id: Block File - Cylance Protect v2
version: -1
contentitemexportablefields:
  contentitemfields: {}
name: Block File - Cylance Protect v2
description: This playbook accepts a SHA256 hash and adds the hash to the Global Quarantine
  list using the Cylance Protect v2 integration.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 5e4385e3-76c2-48e2-80a4-c3798cdae027
    type: start
    task:
      id: 5e4385e3-76c2-48e2-80a4-c3798cdae027
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "6"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "6":
    id: "6"
    taskid: df41aaaa-8055-4c59-8e9e-a167a7ef7819
    type: condition
    task:
      id: df41aaaa-8055-4c59-8e9e-a167a7ef7819
      version: -1
      name: Is Cylance Protect v2 enabled?
      description: Checks if Cylance Protect is enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "8"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Cylance Protect v2
                    ignorecase: true
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                    ignorecase: true
                accessor: brand
            iscontext: true
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 265,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "8":
    id: "8"
    taskid: 9b14005e-903d-4724-80ec-84e7c42a9e7b
    type: condition
    task:
      id: 9b14005e-903d-4724-80ec-84e7c42a9e7b
      version: -1
      name: Is there a SHA256 to block?
      description: Checks if there is a value for the SHA256 input field. This task
        does not verify that the value is actually a SHA256 hash, just that the value
        for the field exists.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "10"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.SHA256
            iscontext: true
    view: |-
      {
        "position": {
          "x": 510,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "9":
    id: "9"
    taskid: 2c14bf01-7fd9-45f8-8554-86d0c1332d81
    type: title
    task:
      id: 2c14bf01-7fd9-45f8-8554-86d0c1332d81
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 710
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "10":
    id: "10"
    taskid: 4c4a1221-1c33-4b3f-8ada-96df4d7069c0
    type: regular
    task:
      id: 4c4a1221-1c33-4b3f-8ada-96df4d7069c0
      version: -1
      name: Add hash to Global Quarantine list
      description: Adds a convicted threat for a particular tenant to either the Global
        Quarantine list or the Global Safe list.
      script: '|||cylance-protect-add-hash-to-list'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      listType:
        complex:
          root: inputs.ListType
      sha256:
        complex:
          root: inputs.SHA256
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 770,
          "y": 540
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
system: true
view: |-
  {
    "linkLabelsPosition": {
      "6_9_#default#": 0.64,
      "8_9_#default#": 0.32
    },
    "paper": {
      "dimensions": {
        "height": 725,
        "width": 885,
        "x": 265,
        "y": 50
      }
    }
  }
inputs:
- key: SHA256
  value:
    complex:
      root: File
      filters:
      - - operator: isExists
          left:
            value:
              simple: File.Malicious
            iscontext: true
      accessor: SHA256
      transformers:
      - operator: uniq
  required: false
  description: The SHA256 hash of the file to block.
  playbookInputQuery:
- key: ListType
  value:
    simple: GlobalQuarantine
  required: false
  description: The list type to which the threat belongs. Can be "GlobalQuarantine" or "GlobalSafe".
  playbookInputQuery:
outputs:
- contextPath: CbResponse.BlockedHashes.LastBlock.Time
  description: Last block time
- contextPath: CbResponse.BlockedHashes.LastBlock.Hostname
  description: Last block hostname
- contextPath: CbResponse.BlockedHashes.LastBlock.CbSensorID
  description: Last block sensor ID
tests:
- No test
fromversion: 5.0.0