Eradication Plan - Terminate Process

This playbook is one of the sub-playbooks in the eradication plan. This playbook handles the termination of the processes as a crucial step in the eradication action. The playbook executes actions of process termination, which is a crucial step in the eradication process. The process termination can be performed based on either the process ID or the process name.

Common Playbooks · 17 tasks · 4 inputs · 1 output

Details

ID	`Eradication Plan - Terminate Process`
From Version	6.6.0
Tasks	17

README

This playbook is one of the sub-playbooks in the eradication plan.
This playbook handles the termination of the processes as a crucial step in the eradication action.
The playbook executes actions of process termination, which is a crucial step in the eradication process.
The process termination can be performed based on either the process ID or the process name.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

This playbook does not use any integrations.

Scripts

PrintErrorEntry
Set

Commands

setParentIncidentContext
core-run-script-execute-commands
core-get-script-execution-results
core-run-script-kill-process

Playbook Inputs

Name	Description	Default Value	Required
ProcessTermination	Choose ‘PID’ to terminate the process by PID or ‘Name’ to terminate the process by process name. Note: If neither option is selected, the process will not be terminated.	Name	Optional
EndpointID	The endpoint ID to run commands over.		Optional
FilePath	The file path for the process termination.		Optional
ProcessID	The process ID to terminate.		Optional

Playbook Outputs

Path	Description	Type
TerminatedProcessFromEndpoints	The terminated process from endpoint	unknown

Playbook Image

Eradication Plan - Terminate Process

Inputs

ProcessTermination — Choose 'PID' to terminate the process by PID or 'Name' to terminate the process by process name. Note: If neither option is selected, the process will not be terminated.
EndpointID — The endpoint ID to run commands over.
FilePath — The file path for the process termination.
ProcessID — The process ID to terminate.

Outputs

TerminatedProcessFromEndpoints — The terminated process from endpoint

Commands used

core-get-script-execution-results core-run-script-execute-commands core-run-script-kill-process setParentIncidentContext

Flowchart

Source

playbook-Eradication_Plan_-_Terminate_Process.yml

Download History Raw

id: Eradication Plan - Terminate Process
version: -1
name: Eradication Plan - Terminate Process
description: "This playbook is one of the sub-playbooks in the eradication plan. \nThis playbook handles the termination of the processes as a crucial step in the eradication action.\nThe playbook executes actions of process termination, which is a crucial step in the eradication process.\nThe process termination can be performed based on either the process ID or the process name."
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 0c2bd2d8-2747-473f-873c-fdf0258c1425
    type: start
    task:
      id: 0c2bd2d8-2747-473f-873c-fdf0258c1425
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 190,
          "y": -180
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 387a0de2-f9a3-412a-8531-299ba47ac010
    type: condition
    task:
      id: 387a0de2-f9a3-412a-8531-299ba47ac010
      version: -1
      name: Should terminate the process?
      description: Whether to terminate the process automatically, manually, or not at all.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      Name:
      - "22"
      PID:
      - "21"
    separatecontext: false
    conditions:
    - label: PID
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.EndpointID
            iscontext: true
          right:
            value: {}
          ignorecase: true
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.ProcessTermination
            iscontext: true
          right:
            value:
              simple: PID
          ignorecase: true
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.ProcessID
            iscontext: true
      - - operator: notContainsGeneral
          left:
            value:
              complex:
                root: inputs.ProcessID
            iscontext: true
          right:
            value:
              simple: \
    - label: Name
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.ProcessTermination
            iscontext: true
          right:
            value:
              simple: Name
          ignorecase: true
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.EndpointID
            iscontext: true
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.FilePath
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 190,
          "y": -40
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: b6c458a7-8533-4692-87af-498de4ea894f
    type: title
    task:
      id: b6c458a7-8533-4692-87af-498de4ea894f
      version: -1
      name: Done - Process Termination
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 190,
          "y": 1240
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: d1bf1eb3-8962-4fe0-8f37-dd1d6e67fc1d
    type: regular
    task:
      id: d1bf1eb3-8962-4fe0-8f37-dd1d6e67fc1d
      version: -1
      name: Get command result
      description: Retrieve the results of a script execution action.
      script: '|||core-get-script-execution-results'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "10"
    scriptarguments:
      action_id:
        complex:
          root: Core.GetActionStatus
          accessor: action_id
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -70,
          "y": 500
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: f3850073-38b9-4991-8e2e-ac78bd2372e6
    type: regular
    task:
      id: f3850073-38b9-4991-8e2e-ac78bd2372e6
      version: -1
      name: process termination
      description: Initiates a new endpoint script execution kill process.
      script: '|||core-run-script-kill-process'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      endpoint_ids:
        complex:
          root: inputs.EndpointID
      process_name:
        complex:
          root: FilePath
          transformers:
          - operator: RegexExtractAll
            args:
              error_if_no_match: {}
              ignore_case: {}
              multi_line: {}
              period_matches_newline: {}
              regex:
                value:
                  simple: '[^\\]+$'
              unpack_matches: {}
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -70,
          "y": 320
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: 5bb3ab00-26df-4e11-89b2-a213d1eba8aa
    type: condition
    task:
      id: 5bb3ab00-26df-4e11-89b2-a213d1eba8aa
      version: -1
      name: Was the process terminated?
      description: Checks if the process was terminated.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "20"
      "yes":
      - "11"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: notEndWith
          left:
            value:
              complex:
                root: Core.ScriptResult.results
                accessor: standard_output
            iscontext: true
          right:
            value:
              simple: 'killed: 0.'
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -70,
          "y": 670
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: 960374b2-8b4a-4577-8bf1-ac02f9ceccf4
    type: regular
    task:
      id: 960374b2-8b4a-4577-8bf1-ac02f9ceccf4
      version: -1
      name: Set terminated process per endpoint ID
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "12"
    scriptarguments:
      extend-context:
        simple: TerminatedProcessFromEndpoints=
      ignore-outputs:
        simple: "true"
      key:
        complex:
          root: inputs.EndpointID
      value:
        complex:
          root: Core.ScriptResult.results
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: Core.ScriptResult.results._return_value
                iscontext: true
              right:
                value:
                  simple: "True"
              ignorecase: true
          accessor: standard_output
          transformers:
          - operator: RegexExtractAll
            args:
              error_if_no_match: {}
              ignore_case: {}
              multi_line: {}
              period_matches_newline: {}
              regex:
                value:
                  simple: .*name (.*) found.*
              unpack_matches: {}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -70,
          "y": 860
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: 42d427fd-6d4a-4b70-8b1a-35c76fdd8d45
    type: regular
    task:
      id: 42d427fd-6d4a-4b70-8b1a-35c76fdd8d45
      version: -1
      name: Set Deleted files per endpoint ID to the Incident context
      description: commands.local.cmd.set.parent.incident.context
      script: Builtin|||setParentIncidentContext
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      extend-context:
        simple: TerminatedProcessOnEndpoints=
      key:
        simple: TerminatedProcessPerEndpointsID
      value:
        complex:
          root: TerminatedProcessFromEndpoints
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -70,
          "y": 1040
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: 961146c8-6afd-4e75-8de9-d6a3171cf051
    type: regular
    task:
      id: 961146c8-6afd-4e75-8de9-d6a3171cf051
      version: -1
      name: process termination
      description: Initiate a new endpoint script execution of shell commands.
      script: '|||core-run-script-execute-commands'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "15"
    scriptarguments:
      commands:
        simple: taskkill /F /PID ${ProcessID}
      endpoint_ids:
        complex:
          root: inputs.EndpointID
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 440,
          "y": 320
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: 98faa8b1-1539-4e59-8274-c8434226eff7
    type: regular
    task:
      id: 98faa8b1-1539-4e59-8274-c8434226eff7
      version: -1
      name: Get command result
      description: Retrieve the results of a script execution action.
      script: '|||core-get-script-execution-results'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "16"
    scriptarguments:
      action_id:
        complex:
          root: Core.ScriptRun
          accessor: action_id
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 440,
          "y": 500
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "16":
    id: "16"
    taskid: 1a42b9b2-db4a-4905-8dd5-4b47d18449fc
    type: condition
    task:
      id: 1a42b9b2-db4a-4905-8dd5-4b47d18449fc
      version: -1
      name: Was the process terminated?
      description: Checks if the termination of the process was successful.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "19"
      "yes":
      - "17"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: endWith
          left:
            value:
              complex:
                root: Core.ScriptResult.results
                accessor: standard_output
            iscontext: true
          right:
            value:
              simple: has been terminated.
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 440,
          "y": 670
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "17":
    id: "17"
    taskid: 800bc596-f674-43ff-84cf-91da9573954b
    type: regular
    task:
      id: 800bc596-f674-43ff-84cf-91da9573954b
      version: -1
      name: Set terminated process per endpoint ID
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "18"
    scriptarguments:
      extend-context:
        simple: TerminatedProcessFromEndpoints=
      ignore-outputs:
        simple: "true"
      key:
        complex:
          root: inputs.EndpointID
      value:
        complex:
          root: Core.ScriptResult.results
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: Core.ScriptResult.results._return_value
                iscontext: true
              right:
                value:
                  simple: "True"
              ignorecase: true
          accessor: standard_output
          transformers:
          - operator: RegexExtractAll
            args:
              error_if_no_match: {}
              ignore_case: {}
              multi_line: {}
              period_matches_newline: {}
              regex:
                value:
                  simple: .*name (.*) found.*
              unpack_matches: {}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 440,
          "y": 860
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "18":
    id: "18"
    taskid: 0056cbe7-0eda-4bea-832f-9438e1f45936
    type: regular
    task:
      id: 0056cbe7-0eda-4bea-832f-9438e1f45936
      version: -1
      name: Set Deleted files per endpoint ID to the Incident context
      description: commands.local.cmd.set.parent.incident.context
      script: Builtin|||setParentIncidentContext
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      extend-context:
        simple: TerminatedProcessOnEndpoints=
      key:
        simple: TerminatedProcessPerEndpointsID
      value:
        complex:
          root: TerminatedProcessFromEndpoints
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 440,
          "y": 1040
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "19":
    id: "19"
    taskid: c7749af3-73ff-4422-87dd-e8caeb84c069
    type: regular
    task:
      id: c7749af3-73ff-4422-87dd-e8caeb84c069
      version: -1
      name: Print Error
      description: Prints an error entry with a given message
      scriptName: PrintErrorEntry
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      message:
        simple: The process termination has failed.
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 880,
          "y": 860
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "20":
    id: "20"
    taskid: 4e7794f3-70a6-4941-8e9e-65ef20777dca
    type: regular
    task:
      id: 4e7794f3-70a6-4941-8e9e-65ef20777dca
      version: -1
      name: Print Error
      description: Prints an error entry with a given message
      scriptName: PrintErrorEntry
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      message:
        simple: The process termination has failed.
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -490,
          "y": 860
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "21":
    id: "21"
    taskid: e5475bb4-564f-4364-892b-12b130016b7a
    type: regular
    task:
      id: e5475bb4-564f-4364-892b-12b130016b7a
      version: -1
      name: Set PID
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "13"
    scriptarguments:
      key:
        simple: ProcessID
      value:
        complex:
          root: inputs.ProcessID
          transformers:
          - operator: RegexExtractAll
            args:
              error_if_no_match: {}
              ignore_case: {}
              multi_line: {}
              period_matches_newline: {}
              regex:
                value:
                  simple: PID\":\"(\d+?)\"
              unpack_matches: {}
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: inputs.ProcessID
                iscontext: true
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 440,
          "y": 150
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "22":
    id: "22"
    taskid: 77d2329d-39ac-4e97-8490-b759589f91ad
    type: regular
    task:
      id: 77d2329d-39ac-4e97-8490-b759589f91ad
      version: -1
      name: Set Path
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      key:
        simple: FilePath
      value:
        complex:
          root: inputs.FilePath
          transformers:
          - operator: RegexExtractAll
            args:
              error_if_no_match: {}
              ignore_case: {}
              multi_line: {}
              period_matches_newline: {}
              regex:
                value:
                  simple: Path\":\"(.+?)\"
              unpack_matches: {}
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: inputs.FilePath
                iscontext: true
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -70,
          "y": 150
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "16_17_yes": 0.41,
      "1_5_#default#": 0.14
    },
    "paper": {
      "dimensions": {
        "height": 1485,
        "width": 1750,
        "x": -490,
        "y": -180
      }
    }
  }
inputs:
- key: ProcessTermination
  value:
    simple: Name
  required: false
  description: "Choose 'PID' to terminate the process by PID or 'Name' to terminate the process by process name. \nNote: If neither option is selected, the process will not be terminated."
  playbookInputQuery:
- key: EndpointID
  value: {}
  required: false
  description: The endpoint ID to run commands over.
  playbookInputQuery:
- key: FilePath
  value: {}
  required: false
  description: The file path for the process termination.
  playbookInputQuery:
- key: ProcessID
  value: {}
  required: false
  description: The process ID to terminate.
  playbookInputQuery:
outputs:
- contextPath: TerminatedProcessFromEndpoints
  description: The terminated process from endpoint
  type: unknown
tests:
- No tests (auto formatted)
fromversion: 6.6.0
marketplaces:
- marketplacev2
- platform
supportedModules:
- cloud_runtime_security
- xsiam
- edr
- agentix
- cloud