MDE - Search And Block Software

id: MDE - Search And Block Software
version: -1
name: MDE - Search And Block Software
description: This playbook will search a file or process activity of a software by a given image file name using Microsoft Defender For Endpoint. The analyst can then choose the files to block.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: e2462455-b6f1-4456-847a-8d2cbfe68e11
    type: start
    task:
      id: e2462455-b6f1-4456-847a-8d2cbfe68e11
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "31"
      - "32"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 440,
          "y": -330
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: f16ed52e-b396-43c3-85e0-74ca45de4ce0
    type: condition
    task:
      id: f16ed52e-b396-43c3-85e0-74ca45de4ce0
      version: -1
      name: Has query results?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "26"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: MicrosoftATP.Hunt
                accessor: Result
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 990,
          "y": 520
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: 2b9111c4-c7f3-4aff-8722-cb0e0de16aa9
    type: title
    task:
      id: 2b9111c4-c7f3-4aff-8722-cb0e0de16aa9
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 440,
          "y": 2390
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: 7ed6724b-75d4-45c8-8a3d-e39ffa900e22
    type: regular
    task:
      id: 7ed6724b-75d4-45c8-8a3d-e39ffa900e22
      version: -1
      name: delete context - XDR Results
      description: |-
        Delete field from context.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: DeleteContext
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "21"
    scriptarguments:
      key:
        simple: PaloAltoNetworksXQL
      subplaybook:
        simple: "yes"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 740,
          "y": 1890
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: 204f5af9-ee11-4c34-8429-3d0cc19a3685
    type: condition
    task:
      id: 204f5af9-ee11-4c34-8429-3d0cc19a3685
      version: -1
      name: Has software name and timeframe from input?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "15"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.Filename
            iscontext: true
          right:
            value: {}
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.TimeFrame
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 740,
          "y": 170
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: acdbc23e-ea80-4a6f-86a6-b210df33031d
    type: regular
    task:
      id: acdbc23e-ea80-4a6f-86a6-b210df33031d
      version: -1
      name: Execute KQL query to search software
      description: 'Allows you to run programmatic queries like in Microsoft Defender ATP Portal (https://securitycenter.windows.com/hunting). Limitations: You can only run a query on data from the last 30 days. The results include a maximum of 10,000 rows. The number of executions is limited (up to 15 calls per minute, 15 minutes of running time every hour and 4 hours of running time a day).'
      script: '|||microsoft-atp-advanced-hunting'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      query:
        simple: |-
          DeviceProcessEvents
          | where FileName in~ ("${inputs.Filename}")
          | project FileName, ProcessCreationTime, DeviceName, FolderPath, SHA256
      time_range:
        complex:
          root: inputs.TimeFrame
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 990,
          "y": 350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "16":
    id: "16"
    taskid: e1cad07d-ecc9-448d-8dfe-1b414f4d1f2b
    type: collection
    task:
      id: e1cad07d-ecc9-448d-8dfe-1b414f4d1f2b
      version: -1
      name: Would you like to block the files found?
      type: collection
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "17"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1220,
          "y": 850
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
      subject:
      body:
      methods: []
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: true
        completeaftersla: false
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          simple: Would you like to block the files found?
        required: false
        gridcolumns: []
        defaultrows: []
        type: singleSelect
        options: []
        optionsarg:
        - simple: Yes - All
        - simple: Yes - Choose specific files
        - simple: "No"
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      title: Would you like to block the files found?
      description: ""
      sender: ""
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "17":
    id: "17"
    taskid: 0d2ff43d-695e-4cac-8dad-b19811c882e6
    type: condition
    task:
      id: 0d2ff43d-695e-4cac-8dad-b19811c882e6
      version: -1
      name: Block the files?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "6"
      Yes - Choose specific files:
      - "18"
      "yes":
      - "19"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: Would you like to block the files found?.Answers
                accessor: "0"
            iscontext: true
          right:
            value:
              simple: "Yes"
          ignorecase: true
    - label: Yes - Choose specific files
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: Would you like to block the files found?.Answers
                accessor: "0"
            iscontext: true
          right:
            value:
              simple: Yes - Choose specific files
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1220,
          "y": 1020
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "18":
    id: "18"
    taskid: d901ba98-06ad-476a-8bfc-13a7984e9b35
    type: collection
    task:
      id: d901ba98-06ad-476a-8bfc-13a7984e9b35
      version: -1
      name: Choose specific files to block
      type: collection
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "24"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1650,
          "y": 1200
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
      subject:
      body:
      methods: []
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: true
        completeaftersla: false
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          simple: Choose specific files to block
        required: false
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: MicrosoftATP.Hunt.Result
            accessor: FolderPath
        - {}
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      title: Choose specific files to block
      description: ""
      sender: ""
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "19":
    id: "19"
    taskid: e1a29a81-6e8b-4964-8378-317d6da13486
    type: regular
    task:
      id: e1a29a81-6e8b-4964-8378-317d6da13486
      version: -1
      name: Set Indicators To Block
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "29"
    scriptarguments:
      key:
        simple: IndicatorsToBlock
      value:
        complex:
          root: MicrosoftATP.Hunt.Result
          accessor: SHA256
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1220,
          "y": 1200
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "21":
    id: "21"
    taskid: dbca7f71-0386-4a09-82b3-7127aa1272d3
    type: regular
    task:
      id: dbca7f71-0386-4a09-82b3-7127aa1272d3
      version: -1
      name: delete context - Indicators To block
      description: |-
        Delete field from context.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: DeleteContext
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "27"
    scriptarguments:
      key:
        simple: PaloAltoNetworksXQL
      subplaybook:
        simple: "yes"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 740,
          "y": 2055
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "23":
    id: "23"
    taskid: 0eeeff57-dc6a-48f0-828f-2742507e80f2
    type: regular
    task:
      id: 0eeeff57-dc6a-48f0-828f-2742507e80f2
      version: -1
      name: Set Indicators To Block - Process
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "29"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: IndicatorsToBlock
      value:
        complex:
          root: MicrosoftATP.Hunt.Result
          filters:
          - - operator: in
              left:
                value:
                  simple: MicrosoftATP.Hunt.Result.FolderPath
                iscontext: true
              right:
                value:
                  simple: Choose specific files to block.Answers.0
                iscontext: true
              ignorecase: true
          accessor: SHA256
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1650,
          "y": 1540
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "24":
    id: "24"
    taskid: 04f5195a-5602-41dd-8161-23a159aabede
    type: condition
    task:
      id: 04f5195a-5602-41dd-8161-23a159aabede
      version: -1
      name: Has relevant files to block?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "29"
      "yes":
      - "23"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: Choose specific files to block.Answers
                accessor: "0"
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1650,
          "y": 1360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "26":
    id: "26"
    taskid: 4252ff7c-9f2f-4ad0-8dfa-f2a5ac8227b4
    type: regular
    task:
      id: 4252ff7c-9f2f-4ad0-8dfa-f2a5ac8227b4
      version: -1
      name: Set query results to layout
      description: Accepts a JSON object and returns a markdown.
      scriptName: JsonToTable
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "16"
    scriptarguments:
      extend-context:
        simple: customquerymarkdown=
      value:
        complex:
          root: MicrosoftATP.Hunt
          accessor: Result
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1220,
          "y": 690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    fieldMapping:
    - incidentfield: Custom Query Results
      output:
        simple: ${customquerymarkdown}
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "27":
    id: "27"
    taskid: 73d00fa3-bca8-4100-874a-97f8bfebc839
    type: regular
    task:
      id: 73d00fa3-bca8-4100-874a-97f8bfebc839
      version: -1
      name: Delete context - markdown
      description: |-
        Delete field from context.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: DeleteContext
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      key:
        simple: customquerymarkdown
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 740,
          "y": 2220
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "29":
    id: "29"
    taskid: 716ee229-5da3-412b-8867-4d7dcd3b94bc
    type: regular
    task:
      id: 716ee229-5da3-412b-8867-4d7dcd3b94bc
      version: -1
      name: Block indicators
      description: Creates a new indicator.
      script: '|||microsoft-atp-sc-indicator-create'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      action:
        simple: Block
      expiration_time:
        complex:
          root: inputs.Indicator Expiration
      indicator_description:
        complex:
          root: inputs.Defender Indicator Title
      indicator_title:
        complex:
          root: inputs.Defender Indicator Title
      indicator_type:
        simple: FileSha256
      indicator_value:
        complex:
          root: IndicatorsToBlock
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1220,
          "y": 1710
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "30":
    id: "30"
    taskid: 34b5f859-aa10-48cf-8f28-41ee793c6d73
    type: condition
    task:
      id: 34b5f859-aa10-48cf-8f28-41ee793c6d73
      version: -1
      name: Is Defender For Endpoint enabled?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "4"
      "yes":
      - "14"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Microsoft Defender Advanced Threat Protection
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                    ignorecase: true
                accessor: brand
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 440,
          "y": 0
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "31":
    id: "31"
    taskid: d56940ed-4d06-417b-8025-ad1efff4c0ad
    type: regular
    task:
      id: d56940ed-4d06-417b-8025-ad1efff4c0ad
      version: -1
      name: Delete context to avoid duplications - customquerymarkdown
      description: |-
        Delete field from context.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: DeleteContext
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "30"
    scriptarguments:
      key:
        simple: customquerymarkdown
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 640,
          "y": -180
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "32":
    id: "32"
    taskid: 66aa84a3-2c01-473f-8346-29a174cdae15
    type: regular
    task:
      id: 66aa84a3-2c01-473f-8346-29a174cdae15
      version: -1
      name: Delete context to avoid duplications - MicrosoftATP
      description: |-
        Delete field from context.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: DeleteContext
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "30"
    scriptarguments:
      key:
        simple: MicrosoftATP
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 250,
          "y": -180
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
system: true
view: |-
  {
    "linkLabelsPosition": {
      "14_6_#default#": 0.14,
      "17_18_Yes - Choose specific files": 0.52,
      "17_6_#default#": 0.25,
      "24_29_#default#": 0.9,
      "3_26_yes": 0.54,
      "3_6_#default#": 0.15
    },
    "paper": {
      "dimensions": {
        "height": 2785,
        "width": 1780,
        "x": 250,
        "y": -330
      }
    }
  }
inputs:
- key: Filename
  value: {}
  required: false
  description: File name to search
  playbookInputQuery:
- key: TimeFrame
  value: {}
  required: false
  description: 'Time in relative date or range format (for example: "1 day", "3 weeks ago", "between 2021-01-01 12:34:56 +02:00 and 2021-02-01 12:34:56 +02:00"). The default is the last 24 hours.'
  playbookInputQuery:
- key: Defender Indicator Title
  value:
    simple: XSOAR Software Block
  required: false
  description: The indicator alert title in Defender.
  playbookInputQuery:
- key: Indicator Expiration
  value: {}
  required: false
  description: 'DateTime string indicating when the indicator expires. Format: (<number> <time unit>, e.g., 12 hours, 7 days).'
  playbookInputQuery:
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.9.0