Eradication Plan - Delete File

This playbook is one of the sub-playbooks in the eradication plan. This playbook executes actions of file deletion, which is a crucial step in the eradication process.

Common Playbooks · 5 tasks · 3 inputs · 0 outputs

Details

ID	`Eradication Plan - Delete File`
From Version	6.6.0
Tasks	5

README

This playbook is one of the sub-playbooks in the eradication plan.
This playbook executes actions of file deletion, which is a crucial step in the eradication process.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

This playbook does not use any integrations.

Scripts

This playbook does not use any scripts.

Commands

core-get-script-execution-results
core-run-script-delete-file

Playbook Inputs

Name	Description	Default Value	Required
FileRemediation	Choose ‘Quarantine’ or ‘Delete’ to avoid file remediation conflicts. For example, choosing ‘Delete’ ignores the ‘Quarantine file’ task under the containment playbook and executes only file deletion.	Delete	Optional
EndpointID	The endpoint ID.	Endpoints	Optional
FilePath	The file path for the file deletion task.	Path	Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Eradication Plan - Delete File

Inputs

FileRemediation — Choose 'Quarantine' or 'Delete' to avoid file remediation conflicts. For example, choosing 'Delete' ignores the 'Quarantine file' task under the containment playbook and executes only file deletion.
EndpointID — The endpoint ID.
FilePath — The file path for the file deletion task.

Commands used

core-get-script-execution-results core-run-script-delete-file

Flowchart

Source

playbook-Eradication_Plan_-_Delete_File.yml

Download History Raw

id: Eradication Plan - Delete File
version: -1
name: Eradication Plan - Delete File
description: "This playbook is one of the sub-playbooks in the eradication plan. \nThis playbook executes actions of file deletion, which is a crucial step in the eradication process."
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 48cbb13a-a0c0-4a27-815a-66e38f3387ff
    type: start
    task:
      id: 48cbb13a-a0c0-4a27-815a-66e38f3387ff
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "21"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 350,
          "y": 80
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 7c4ec73d-fff2-45de-8387-699ac5c64a2d
    type: regular
    task:
      id: 7c4ec73d-fff2-45de-8387-699ac5c64a2d
      version: -1
      name: Auto file deletion
      description: Initiates a new endpoint script execution to delete the specified file.
      script: '|||core-run-script-delete-file'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "19"
    scriptarguments:
      endpoint_ids:
        complex:
          root: inputs.EndpointID
      file_path:
        complex:
          root: inputs.FilePath
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 350,
          "y": 430
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: 040279ae-6f3d-42a1-8def-2c0565fd669f
    type: title
    task:
      id: 040279ae-6f3d-42a1-8def-2c0565fd669f
      version: -1
      name: Done - File Deletion
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 350,
          "y": 790
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "19":
    id: "19"
    taskid: e6efaf8f-a382-45a5-8286-e3e8b86eee8e
    type: regular
    task:
      id: e6efaf8f-a382-45a5-8286-e3e8b86eee8e
      version: -1
      name: Get command result
      description: Retrieve the results of a script execution action.
      script: '|||core-get-script-execution-results'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      action_id:
        complex:
          root: Core.GetActionStatus
          accessor: action_id
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 350,
          "y": 600
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "21":
    id: "21"
    taskid: a1a09dd3-d1de-40ae-898b-6fe92bd93c6e
    type: condition
    task:
      id: a1a09dd3-d1de-40ae-898b-6fe92bd93c6e
      version: -1
      name: Should delete the file?
      description: Whether to delete the file based on the input values.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "3"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.FilePath
            iscontext: true
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.EndpointID
            iscontext: true
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.FileRemediation
            iscontext: true
          right:
            value:
              simple: Delete
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 350,
          "y": 220
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "21_3_yes": 0.59
    },
    "paper": {
      "dimensions": {
        "height": 775,
        "width": 380,
        "x": 350,
        "y": 80
      }
    }
  }
inputs:
- key: FileRemediation
  value:
    simple: Delete
  required: false
  description: "Choose 'Quarantine' or 'Delete' to avoid file remediation conflicts. \nFor example, choosing 'Delete' ignores the 'Quarantine file' task under the containment playbook and executes only file deletion."
  playbookInputQuery:
- key: EndpointID
  value:
    complex:
      root: Endpoints
  required: false
  description: The endpoint ID.
  playbookInputQuery:
- key: FilePath
  value:
    complex:
      root: Path
  required: false
  description: The file path for the file deletion task.
  playbookInputQuery:
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.6.0
marketplaces:
- marketplacev2
- platform
supportedModules:
- cloud_runtime_security
- xsiam
- edr
- agentix
- cloud