Eradication Plan

This playbook handles all the eradication actions available with Cortex XSIAM, including the following sub-playbooks: * Eradication Plan - Reset user password * Eradication Plan - Delete file * Eradication Plan - Kill process (currently, the playbook supports terminating a process by name) Note: The playbook inputs enable manipulating the execution flow. Read the input descriptions for details.

Common Playbooks · 13 tasks · 8 inputs · 1 output

Details

ID	`Eradication Plan`
From Version	6.6.0
Tasks	13

README

This playbook handles all the eradication actions available with Cortex XSIAM, including the following sub-playbooks:

Eradication Plan - Reset user password
Eradication Plan - Delete file
Eradication Plan - Kill process (currently, the playbook supports terminating a process by name)

Note: The playbook inputs enable manipulating the execution flow. Read the input descriptions for details.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

Eradication Plan - Terminate Process
Eradication Plan - Reset Password
Eradication Plan - Delete File

Integrations

This playbook does not use any integrations.

Scripts

Commands

This playbook does not use any commands.

Playbook Inputs

Name	Description	Default Value	Required
AutoEradicate	Set to True to execute the eradication playbook automatically.	True	Optional
EndpointID	The endpoint ID.	alert.agentid	Optional
FilePath	The file path for the file deletion and for the process termination task.	foundIncidents.CustomFields.initiatorpath	Optional
Username	The username to reset the password for.	foundIncidents.CustomFields.username	Optional
FileRemediation	Choose ‘Quarantine’ or ‘Delete’ to avoid file remediation conflicts. For example, choosing ‘Delete’ ignores the ‘Quarantine file’ task under the containment playbook and executes only file deletion.	Delete	Optional
UserRemediation	Set to ‘True’ to reset the user’s password.	True	Optional
ProcessTermination	Choose ‘PID’ to terminate the process using the Process ID, or ‘Name’ to terminate the process using its name. Please note that providing the file path is mandatory for the process termination. If ‘PID’ is chosen, the input `ProcessID` should not be empty; otherwise, the termination will not proceed.	Name	Optional
ProcessID	The process ID to terminate.		Optional

Playbook Outputs

Path	Description	Type
TerminatedProcessFromEndpoints	The terminated process from endpoint	unknown

Playbook Image

Eradication Plan

Inputs

AutoEradicate — Set to True to execute the eradication playbook automatically.
EndpointID — The endpoint ID.
FilePath — The file path for the file deletion and for the process termination task.
Username — The username to reset the password for.
FileRemediation — Choose 'Quarantine' or 'Delete' to avoid file remediation conflicts. For example, choosing 'Delete' ignores the 'Quarantine file' task under the containment playbook and executes only file deletion.
UserRemediation — Set to 'True' to reset the user's password.
ProcessTermination — Choose 'PID' to terminate the process using the Process ID, or 'Name' to terminate the process using its name. Please note that providing the file path is mandatory for the process termination. If 'PID' is chosen, the input `ProcessID` should not be empty; otherwise, the termination will not proceed.
ProcessID — The process ID to terminate.

Outputs

TerminatedProcessFromEndpoints — The terminated process from endpoint

Flowchart

Source

playbook-Eradication_Plan.yml playbook-Eradication_Plan_-_Delete_File.yml playbook-Eradication_Plan_-_Delete_File_README.md playbook-Eradication_Plan_-_Reset_Password.yml playbook-Eradication_Plan_-_Reset_Password_README.md playbook-Eradication_Plan_-_Terminate_Process.yml playbook-Eradication_Plan_-_Terminate_Process_README.md

Download History Raw

id: Eradication Plan - Reset Password
version: -1
name: Eradication Plan - Reset Password
description: "This playbook is one of the sub-playbooks in the eradication plan. \nThe playbook executes actions to reset the user's passwords, which is a crucial step in the eradication process."
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 09c31255-cc27-43a6-81db-fb416e7a41fc
    type: start
    task:
      id: 09c31255-cc27-43a6-81db-fb416e7a41fc
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "9"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 150
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: c674cf0c-a189-45a8-88d6-6f39d888ced0
    type: regular
    task:
      id: c674cf0c-a189-45a8-88d6-6f39d888ced0
      version: -1
      name: Auto password reset
      description: Invalidates the password of an Active Directory user.
      script: '|||ad-expire-password'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "13"
    scriptarguments:
      username:
        complex:
          root: ResetPasswordToUsers
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 910
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 83bdf4fd-82e0-41c8-801a-7dacf7cc7cb7
    type: title
    task:
      id: 83bdf4fd-82e0-41c8-801a-7dacf7cc7cb7
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1300
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: ed488801-2746-4d07-8abc-1dfb26c26f70
    type: condition
    task:
      id: ed488801-2746-4d07-8abc-1dfb26c26f70
      version: -1
      name: Is Active Directory Query v2 enabled?
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'.
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "14"
    scriptarguments:
      brandname:
        simple: Active Directory Query v2
    results:
    - brandInstances
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 510
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: 948a893e-2686-482c-8662-cde9931f0644
    type: condition
    task:
      id: 948a893e-2686-482c-8662-cde9931f0644
      version: -1
      name: Should reset the user password?
      description: |+
        Whether to reset the user's password based on the input values.


      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "8"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.UserRemediation
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.Username
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 295
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: 11182b8c-325c-453c-8d1e-6890e1846610
    type: regular
    task:
      id: 11182b8c-325c-453c-8d1e-6890e1846610
      version: -1
      name: Set the user with a password reset to the Incident context
      description: commands.local.cmd.set.parent.incident.context
      script: Builtin|||setParentIncidentContext
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      key:
        simple: UserPasswordReset
      value:
        complex:
          root: ResetPasswordToUsers
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1080
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: 89912e2c-f160-47d2-8ea0-a03d2e7125eb
    type: regular
    task:
      id: 89912e2c-f160-47d2-8ea0-a03d2e7125eb
      version: -1
      name: Set users to reset password
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "1"
    scriptarguments:
      key:
        simple: ResetPasswordToUsers
      value:
        complex:
          root: inputs.Username
          filters:
          - - operator: isNotEqualString
              left:
                value:
                  simple: inputs.Username
                iscontext: true
              right:
                value:
                  simple: Administrator
              ignorecase: true
          transformers:
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 735
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "8_3_#default#": 0.16,
      "9_3_#default#": 0.14
    },
    "paper": {
      "dimensions": {
        "height": 1215,
        "width": 380,
        "x": 450,
        "y": 150
      }
    }
  }
inputs:
- key: UserRemediation
  value:
    simple: "True"
  required: false
  description: Set to 'True' to reset the user's password.
  playbookInputQuery:
- key: Username
  value: {}
  required: false
  description: The username to reset the password for.
  playbookInputQuery:
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.6.0
marketplaces:
- marketplacev2
- platform