Recovery Plan

This playbook handles all the recovery actions available with Cortex XSIAM, including the following tasks: * Unisolate endpoint * Restore quarantined file Note: The playbook inputs enable manipulating the execution flow; read the input descriptions for details.

Common Playbooks · 6 tasks · 4 inputs · 0 outputs

Inputs

  • unIsolateEndpoint — Set to True to cancel the endpoint isolation.
  • releaseFile — Set to True to release the quarantined file.
  • endpointID — The endpoint ID.
  • FileHash — The file hash.

Commands used

core-restore-file core-unisolate-endpoint

Flowchart

yes yes Start Start Should unisolate the endpoint? Should unisolate the endp... Unisolate endpoint - core-unisolate-endpoint Unisolate endpoint core-unisolate-endpoint Done Done Should restore the quarantined file? Should restore the quaran... Restore file - core-restore-file Restore file core-restore-file