Recovery Plan

This playbook handles all the recovery actions available with Cortex XSIAM, including the following tasks: * Unisolate endpoint * Restore quarantined file Note: The playbook inputs enable manipulating the execution flow; read the input descriptions for details.

Common Playbooks · 6 tasks · 4 inputs · 0 outputs

Details

ID	`Recovery Plan`
From Version	6.6.0
Tasks	6

README

This playbook handles all the recovery actions available with Cortex XSIAM, including the following tasks:

Unisolate endpoint
Restore quarantined file

Note: The playbook inputs enable manipulating the execution flow; read the input descriptions for details.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

This playbook does not use any integrations.

Scripts

This playbook does not use any scripts.

Commands

core-unisolate-endpoint
core-restore-file

Playbook Inputs

Name	Description	Default Value	Required
unIsolateEndpoint	Set to True to cancel the endpoint isolation.	True	Optional
releaseFile	Set to True to release the quarantined file.	False	Optional
endpointID	The endpoint ID.		Optional
FileHash	The file hash.		Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Recovery Plan

Inputs

unIsolateEndpoint — Set to True to cancel the endpoint isolation.
releaseFile — Set to True to release the quarantined file.
endpointID — The endpoint ID.
FileHash — The file hash.

Commands used

core-restore-file core-unisolate-endpoint

Flowchart

Source

playbook-Recovery_Plan.yml

Download History Raw

id: Recovery Plan
version: -1
name: Recovery Plan
description: |-
  This playbook handles all the recovery actions available with Cortex XSIAM, including the following tasks:
  * Unisolate endpoint
  * Restore quarantined file

  Note: The playbook inputs enable manipulating the execution flow; read the input descriptions for details.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 6664776c-7209-42a0-8272-5f7f66756511
    type: start
    task:
      id: 6664776c-7209-42a0-8272-5f7f66756511
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
      - "4"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 40
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 82bb4625-493c-4e79-8ba2-9ded7a609000
    type: condition
    task:
      id: 82bb4625-493c-4e79-8ba2-9ded7a609000
      version: -1
      name: Should unisolate the endpoint?
      description: Whether to unisolate the endpoint.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "2"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.unIsolateEndpoint
            iscontext: true
          right:
            value:
              simple: "true"
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 170,
          "y": 200
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: f44d89fc-f4c3-4c8b-84f1-c219fe4544ad
    type: regular
    task:
      id: f44d89fc-f4c3-4c8b-84f1-c219fe4544ad
      version: -1
      name: Unisolate endpoint
      description: Reverses the isolation of an endpoint.
      script: '|||core-unisolate-endpoint'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      endpoint_id:
        complex:
          root: inputs.endpointID
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 170,
          "y": 400
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 10b17a6b-93a9-4d5a-8d84-7950f294732a
    type: title
    task:
      id: 10b17a6b-93a9-4d5a-8d84-7950f294732a
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 570
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: 1f8e95ae-1cf7-44c0-896b-576fb895a635
    type: condition
    task:
      id: 1f8e95ae-1cf7-44c0-896b-576fb895a635
      version: -1
      name: Should restore the quarantined file?
      description: Whether to restore the quarantined file.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "5"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.releaseFile
            iscontext: true
          right:
            value:
              simple: "true"
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 730,
          "y": 200
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: 80ff52ba-235e-49e9-8813-e4f79b1bd407
    type: regular
    task:
      id: 80ff52ba-235e-49e9-8813-e4f79b1bd407
      version: -1
      name: Restore file
      description: Restores a quarantined file on requested endpoints.
      script: '|||core-restore-file'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      endpoint_id:
        complex:
          root: inputs.endpointID
      file_hash:
        complex:
          root: inputs.FileHash
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 730,
          "y": 400
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "1_2_yes": 0.51,
      "1_3_#default#": 0.54,
      "4_3_#default#": 0.54,
      "4_5_yes": 0.43
    },
    "paper": {
      "dimensions": {
        "height": 595,
        "width": 940,
        "x": 170,
        "y": 40
      }
    }
  }
inputs:
- key: unIsolateEndpoint
  value:
    simple: "true"
  required: false
  description: Set to True to cancel the endpoint isolation.
  playbookInputQuery:
- key: releaseFile
  value:
    simple: "false"
  required: false
  description: Set to True to release the quarantined file.
  playbookInputQuery:
- key: endpointID
  value: {}
  required: false
  description: The endpoint ID.
  playbookInputQuery:
- key: FileHash
  value: {}
  required: false
  description: The file hash.
  playbookInputQuery:
outputs: []
tests:
- No tests (auto formatted)
marketplaces:
- marketplacev2
- platform
- xpanse
fromversion: 6.6.0
supportedModules:
- cloud_runtime_security
- xsiam
- edr