Eradication Plan

This playbook handles all the eradication actions available with Cortex XSIAM, including the following sub-playbooks: * Eradication Plan - Reset user password * Eradication Plan - Delete file * Eradication Plan - Kill process (currently, the playbook supports terminating a process by name) Note: The playbook inputs enable manipulating the execution flow. Read the input descriptions for details.

Common Playbooks · 13 tasks · 8 inputs · 1 output

Details

IDEradication Plan
From Version6.6.0
Tasks13

README

This playbook handles all the eradication actions available with Cortex XSIAM, including the following sub-playbooks:

  • Eradication Plan - Reset user password
  • Eradication Plan - Delete file
  • Eradication Plan - Kill process (currently, the playbook supports terminating a process by name)

Note: The playbook inputs enable manipulating the execution flow. Read the input descriptions for details.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • Eradication Plan - Terminate Process
  • Eradication Plan - Reset Password
  • Eradication Plan - Delete File

Integrations

This playbook does not use any integrations.

Scripts

  • Set

Commands

This playbook does not use any commands.

Playbook Inputs

Name Description Default Value Required
AutoEradicate Set to True to execute the eradication playbook automatically. True Optional
EndpointID The endpoint ID. alert.agentid Optional
FilePath The file path for the file deletion and for the process termination task. foundIncidents.CustomFields.initiatorpath Optional
Username The username to reset the password for. foundIncidents.CustomFields.username Optional
FileRemediation Choose ‘Quarantine’ or ‘Delete’ to avoid file remediation conflicts.
For example, choosing ‘Delete’ ignores the ‘Quarantine file’ task under the containment playbook and executes only file deletion.		 Delete Optional
UserRemediation Set to ‘True’ to reset the user’s password. True Optional
ProcessTermination Choose ‘PID’ to terminate the process using the Process ID, or ‘Name’ to terminate the process using its name.
Please note that providing the file path is mandatory for the process termination.
If ‘PID’ is chosen, the input `ProcessID` should not be empty; otherwise, the termination will not proceed.		 Name Optional
ProcessID The process ID to terminate.   Optional

Playbook Outputs

Path Description Type
TerminatedProcessFromEndpoints The terminated process from endpoint unknown

Playbook Image

Eradication Plan

Inputs

  • AutoEradicate — Set to True to execute the eradication playbook automatically.
  • EndpointID — The endpoint ID.
  • FilePath — The file path for the file deletion and for the process termination task.
  • Username — The username to reset the password for.
  • FileRemediation — Choose 'Quarantine' or 'Delete' to avoid file remediation conflicts. For example, choosing 'Delete' ignores the 'Quarantine file' task under the containment playbook and executes only file deletion.
  • UserRemediation — Set to 'True' to reset the user's password.
  • ProcessTermination — Choose 'PID' to terminate the process using the Process ID, or 'Name' to terminate the process using its name. Please note that providing the file path is mandatory for the process termination. If 'PID' is chosen, the input `ProcessID` should not be empty; otherwise, the termination will not proceed.
  • ProcessID — The process ID to terminate.

Outputs

  • TerminatedProcessFromEndpoints — The terminated process from endpoint

Flowchart

yes yes Start Start Which eradication actions would you like to perform? Which eradication actions... Eradication Eradication Should Eradicate automatically? Should Eradicate automati... Eradication Plan - Delete File - Eradication Plan - Delete File Eradication Plan - Delete... Eradication Plan - Delete File Eradication Plan - Reset Password - Eradication Plan - Reset Password Eradication Plan - Reset ... Eradication Plan - Reset Pass... Eradication Plan - Terminate Process - Eradication Plan - Terminate Process Eradication Plan - Termin... Eradication Plan - Terminate ... Reset Password Reset Password Delete File Delete File Terminate Process Terminate Process Done Done Set Process list - Set Set Process list Set The file path and PID defined? The file path and PID def...

Source

playbook-Eradication_Plan.yml playbook-Eradication_Plan_-_Delete_File.yml playbook-Eradication_Plan_-_Delete_File_README.md playbook-Eradication_Plan_-_Reset_Password.yml playbook-Eradication_Plan_-_Reset_Password_README.md playbook-Eradication_Plan_-_Terminate_Process.yml playbook-Eradication_Plan_-_Terminate_Process_README.md
Download History Raw 
This playbook is one of the sub-playbooks in the eradication plan. 
This playbook handles the termination of the processes as a crucial step in the eradication action.
The playbook executes actions of process termination, which is a crucial step in the eradication process.
The process termination can be performed based on either the process ID or the process name.

## Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

### Sub-playbooks

This playbook does not use any sub-playbooks.

### Integrations

This playbook does not use any integrations.

### Scripts

* PrintErrorEntry
* Set

### Commands

* setParentIncidentContext
* core-run-script-execute-commands
* core-get-script-execution-results
* core-run-script-kill-process

## Playbook Inputs

---

| **Name** | **Description** | **Default Value** | **Required** |
| --- | --- | --- | --- |
| ProcessTermination | Choose 'PID' to terminate the process by PID or 'Name' to terminate the process by process name. <br/>Note: If neither option is selected, the process will not be terminated. | Name | Optional |
| EndpointID | The endpoint ID to run commands over. |  | Optional |
| FilePath | The file path for the process termination. |  | Optional |
| ProcessID | The process ID to terminate. |  | Optional |

## Playbook Outputs

---

| **Path** | **Description** | **Type** |
| --- | --- | --- |
| TerminatedProcessFromEndpoints | The terminated process from endpoint | unknown |

## Playbook Image

---

![Eradication Plan - Terminate Process](../doc_files/Eradication_Plan_-_Terminate_Process.png)