quarantine-file

This script executes the 'quarantine-file' command on a specified file via the appropriate agent. This script is used to isolate files identified as suspicious. Currently supported brands are "Cortex XDR - IR", "Cortex Core - IR", and "Microsoft Defender Advanced Threat Protection".

python · Aggregated Scripts

Details

ID	`quarantine-file`
Language	python
From Version	6.10.0
Docker Image	`demisto/python3:3.12.13.10404775`

README

This script executes the ‘quarantine-file’ command on a specified file via the appropriate agent. This script is used to isolate files identified as suspicious.

Script Data

Name	Description
Script Type	python3
Cortex XSOAR Version	6.10.0

Inputs

Argument Name	Description
endpoint_id	List of endpoint IDs.
file_hash	The hash of the file to quarantine. Supported types are: SHA256, SHA1.
file_path	The path of the file to quarantine.
timeout	The polling timeout in seconds for the quarantine commands. The default is 300.
brands	Brands for which to execute the ‘quarantine-file’ command. If not specified, all available instances will run.
verbose	Whether to retrieve a human-readable entry for every command. When set to false, human-readable will only summarize the final result.

Outputs

Path	Description	Type
QuarantineFile.FilePath	The path of the quarantined file.	String
QuarantineFile.FileHash	The hash of the quarantined file.	String
QuarantineFile.Status	Whether the command execution was successful or not.	String
QuarantineFile.Message	A success message if the command runs successfully, otherwise a message that contains the error.	String
QuarantineFile.Brand	The integration that executed the command. On the Cortex Platform, the Cortex Core action runs as a Builtin command and is reported as “Cortex Builtin”.	String
QuarantineFile.EndpointID	The endpoint_id which the command was executed on.	String

Source

QuarantineFile.py QuarantineFile_test.py QuarantineFile.yml

Download History Raw

commonfields:
  id: quarantine-file
  version: -1
args:
- name: endpoint_id
  description: List of endpoint IDs.
  required: true
  isArray: true
- name: file_hash
  description: The hash of the file to quarantine. Supported types are SHA256, SHA1.
  required: true
- name: file_path
  description: The path of the file to quarantine.
  required: false
- name: timeout
  description: The polling timeout in seconds for the quarantine commands. The default is 300.
  required: false
  defaultValue: 300
- name: brands
  description: |-
    A comma-separated list of brands for which to execute the 'quarantine-file' command. If not specified, all available instances will run.
    Currently supported brands are: "Cortex XDR - IR", "Cortex Core - IR", "Microsoft Defender Advanced Threat Protection".
  isArray: true
  auto: PREDEFINED
  predefined:
  - "Cortex XDR - IR"
  - "Cortex Core - IR"
  - "Microsoft Defender Advanced Threat Protection"
- name: verbose
  description: Whether to retrieve a human-readable entry for every command. When set to false, human-readable will only summarize the final result.
  auto: PREDEFINED
  predefined:
  - 'true'
  - 'false'
  defaultValue: 'false'
- name: completed_results
  description: A list of completed jobs before quarantine (automatically filled by polling).
  deprecated: true
- name: pending_jobs
  description: A list of jobs for which to poll quarantine status (automatically filled by polling).
  deprecated: true
comment: This script executes the 'quarantine-file' command on a specified file via the appropriate agent. This script is used to isolate files identified as suspicious. Currently supported brands are "Cortex XDR - IR", "Cortex Core - IR", and "Microsoft Defender Advanced Threat Protection".
name: quarantine-file
supportedModules:
- agentix
- cloud
- cloud_runtime_security
- edr
- xsiam
outputs:
- contextPath: QuarantineFile.FilePath
  description: The path of the quarantined file.
  type: String
- contextPath: QuarantineFile.FileHash
  description: The hash of the quarantined file.
  type: String
- contextPath: QuarantineFile.Status
  description: Whether the command execution was successful or not.
  type: String
- contextPath: QuarantineFile.Message
  description: A success message if the command runs successfully, otherwise a message that contains the error.
  type: String
- contextPath: QuarantineFile.Brand
  description: The integration that executed the command. On the Cortex platform, the Core action runs as a Builtin command and is reported as "Cortex Builtin".
  type: String
- contextPath: QuarantineFile.EndpointID
  description: The endpoint_id which the command was executed on.
  type: String
script: '-'
timeout: '0'
type: python
subtype: python3
compliantpolicies:
- Quarantine File
dockerimage: demisto/python3:3.12.13.10404775
fromversion: 6.10.0
polling: true
tests:
- QuarantineFile-Test