eradication Plan - Kill process (currently, the playbook supports terminating a process by name)  \n\nNote: The playbook inputs enable manipulating the execution flow. Read the input descriptions for details."
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: a565fd6d-2dd4-4f6f-8c41-d80d96fd1a58
    type: start
    task:
      id: a565fd6d-2dd4-4f6f-8c41-d80d96fd1a58
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "57"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 170,
          "y": -470
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "46":
    id: "46"
    taskid: 0b8d21a3-7d1d-44ac-898f-f7b9dd3c484e
    type: collection
    task:
      id: 0b8d21a3-7d1d-44ac-898f-f7b9dd3c484e
      version: -1
      name: Which eradication actions would you like to perform?
      description: Select which indicators to block.
      type: collection
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "47"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -120,
          "y": 240
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
      subject:
      body:
      methods: []
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: true
        completeaftersla: false
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          simple: Select Users to reset their password
        required: false
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: inputs.Username
            transformers:
            - operator: uniq
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      - id: "1"
        label: ""
        labelarg:
          simple: Select Files to delete
        required: false
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: inputs.FilePath
            transformers:
            - operator: uniq
        fieldassociated: ""
        placeholder: ""
        tooltip: Please consider carefully whether the file will be needed for further investigation before deleting it.
        readonly: false
      - id: "2"
        label: ""
        labelarg:
          simple: Select Process to terminate
        required: false
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: ProcessList
            transformers:
            - operator: uniq
            - operator: SetIfEmpty
              args:
                applyIfEmpty: {}
                defaultValue:
                  value:
                    simple: inputs.FilePath
                  iscontext: true
        fieldassociated: ""
        placeholder: ""
        tooltip: Please consider carefully whether the process termination could impact system processes with a similar name.
        readonly: false
      title: Which Eradication actions would you like to perform?
      description: Select which eradication actions to perform.
      sender: ""
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "47":
    id: "47"
    taskid: eac14d54-acee-4628-894b-c3f85ad56381
    type: title
    task:
      id: eac14d54-acee-4628-894b-c3f85ad56381
      version: -1
      name: Eradication
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "54"
      - "52"
      - "53"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 170,
          "y": 410
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "48":
    id: "48"
    taskid: 7e62a114-2f14-44b9-8fcb-e391078f8112
    type: condition
    task:
      id: 7e62a114-2f14-44b9-8fcb-e391078f8112
      version: -1
      name: Should Eradicate automatically?
      description: Whether to perform eradication actions automatically or manually.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "46"
      "yes":
      - "47"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.AutoEradicate
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 170,
          "y": 60
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "49":
    id: "49"
    taskid: 4c625140-7998-49e8-82c5-aeee98dfc0ca
    type: playbook
    task:
      id: 4c625140-7998-49e8-82c5-aeee98dfc0ca
      version: -1
      name: Eradication Plan - Delete File
      description: "This playbook is one of the sub-playbooks in the eradication plan. \nThis playbook handles the deletion of files as a crucial step in the eradication action."
      playbookName: Eradication Plan - Delete File
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "55"
    scriptarguments:
      EndpointID:
        complex:
          root: inputs.EndpointID
      FilePath:
        complex:
          root: inputs.AutoEradicate
          transformers:
          - operator: If-Then-Else
            args:
              condition:
                value:
                  simple: lhs==rhs
              conditionB: {}
              conditionInBetween: {}
              else:
                value:
                  simple: Which Eradication actions would you like to perform?.Answers.1
                iscontext: true
              equals: {}
              lhs:
                value:
                  simple: inputs.AutoEradicate
                iscontext: true
              lhsB: {}
              options: {}
              optionsB: {}
              rhs:
                value:
                  simple: "True"
              rhsB: {}
              then:
                value:
                  simple: inputs.FilePath
                iscontext: true
      FileRemediation:
        complex:
          root: inputs.FileRemediation
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 170,
          "y": 695
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "50":
    id: "50"
    taskid: 4064fb9d-3562-4426-8567-806aac320392
    type: playbook
    task:
      id: 4064fb9d-3562-4426-8567-806aac320392
      version: -1
      name: Eradication Plan - Reset Password
      description: "This playbook is one of the sub-playbooks in the eradication plan. \nThis playbook handles the resetting of users' passwords as a crucial step in the containment action."
      playbookName: Eradication Plan - Reset Password
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "55"
    scriptarguments:
      UserRemediation:
        complex:
          root: inputs.UserRemediation
      Username:
        complex:
          root: inputs.AutoEradicate
          transformers:
          - operator: If-Then-Else
            args:
              condition:
                value:
                  simple: lhs==rhs
              conditionB: {}
              conditionInBetween: {}
              else:
                value:
                  simple: Which Eradication actions would you like to perform?.Answers.0
                iscontext: true
              equals: {}
              lhs:
                value:
                  simple: inputs.AutoEradicate
                iscontext: true
              lhsB: {}
              options: {}
              optionsB: {}
              rhs:
                value:
                  simple: "True"
              rhsB: {}
              then:
                value:
                  simple: inputs.Username
                iscontext: true
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": -300,
          "y": 695
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "51":
    id: "51"
    taskid: f6891014-dec9-4d8f-8bcf-9394440fff4c
    type: playbook
    task:
      id: f6891014-dec9-4d8f-8bcf-9394440fff4c
      version: -1
      name: Eradication Plan - Terminate Process
      description: "This playbook is one of the sub-playbooks in the eradication plan. \nThis playbook handles the termination of the processes as a crucial step in the eradication action."
      playbookName: Eradication Plan - Terminate Process
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "55"
    scriptarguments:
      EndpointID:
        complex:
          root: inputs.EndpointID
      FilePath:
        complex:
          root: inputs.AutoEradicate
          transformers:
          - operator: If-Then-Else
            args:
              condition:
                value:
                  simple: lhs==rhs
              conditionB: {}
              conditionInBetween: {}
              else:
                value:
                  simple: Which Eradication actions would you like to perform?.Answers.2
                iscontext: true
              equals: {}
              lhs:
                value:
                  simple: inputs.AutoEradicate
                iscontext: true
              lhsB: {}
              options: {}
              optionsB: {}
              rhs:
                value:
                  simple: "True"
              rhsB: {}
              then:
                value:
                  simple: inputs.FilePath
                iscontext: true
      ProcessID:
        complex:
          root: inputs.AutoEradicate
          transformers:
          - operator: If-Then-Else
            args:
              condition:
                value:
                  simple: lhs==rhs
              conditionB: {}
              conditionInBetween: {}
              else:
                value:
                  simple: Which Eradication actions would you like to perform?.Answers.2
                iscontext: true
              equals: {}
              lhs:
                value:
                  simple: inputs.AutoEradicate
                iscontext: true
              lhsB: {}
              options: {}
              optionsB: {}
              rhs:
                value:
                  simple: "True"
              rhsB: {}
              then:
                value:
                  simple: inputs.ProcessID
                iscontext: true
      ProcessTermination:
        complex:
          root: inputs.ProcessTermination
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 640,
          "y": 695
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "52":
    id: "52"
    taskid: e2ca1e88-b318-4dd3-8cd0-e79bcea8b708
    type: title
    task:
      id: e2ca1e88-b318-4dd3-8cd0-e79bcea8b708
      version: -1
      name: Reset Password
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "50"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -300,
          "y": 560
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "53":
    id: "53"
    taskid: 55eece77-4b85-418a-85b4-2df675bc6406
    type: title
    task:
      id: 55eece77-4b85-418a-85b4-2df675bc6406
      version: -1
      name: Delete File
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "49"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 170,
          "y": 560
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "54":
    id: "54"
    taskid: 85a5283a-4dcb-4be9-8994-cda1836b671a
    type: title
    task:
      id: 85a5283a-4dcb-4be9-8994-cda1836b671a
      version: -1
      name: Terminate Process
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "51"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 640,
          "y": 560
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "55":
    id: "55"
    taskid: aca6dccc-d750-41e7-8303-cc4cb1d1e1d8
    type: title
    task:
      id: aca6dccc-d750-41e7-8303-cc4cb1d1e1d8
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 170,
          "y": 875
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "56":
    id: "56"
    taskid: d459e56b-3290-44e3-81c7-0a69a339dbbf
    type: regular
    task:
      id: d459e56b-3290-44e3-81c7-0a69a339dbbf
      version: -1
      name: Set Process list
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "48"
    scriptarguments:
      key:
        simple: ProcessList
      stringify:
        simple: "false"
      value:
        complex:
          root: inputs.FilePath
          transformers:
          - operator: RegexExtractAll
            args:
              error_if_no_match: {}
              ignore_case: {}
              multi_line: {}
              period_matches_newline: {}
              regex:
                value:
                  simple: '[^\\]+$'
              unpack_matches: {}
          - operator: MakePair
            args:
              array1_key:
                iscontext: true
              array2:
                value:
                  simple: inputs.ProcessID
                iscontext: true
              array2_key: {}
              determine_output_length_by: {}
              merge_dict: {}
              output_name1:
                value:
                  simple: Path
              output_name2:
                value:
                  simple: PID
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -120,
          "y": -140
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "57":
    id: "57"
    taskid: e5166636-3899-4c68-8dfa-b2b39ca764ed
    type: condition
    task:
      id: e5166636-3899-4c68-8dfa-b2b39ca764ed
      version: -1
      name: The file path and PID defined?
      description: Check if the file path and PID are defined.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "48"
      "yes":
      - "56"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.FilePath
            iscontext: true
          right:
            value: {}
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.ProcessID
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 170,
          "y": -330
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "48_47_yes": 0.53
    },
    "paper": {
      "dimensions": {
        "height": 1410,
        "width": 1320,
        "x": -300,
        "y": -470
      }
    }
  }
inputs:
- key: AutoEradicate
  value:
    simple: "True"
  required: false
  description: Set to True to execute the eradication playbook automatically.
  playbookInputQuery:
- key: EndpointID
  value:
    complex:
      root: alert
      accessor: agentid
  required: false
  description: The endpoint ID.
  playbookInputQuery:
- key: FilePath
  value:
    complex:
      root: foundIncidents.CustomFields
      accessor: initiatorpath
  required: false
  description: The file path for the file deletion and for the process termination task.
  playbookInputQuery:
- key: Username
  value:
    complex:
      root: foundIncidents.CustomFields
      accessor: username
  required: false
  description: The username to reset the password for.
  playbookInputQuery:
- key: FileRemediation
  value:
    simple: Delete
  required: false
  description: "Choose 'Quarantine' or 'Delete'  to avoid file remediation conflicts. \nFor example, choosing 'Delete' ignores the 'Quarantine file' task under the containment playbook and executes only file deletion."
  playbookInputQuery:
- key: UserRemediation
  value:
    simple: "True"
  required: false
  description: Set to 'True' to reset the user's password.
  playbookInputQuery:
- key: ProcessTermination
  value:
    simple: Name
  required: false
  description: "Choose 'PID' to terminate the process using the Process ID, or 'Name' to terminate the process using its name.\nPlease note that providing the file path is mandatory for the process termination. \nIf 'PID' is chosen, the input `ProcessID` should not be empty; otherwise, the termination will not proceed."
  playbookInputQuery:
- key: ProcessID
  value: {}
  required: false
  description: The process ID to terminate.
  playbookInputQuery:
outputs:
- contextPath: TerminatedProcessFromEndpoints
  description: The terminated process from endpoint
  type: unknown
tests:
- Eradication plan - Test
marketplaces:
- marketplacev2
- platform
fromversion: 6.6.0