Proactive Threat Hunting - Quarantine File

This playbook will be executed from the “Proactive Threat Hunting” layout button with the objective of quarantining a file specified by the analyst. The following integration is supported: - Cortex XDR IR

Proactive Threat Hunting · 6 tasks · 0 inputs · 0 outputs

Details

IDProactive Threat Hunting - Quarantine File
From Version6.9.0
Tasks6

README

This playbook will be executed from the “Proactive Threat Hunting” layout button with the objective of quarantining a file specified by the analyst. The following integration is supported:

  • Cortex XDR IR

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

This playbook does not use any integrations.

Scripts

  • Print

Commands

  • xdr-file-quarantine

Playbook Inputs

There are no inputs for this playbook.

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Proactive Threat Hunting - Quarantine File

Commands used

xdr-file-quarantine

Flowchart

yes Start Start Print update to notes - Print Print update to notes Print Provide details for file quarantine Provide details for file ... Has file to quarantine? Has file to quarantine? Done Done Quarantine file - xdr-file-quarantine Quarantine file xdr-file-quarantine

Source

playbook-Proactive_Threat_Hunting_-_Quarantine_File.yml
Download History Raw 
id: Proactive Threat Hunting - Quarantine File
version: -1
name: Proactive Threat Hunting - Quarantine File
description: |-
  This playbook will be executed from the “Proactive Threat Hunting” layout button with the objective of quarantining a file specified by the analyst. The following integration is supported:
  - Cortex XDR IR
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 35c489f4-3d7c-4d13-882c-4bbc8fd7c5a1
    type: start
    task:
      id: 35c489f4-3d7c-4d13-882c-4bbc8fd7c5a1
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "2"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 7e850afe-3652-4e16-8e64-76d27b1e5381
    type: regular
    task:
      id: 7e850afe-3652-4e16-8e64-76d27b1e5381
      version: -1
      name: Print update to notes
      description: Prints text to the War Room. (Markdown supported).
      scriptName: Print
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      value:
        simple: Quarantine file procedure has executed. Follow the work plan to continue.
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 180
        }
      }
    note: true
    timertriggers: []
    ignoreworker: false
    fieldMapping:
    - incidentfield: User Block Status
      output:
        simple: Executed
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 224159e0-ec3c-4364-8128-a8f2d37f8641
    type: collection
    task:
      id: 224159e0-ec3c-4364-8128-a8f2d37f8641
      version: -1
      name: Provide details for file quarantine
      description: Asks the analyst to provide the relevant data required for quarantining the file.
      type: collection
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
      subject:
      body:
      methods: []
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: true
        completeaftersla: false
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          simple: Provide endpoint ID
        required: false
        gridcolumns: []
        defaultrows: []
        type: shortText
        options: []
        optionsarg:
        - {}
        - complex:
            root: incident
            accessor: affectedusers
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      - id: "1"
        label: ""
        labelarg:
          simple: Provide file path
        required: false
        gridcolumns: []
        defaultrows: []
        type: shortText
        options: []
        optionsarg: []
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      - id: "2"
        label: ""
        labelarg:
          simple: Provide file SHA256 hash
        required: false
        gridcolumns: []
        defaultrows: []
        type: shortText
        options: []
        optionsarg: []
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      title: Provide details for file quarantine
      description: ""
      sender: ""
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: 7e70a140-5c50-439e-80de-e80725223c92
    type: condition
    task:
      id: 7e70a140-5c50-439e-80de-e80725223c92
      version: -1
      name: Has file to quarantine?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "6"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: Provide details for file quarantine.Answers
                accessor: "0"
            iscontext: true
          right:
            value: {}
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: Provide details for file quarantine.Questions
                accessor: "1"
            iscontext: true
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: Provide details for file quarantine.Answers
                accessor: "2"
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 500
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: e171a237-98a4-4a7f-8a18-4ced40b8491d
    type: title
    task:
      id: e171a237-98a4-4a7f-8a18-4ced40b8491d
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 840
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: 3d38dd61-7381-44d2-82b5-3d880f9cc271
    type: regular
    task:
      id: 3d38dd61-7381-44d2-82b5-3d880f9cc271
      version: -1
      name: Quarantine file
      description: Quarantines a file on selected endpoints. You can select up to 1000 endpoints.
      script: '|||xdr-file-quarantine'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      endpoint_id_list:
        complex:
          root: Provide details for file quarantine.Questions
          accessor: "0"
      file_hash:
        complex:
          root: Provide details for file quarantine.Answers
          accessor: "2"
      file_path:
        complex:
          root: Provide details for file quarantine.Answers
          accessor: "1"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 890,
          "y": 670
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "4_5_#default#": 0.55
    },
    "paper": {
      "dimensions": {
        "height": 855,
        "width": 820,
        "x": 450,
        "y": 50
      }
    }
  }
inputs: []
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.9.0