id: Containment Plan - Block Indicators
version: -1
name: Containment Plan - Block Indicators
description: |-
  ## Containment Plan - Block Indicators

  This playbook is a sub-playbook within the containment plan playbook.

  ### Indicator Blocking

  The playbook block indicators by two methods:

  1. It adds the malicious hashes into the XSIAM hash block list
  2. It utilizes the sub-playbook "Block Indicators - Generic v3"
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 0eab88db-3b97-46e9-8040-fc0e5ccdd72b
    type: start
    task:
      id: 0eab88db-3b97-46e9-8040-fc0e5ccdd72b
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "3"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 230,
          "y": -190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 42177fdd-e676-4494-8430-473b77c4d326
    type: regular
    task:
      id: 42177fdd-e676-4494-8430-473b77c4d326
      version: -1
      name: Add to XSIAM hash block list
      description: Block lists requested files which have not already been block listed or added to allow list.
      script: '|||core-blocklist-files'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "32"
    scriptarguments:
      comment:
        complex:
          root: alert
          accessor: alertname
      hash_list:
        complex:
          root: foundIncidents.CustomFields
          filters:
          - - operator: isNotEqualString
              left:
                value:
                  simple: foundIncidents.CustomFields.initiatorpath
                iscontext: true
              right:
                value:
                  simple: c:\windows\explorer.exe
              ignorecase: true
          accessor: initiatorsha256
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: inputs.FileHash
                iscontext: true
          - operator: uniq
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 470,
          "y": 590
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 6555f437-9362-4b64-8416-9a207801acc8
    type: title
    task:
      id: 6555f437-9362-4b64-8416-9a207801acc8
      version: -1
      name: Done - Block Indicators
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 690,
          "y": 1710
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: c769a542-379a-42a7-8cb0-325e6b48e2b4
    type: condition
    task:
      id: c769a542-379a-42a7-8cb0-325e6b48e2b4
      version: -1
      name: Should block indicators?
      description: Whether to block the indicators based on the input values.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "25"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.BlockIndicators
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 230,
          "y": -50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: 58da2cac-8a9e-4f4f-88de-623361cde61f
    type: regular
    task:
      id: 58da2cac-8a9e-4f4f-88de-623361cde61f
      version: -1
      name: Set Block list files to the Incident context
      description: commands.local.cmd.set.parent.incident.context
      script: Builtin|||setParentIncidentContext
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "28"
    scriptarguments:
      key:
        simple: BlockedFilesHash
      value:
        complex:
          root: Core.blocklist.added_hashes
          accessor: fileHash
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 470,
          "y": 990
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: 4fb0cfd4-2555-4d5b-844c-c83c447c4a99
    type: regular
    task:
      id: 4fb0cfd4-2555-4d5b-844c-c83c447c4a99
      version: -1
      name: Set Blocked Indicators to the Incident context
      description: commands.local.cmd.set.parent.incident.context
      script: Builtin|||setParentIncidentContext
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      key:
        simple: IndicatorsToBlock
      value:
        complex:
          root: IndicatorsToBlock
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 230,
          "y": 1530
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "24":
    id: "24"
    taskid: df934c6a-4169-41f4-8cbe-76de251da626
    type: condition
    task:
      id: df934c6a-4169-41f4-8cbe-76de251da626
      version: -1
      name: Is file hash exist?
      description: Checks whether the file hash exists.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "28"
      "yes":
      - "1"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: foundIncidents.CustomFields
                accessor: initiatorsha256
            iscontext: true
          right:
            value: {}
        - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.FileHash
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 470,
          "y": 390
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "25":
    id: "25"
    taskid: 56214186-2922-4165-820b-062ad475cf73
    type: condition
    task:
      id: 56214186-2922-4165-820b-062ad475cf73
      version: -1
      name: Should block indicators automatically?
      description: Whether to disable the account automatically based on the input values.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "26"
      "yes":
      - "24"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.AutoContainment
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 230,
          "y": 160
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "26":
    id: "26"
    taskid: 6401c6c9-8ff7-4f49-8676-fd99f48da60f
    type: condition
    task:
      id: 6401c6c9-8ff7-4f49-8676-fd99f48da60f
      version: -1
      name: Is file hash exist?
      description: Checks whether the file hash exists.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "28"
      "yes":
      - "27"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.FileHash
                transformers:
                - operator: uniq
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -10,
          "y": 390
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "27":
    id: "27"
    taskid: fca5352e-ba68-4776-8b35-903387490051
    type: regular
    task:
      id: fca5352e-ba68-4776-8b35-903387490051
      version: -1
      name: Add to XSIAM hash block list
      description: Block lists requested files which have not already been block listed or added to allow list.
      script: '|||core-blocklist-files'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "31"
    scriptarguments:
      comment:
        complex:
          root: alert
          accessor: alertname
      hash_list:
        complex:
          root: inputs.FileHash
          filters:
          - - operator: in
              left:
                value:
                  simple: inputs.FileHash
                iscontext: true
              right:
                value:
                  simple: inputs.FileHash
                iscontext: true
          - - operator: stringHasLength
              left:
                value:
                  simple: inputs.FileHash
                iscontext: true
              right:
                value:
                  simple: "64"
          transformers:
          - operator: uniq
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -10,
          "y": 590
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "28":
    id: "28"
    taskid: 5ba573bb-fbf4-4890-8e63-15376725d187
    type: playbook
    task:
      id: 5ba573bb-fbf4-4890-8e63-15376725d187
      version: -1
      name: Block Indicators - Generic v3
      description: |+
        This playbook blocks malicious indicators using all integrations that are enabled, using the following sub-playbooks:

        - Block URL - Generic v2
        - Block Account - Generic v2
        - Block IP - Generic v3
        - Block File - Generic v2
        - Block Email - Generic v2
        - Block Domain - Generic v2

      playbookName: Block Indicators - Generic v3
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "30"
    scriptarguments:
      AutoBlockIndicators:
        complex:
          root: inputs.AutoBlockIndicators
      AutoCommit:
        simple: "No"
      CustomBlockRule:
        simple: "True"
      CustomURLCategory:
        simple: Demisto Remediation - Malicious URLs
      DomainToBlock:
        complex:
          root: inputs.Domain
      EmailToBlock:
        complex:
          root: DBotScore
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: DBotScore.Type
                iscontext: true
              right:
                value:
                  simple: email
          - - operator: greaterThanOrEqual
              left:
                value:
                  simple: DBotScore.Score
                iscontext: true
              right:
                value:
                  simple: "3"
          accessor: Indicator
          transformers:
          - operator: uniq
      FilesToBlock:
        complex:
          root: DBotScore
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: DBotScore.Type
                iscontext: true
              right:
                value:
                  simple: file
          - - operator: greaterThanOrEqual
              left:
                value:
                  simple: DBotScore.Score
                iscontext: true
              right:
                value:
                  simple: "3"
          accessor: Indicator
          transformers:
          - operator: uniq
      IP:
        complex:
          root: inputs.IP
          transformers:
          - operator: uniq
      InputEnrichment:
        simple: "False"
      MD5:
        complex:
          root: inputs.FileHash
          filters:
          - - operator: stringHasLength
              left:
                value:
                  simple: inputs.FileHash
                iscontext: true
              right:
                value:
                  simple: "32"
          transformers:
          - operator: uniq
      RuleDirection:
        simple: outbound
      RuleName:
        simple: XSOAR - Block Indicators playbook - ${incident.id}
      SHA256:
        complex:
          root: inputs.FileHash
          filters:
          - - operator: stringHasLength
              left:
                value:
                  simple: inputs.FileHash
                iscontext: true
              right:
                value:
                  simple: "64"
          transformers:
          - operator: uniq
      URL:
        complex:
          root: inputs.URL
          transformers:
          - operator: uniq
      UserVerification:
        complex:
          root: inputs.UserVerification
      Username:
        complex:
          root: inputs.Username
          transformers:
          - operator: replace
            args:
              limit: {}
              replaceWith: {}
              toReplace:
                value:
                  simple: inputs.Username
                iscontext: true
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 230,
          "y": 1170
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "29":
    id: "29"
    taskid: cb04e962-15e3-4189-8fcc-73efa9cb71fb
    type: regular
    task:
      id: cb04e962-15e3-4189-8fcc-73efa9cb71fb
      version: -1
      name: Set Block list files to the Incident context
      description: commands.local.cmd.set.parent.incident.context
      script: Builtin|||setParentIncidentContext
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "28"
    scriptarguments:
      key:
        simple: BlockedFilesHash
      value:
        complex:
          root: Core.blocklist.added_hashes
          accessor: fileHash
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -10,
          "y": 990
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "30":
    id: "30"
    taskid: 0a63acdb-6497-4f96-8318-5231aefde427
    type: condition
    task:
      id: 0a63acdb-6497-4f96-8318-5231aefde427
      version: -1
      name: Are there any indicators that are blocked?
      description: Check if there are any indicators that are blocked.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "11"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: IndicatorsToBlock
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 230,
          "y": 1340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "31":
    id: "31"
    taskid: 5e12fc6b-2fa0-43d0-8a46-d2f213525a45
    type: condition
    task:
      id: 5e12fc6b-2fa0-43d0-8a46-d2f213525a45
      version: -1
      name: Is the file hash was added to the block list?
      description: Checks whether the file hash exists.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "28"
      "yes":
      - "29"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: Core.blocklist.added_hashes.fileHash
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -10,
          "y": 780
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "32":
    id: "32"
    taskid: 5df17f17-1825-4ac0-8edf-c0e89f437551
    type: condition
    task:
      id: 5df17f17-1825-4ac0-8edf-c0e89f437551
      version: -1
      name: Is the file hash was added to the block list?
      description: Checks whether the file hash exists.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "28"
      "yes":
      - "10"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: Core.blocklist.added_hashes.fileHash
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 470,
          "y": 780
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "24_1_yes": 0.44,
      "24_28_#default#": 0.24,
      "26_28_#default#": 0.29,
      "30_11_yes": 0.52,
      "30_2_#default#": 0.38,
      "31_29_yes": 0.51,
      "32_10_yes": 0.57,
      "3_25_yes": 0.43,
      "3_2_#default#": 0.12
    },
    "paper": {
      "dimensions": {
        "height": 1965,
        "width": 1080,
        "x": -10,
        "y": -190
      }
    }
  }
inputs:
- key: BlockIndicators
  value:
    simple: "True"
  required: false
  description: Set to 'True' to block the indicators.
  playbookInputQuery:
- key: UserVerification
  value:
    simple: "False"
  required: false
  description: "Possible values: True/False.\nWhether to provide user verification for blocking those IPs. \n\nFalse - No prompt will be displayed to the user.\nTrue - The server will ask the user for blocking verification and will display the blocking list."
  playbookInputQuery:
- key: AutoBlockIndicators
  value:
    simple: "True"
  required: false
  description: |-
    Possible values: True/False.  Default: True.
    Should the given indicators be automatically blocked, or should the user be given the option to choose?

    If set to True - no prompt will appear, and all provided indicators will be blocked automatically.
    If set to False - the user will be prompted to select which indicators to block.
  playbookInputQuery:
- key: FileHash
  value: {}
  required: false
  description: The file hash to block.
  playbookInputQuery:
- key: IP
  value: {}
  required: false
  description: The IP indicators.
  playbookInputQuery:
- key: Domain
  value: {}
  required: false
  description: The domain indicators.
  playbookInputQuery:
- key: URL
  value: {}
  required: false
  description: The URL indicator.
  playbookInputQuery:
- key: Username
  value: {}
  required: false
  description: The username to disable.
  playbookInputQuery:
- key: FilePath
  value: {}
  required: false
  description: The path of the file to block.
  playbookInputQuery:
- key: AutoContainment
  value: {}
  required: false
  description: Whether to execute containment plan automatically.
  playbookInputQuery:
outputs:
- contextPath: Core.blocklist.added_hashes
  description: The file Hash that was added to the blocklist.
tests:
- No tests (auto formatted)
fromversion: 6.6.0
marketplaces:
- marketplacev2
- platform
supportedModules:
- cloud_runtime_security
- xsiam
- edr