Eradication Plan

This playbook handles all the eradication actions available with Cortex XSIAM, including the following sub-playbooks: * Eradication Plan - Reset user password * Eradication Plan - Delete file * Eradication Plan - Kill process (currently, the playbook supports terminating a process by name) Note: The playbook inputs enable manipulating the execution flow. Read the input descriptions for details.

Common Playbooks · 13 tasks · 8 inputs · 1 output

Details

ID	`Eradication Plan`
From Version	6.6.0
Tasks	13

README

This playbook handles all the eradication actions available with Cortex XSIAM, including the following sub-playbooks:

Eradication Plan - Reset user password
Eradication Plan - Delete file
Eradication Plan - Kill process (currently, the playbook supports terminating a process by name)

Note: The playbook inputs enable manipulating the execution flow. Read the input descriptions for details.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

Eradication Plan - Terminate Process
Eradication Plan - Reset Password
Eradication Plan - Delete File

Integrations

This playbook does not use any integrations.

Scripts

Commands

This playbook does not use any commands.

Playbook Inputs

Name	Description	Default Value	Required
AutoEradicate	Set to True to execute the eradication playbook automatically.	True	Optional
EndpointID	The endpoint ID.	alert.agentid	Optional
FilePath	The file path for the file deletion and for the process termination task.	foundIncidents.CustomFields.initiatorpath	Optional
Username	The username to reset the password for.	foundIncidents.CustomFields.username	Optional
FileRemediation	Choose ‘Quarantine’ or ‘Delete’ to avoid file remediation conflicts. For example, choosing ‘Delete’ ignores the ‘Quarantine file’ task under the containment playbook and executes only file deletion.	Delete	Optional
UserRemediation	Set to ‘True’ to reset the user’s password.	True	Optional
ProcessTermination	Choose ‘PID’ to terminate the process using the Process ID, or ‘Name’ to terminate the process using its name. Please note that providing the file path is mandatory for the process termination. If ‘PID’ is chosen, the input `ProcessID` should not be empty; otherwise, the termination will not proceed.	Name	Optional
ProcessID	The process ID to terminate.		Optional

Playbook Outputs

Path	Description	Type
TerminatedProcessFromEndpoints	The terminated process from endpoint	unknown

Playbook Image

Eradication Plan

Inputs

AutoEradicate — Set to True to execute the eradication playbook automatically.
EndpointID — The endpoint ID.
FilePath — The file path for the file deletion and for the process termination task.
Username — The username to reset the password for.
FileRemediation — Choose 'Quarantine' or 'Delete' to avoid file remediation conflicts. For example, choosing 'Delete' ignores the 'Quarantine file' task under the containment playbook and executes only file deletion.
UserRemediation — Set to 'True' to reset the user's password.
ProcessTermination — Choose 'PID' to terminate the process using the Process ID, or 'Name' to terminate the process using its name. Please note that providing the file path is mandatory for the process termination. If 'PID' is chosen, the input `ProcessID` should not be empty; otherwise, the termination will not proceed.
ProcessID — The process ID to terminate.

Outputs

TerminatedProcessFromEndpoints — The terminated process from endpoint

Flowchart

Source

playbook-Eradication_Plan.yml playbook-Eradication_Plan_-_Delete_File.yml playbook-Eradication_Plan_-_Delete_File_README.md playbook-Eradication_Plan_-_Reset_Password.yml playbook-Eradication_Plan_-_Reset_Password_README.md playbook-Eradication_Plan_-_Terminate_Process.yml playbook-Eradication_Plan_-_Terminate_Process_README.md

Download History Raw

id: Eradication Plan - Delete File
version: -1
name: Eradication Plan - Delete File
description: "This playbook is one of the sub-playbooks in the eradication plan. \nThis playbook executes actions of file deletion, which is a crucial step in the eradication process."
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 48cbb13a-a0c0-4a27-815a-66e38f3387ff
    type: start
    task:
      id: 48cbb13a-a0c0-4a27-815a-66e38f3387ff
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "21"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 350,
          "y": 80
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 7c4ec73d-fff2-45de-8387-699ac5c64a2d
    type: regular
    task:
      id: 7c4ec73d-fff2-45de-8387-699ac5c64a2d
      version: -1
      name: Auto file deletion
      description: Initiates a new endpoint script execution to delete the specified file.
      script: '|||core-run-script-delete-file'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "19"
    scriptarguments:
      endpoint_ids:
        complex:
          root: inputs.EndpointID
      file_path:
        complex:
          root: inputs.FilePath
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 350,
          "y": 430
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: 040279ae-6f3d-42a1-8def-2c0565fd669f
    type: title
    task:
      id: 040279ae-6f3d-42a1-8def-2c0565fd669f
      version: -1
      name: Done - File Deletion
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 350,
          "y": 790
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "19":
    id: "19"
    taskid: e6efaf8f-a382-45a5-8286-e3e8b86eee8e
    type: regular
    task:
      id: e6efaf8f-a382-45a5-8286-e3e8b86eee8e
      version: -1
      name: Get command result
      description: Retrieve the results of a script execution action.
      script: '|||core-get-script-execution-results'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      action_id:
        complex:
          root: Core.GetActionStatus
          accessor: action_id
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 350,
          "y": 600
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "21":
    id: "21"
    taskid: a1a09dd3-d1de-40ae-898b-6fe92bd93c6e
    type: condition
    task:
      id: a1a09dd3-d1de-40ae-898b-6fe92bd93c6e
      version: -1
      name: Should delete the file?
      description: Whether to delete the file based on the input values.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "3"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.FilePath
            iscontext: true
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.EndpointID
            iscontext: true
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.FileRemediation
            iscontext: true
          right:
            value:
              simple: Delete
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 350,
          "y": 220
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "21_3_yes": 0.59
    },
    "paper": {
      "dimensions": {
        "height": 775,
        "width": 380,
        "x": 350,
        "y": 80
      }
    }
  }
inputs:
- key: FileRemediation
  value:
    simple: Delete
  required: false
  description: "Choose 'Quarantine' or 'Delete' to avoid file remediation conflicts. \nFor example, choosing 'Delete' ignores the 'Quarantine file' task under the containment playbook and executes only file deletion."
  playbookInputQuery:
- key: EndpointID
  value:
    complex:
      root: Endpoints
  required: false
  description: The endpoint ID.
  playbookInputQuery:
- key: FilePath
  value:
    complex:
      root: Path
  required: false
  description: The file path for the file deletion task.
  playbookInputQuery:
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.6.0
marketplaces:
- marketplacev2
- platform
supportedModules:
- cloud_runtime_security
- xsiam
- edr
- agentix
- cloud