Eradication Plan

This playbook handles all the eradication actions available with Cortex XSIAM, including the following sub-playbooks: * Eradication Plan - Reset user password * Eradication Plan - Delete file * Eradication Plan - Kill process (currently, the playbook supports terminating a process by name) Note: The playbook inputs enable manipulating the execution flow. Read the input descriptions for details.

Common Playbooks · 13 tasks · 8 inputs · 1 output

Inputs

  • AutoEradicate — Set to True to execute the eradication playbook automatically.
  • EndpointID — The endpoint ID.
  • FilePath — The file path for the file deletion and for the process termination task.
  • Username — The username to reset the password for.
  • FileRemediation — Choose 'Quarantine' or 'Delete' to avoid file remediation conflicts. For example, choosing 'Delete' ignores the 'Quarantine file' task under the containment playbook and executes only file deletion.
  • UserRemediation — Set to 'True' to reset the user's password.
  • ProcessTermination — Choose 'PID' to terminate the process using the Process ID, or 'Name' to terminate the process using its name. Please note that providing the file path is mandatory for the process termination. If 'PID' is chosen, the input `ProcessID` should not be empty; otherwise, the termination will not proceed.
  • ProcessID — The process ID to terminate.

Outputs

  • TerminatedProcessFromEndpoints — The terminated process from endpoint

Flowchart

yes yes Start Start Which eradication actions would you like to perform? Which eradication actions... Eradication Eradication Should Eradicate automatically? Should Eradicate automati... Eradication Plan - Delete File - Eradication Plan - Delete File Eradication Plan - Delete... Eradication Plan - Delete File Eradication Plan - Reset Password - Eradication Plan - Reset Password Eradication Plan - Reset ... Eradication Plan - Reset Pass... Eradication Plan - Terminate Process - Eradication Plan - Terminate Process Eradication Plan - Termin... Eradication Plan - Terminate ... Reset Password Reset Password Delete File Delete File Terminate Process Terminate Process Done Done Set Process list - Set Set Process list Set The file path and PID defined? The file path and PID def...