Search And Block Software - Generic

This playbook will search a file or process activity of a software by a given image file name. The analyst can then choose the files to block. The following integrations are supported: - Cortex XDR XQL Engine - Microsoft Defender For Endpoint

Common Playbooks · 8 tasks · 3 inputs · 0 outputs

Inputs

  • FileName — File name to search
  • TimeFrame — Time in relative date or range format (for example: "1 day", "3 weeks ago", "between 2021-01-01 12:34:56 +02:00 and 2021-02-01 12:34:56 +02:00"). The default is the last 24 hours.
  • Indicator Expiration — DateTime string indicating when the indicator expires. Format: (<number> <time unit>, e.g., 12 hours, 7 days).

Flowchart

yes Start Start Has filename and timeframe from inputs? Has filename and timefram... Please provide a software name to block and a timeframe Please provide a software... Search And Block Software Search And Block Software Cortex XDR - Search And Block Software - XQL Engine - Cortex XDR - Search And Block Software - XQL Engine Cortex XDR - Search And B... Cortex XDR - Search And Block... Done Done MDE - Search And Block Software - MDE - Search And Block Software MDE - Search And Block So... MDE - Search And Block Software Delete Context - DeleteContext Delete Context DeleteContext