Eradication Plan

This playbook handles all the eradication actions available with Cortex XSIAM, including the following sub-playbooks: * Eradication Plan - Reset user password * Eradication Plan - Delete file * Eradication Plan - Kill process (currently, the playbook supports terminating a process by name) Note: The playbook inputs enable manipulating the execution flow. Read the input descriptions for details.

Common Playbooks · 13 tasks · 8 inputs · 1 output

Details

IDEradication Plan
From Version6.6.0
Tasks13

README

This playbook handles all the eradication actions available with Cortex XSIAM, including the following sub-playbooks:

  • Eradication Plan - Reset user password
  • Eradication Plan - Delete file
  • Eradication Plan - Kill process (currently, the playbook supports terminating a process by name)

Note: The playbook inputs enable manipulating the execution flow. Read the input descriptions for details.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • Eradication Plan - Terminate Process
  • Eradication Plan - Reset Password
  • Eradication Plan - Delete File

Integrations

This playbook does not use any integrations.

Scripts

  • Set

Commands

This playbook does not use any commands.

Playbook Inputs

Name Description Default Value Required
AutoEradicate Set to True to execute the eradication playbook automatically. True Optional
EndpointID The endpoint ID. alert.agentid Optional
FilePath The file path for the file deletion and for the process termination task. foundIncidents.CustomFields.initiatorpath Optional
Username The username to reset the password for. foundIncidents.CustomFields.username Optional
FileRemediation Choose ‘Quarantine’ or ‘Delete’ to avoid file remediation conflicts.
For example, choosing ‘Delete’ ignores the ‘Quarantine file’ task under the containment playbook and executes only file deletion.		 Delete Optional
UserRemediation Set to ‘True’ to reset the user’s password. True Optional
ProcessTermination Choose ‘PID’ to terminate the process using the Process ID, or ‘Name’ to terminate the process using its name.
Please note that providing the file path is mandatory for the process termination.
If ‘PID’ is chosen, the input `ProcessID` should not be empty; otherwise, the termination will not proceed.		 Name Optional
ProcessID The process ID to terminate.   Optional

Playbook Outputs

Path Description Type
TerminatedProcessFromEndpoints The terminated process from endpoint unknown

Playbook Image

Eradication Plan

Inputs

  • AutoEradicate — Set to True to execute the eradication playbook automatically.
  • EndpointID — The endpoint ID.
  • FilePath — The file path for the file deletion and for the process termination task.
  • Username — The username to reset the password for.
  • FileRemediation — Choose 'Quarantine' or 'Delete' to avoid file remediation conflicts. For example, choosing 'Delete' ignores the 'Quarantine file' task under the containment playbook and executes only file deletion.
  • UserRemediation — Set to 'True' to reset the user's password.
  • ProcessTermination — Choose 'PID' to terminate the process using the Process ID, or 'Name' to terminate the process using its name. Please note that providing the file path is mandatory for the process termination. If 'PID' is chosen, the input `ProcessID` should not be empty; otherwise, the termination will not proceed.
  • ProcessID — The process ID to terminate.

Outputs

  • TerminatedProcessFromEndpoints — The terminated process from endpoint

Flowchart

yes yes Start Start Which eradication actions would you like to perform? Which eradication actions... Eradication Eradication Should Eradicate automatically? Should Eradicate automati... Eradication Plan - Delete File - Eradication Plan - Delete File Eradication Plan - Delete... Eradication Plan - Delete File Eradication Plan - Reset Password - Eradication Plan - Reset Password Eradication Plan - Reset ... Eradication Plan - Reset Pass... Eradication Plan - Terminate Process - Eradication Plan - Terminate Process Eradication Plan - Termin... Eradication Plan - Terminate ... Reset Password Reset Password Delete File Delete File Terminate Process Terminate Process Done Done Set Process list - Set Set Process list Set The file path and PID defined? The file path and PID def...

Source

playbook-Eradication_Plan.yml playbook-Eradication_Plan_-_Delete_File.yml playbook-Eradication_Plan_-_Delete_File_README.md playbook-Eradication_Plan_-_Reset_Password.yml playbook-Eradication_Plan_-_Reset_Password_README.md playbook-Eradication_Plan_-_Terminate_Process.yml playbook-Eradication_Plan_-_Terminate_Process_README.md
Download History Raw 
This playbook is one of the sub-playbooks in the eradication plan. 
This playbook executes actions of file deletion, which is a crucial step in the eradication process.

## Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

### Sub-playbooks

This playbook does not use any sub-playbooks.

### Integrations

This playbook does not use any integrations.

### Scripts

This playbook does not use any scripts.

### Commands

* core-get-script-execution-results
* core-run-script-delete-file

## Playbook Inputs

---

| **Name** | **Description** | **Default Value** | **Required** |
| --- | --- | --- | --- |
| FileRemediation | Choose 'Quarantine' or 'Delete' to avoid file remediation conflicts. <br/>For example, choosing 'Delete' ignores the 'Quarantine file' task under the containment playbook and executes only file deletion. | Delete | Optional |
| EndpointID | The endpoint ID. | Endpoints | Optional |
| FilePath | The file path for the file deletion task. | Path | Optional |

## Playbook Outputs

---
There are no outputs for this playbook.

## Playbook Image

---

![Eradication Plan - Delete File](../doc_files/Eradication_Plan_-_Delete_File.png)