KillProcessWrapper
A cross-vendor wrapper script that triggers a ‘process kill’ command - i.e executes the proper kill process command according to the vendor: CrowdstrikeFalcon or Cortex XDR. The script will only fail when the kill process action fails for both vendors.
python · Malware Investigation and Response
Details
| ID | KillProcessWrapper |
|---|---|
| Language | python |
| From Version | 6.1.0 |
| Docker Image | demisto/python3:3.12.13.10404775 |
README
A cross-vendor wrapper script that triggers a process kill command - i.e executes the proper kill process command according to the vendor: CrowdstrikeFalcon or Cortex XDR.
The script will only fail when the kill process action fails for both vendors.
Script Data
| Name | Description |
|---|---|
| Script Type | python3 |
| Cortex XSOAR Version | 6.1.0 |
Inputs
| Argument Name | Description |
|---|---|
| endpoint_id | The Endpoint ID in which you would like to kill the given process. |
| process_id | The ID of the process to kill. Either the process_id or the process_name must be specified. |
| process_name | The name of the process to kill. Either the process_id or the process_name must be specified. |
| approve_action | Are you sure you want to kill this process? |
Outputs
| Path | Description | Type |
|---|---|---|
| CrowdStrike.Command.kill | The outputs of the CrowdStrike kill process command. | List |
| CrowdStrike.Command.kill.Error | The status of the CrowdStrike kill process command. | String |
| CrowdStrike.Command.kill.HostID | The endpoint ID of the process. | String |
| CrowdStrike.Command.kill.ProcessID | The ID of the process. | String |
| PaloAltoNetworksXDR.ScriptRun | The outputs of the Cortex XDR kill process command. | List |
| PaloAltoNetworksXDR.ScriptRun.action_id | The ID of the kill process action initiated. | Number |
| PaloAltoNetworksXDR.ScriptRun.endpoints_count | The number of endpoints the action was initiated on. | Number |
| PaloAltoNetworksXDR.ScriptRun.status | The status of the kill process action. | Number |
args: - description: The Endpoint ID in which you would like to kill the given process. name: endpoint_id required: true - description: The ID of the process to kill. Either the process_id or the process_name must be specified. name: process_id - description: The name of the process to kill. Either the process_id or the process_name must be specified. name: process_name - auto: PREDEFINED description: Are you sure you want to kill this process? name: approve_action predefined: - 'YES' - 'NO' required: true comment: 'A cross-vendor wrapper script that triggers a ‘process kill’ command - i.e executes the proper kill process command according to the vendor: CrowdstrikeFalcon or Cortex XDR. The script will only fail when the kill process action fails for both vendors.' commonfields: id: KillProcessWrapper version: -1 name: KillProcessWrapper outputs: - contextPath: CrowdStrike.Command.kill description: The outputs of the CrowdStrike kill process command. type: List - contextPath: CrowdStrike.Command.kill.Error description: The status of the CrowdStrike kill process command. type: String - contextPath: CrowdStrike.Command.kill.HostID description: The endpoint ID of the process. type: String - contextPath: CrowdStrike.Command.kill.ProcessID description: The ID of the process. type: String - contextPath: PaloAltoNetworksXDR.ScriptRun description: The outputs of the Cortex XDR kill process command. type: List - contextPath: PaloAltoNetworksXDR.ScriptRun.action_id description: The ID of the kill process action initiated. type: Number - contextPath: PaloAltoNetworksXDR.ScriptRun.endpoints_count description: The number of endpoints the action was initiated on. type: Number - contextPath: PaloAltoNetworksXDR.ScriptRun.status description: The status of the kill process action. type: Number script: '-' subtype: python3 timeout: '0' type: python dockerimage: demisto/python3:3.12.13.10404775 tests: - No tests (auto formatted) fromversion: 6.1.0