id: Containment Plan - Quarantine File version: -1 name: Containment Plan - Quarantine File description: |- ## Containment Plan - Quarantine File This playbook is a sub-playbook within the containment plan playbook. The playbook quarantines files using core commands. starttaskid: "0" tasks: "0": id: "0" taskid: 0c4f76b8-840e-49d6-83ea-28853fed1128 type: start task: id: 0c4f76b8-840e-49d6-83ea-28853fed1128 version: -1 name: "" iscommand: false brand: "" description: '' nexttasks: '#none#': - "17" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -40, "y": -369 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "2": id: "2" taskid: 397f4b57-3b4f-40ed-8871-59fb281d5a77 type: title task: id: 397f4b57-3b4f-40ed-8871-59fb281d5a77 version: -1 name: Done type: title iscommand: false brand: "" description: '' separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -254, "y": 1026 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "7": id: "7" taskid: a0ceb1ef-9c66-4295-8ab8-8ff9b8cbbf2f type: regular task: id: a0ceb1ef-9c66-4295-8ab8-8ff9b8cbbf2f version: -1 name: Get file quarantine status description: Retrieves the quarantine status for a selected file. script: '|||core-get-quarantine-status' type: regular iscommand: true brand: "" nexttasks: '#none#': - "13" scriptarguments: endpoint_id: complex: root: inputs.EndpointID file_hash: complex: root: foundIncidents.CustomFields accessor: initiatorsha256 transformers: - operator: SetIfEmpty args: applyIfEmpty: {} defaultValue: value: simple: inputs.FileHash iscontext: true file_path: complex: root: foundIncidents.CustomFields accessor: initiatorpath transformers: - operator: SetIfEmpty args: applyIfEmpty: {} defaultValue: value: simple: inputs.FilePath iscontext: true separatecontext: false continueonerror: true continueonerrortype: "" view: |- { "position": { "x": 453, "y": -83 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "8": id: "8" taskid: 30398ddb-5182-4c19-84f2-6f06e62eabca type: regular task: id: 30398ddb-5182-4c19-84f2-6f06e62eabca version: -1 name: File quarantine description: Quarantines a file on selected endpoints. You can select up to 1000 endpoints. script: '|||core-quarantine-files' type: regular iscommand: true brand: "" nexttasks: '#none#': - "15" scriptarguments: endpoint_id_list: complex: root: inputs.EndpointID file_hash: complex: root: foundIncidents.CustomFields filters: - - operator: isNotEqualString left: value: simple: foundIncidents.CustomFields.initiatorpath iscontext: true right: value: simple: c:\windows\explorer.exe ignorecase: true accessor: initiatorsha256 transformers: - operator: SetIfEmpty args: applyIfEmpty: {} defaultValue: value: simple: inputs.FileHash iscontext: true file_path: complex: root: foundIncidents.CustomFields.initiatorpath filters: - - operator: isNotEqualString left: value: simple: foundIncidents.CustomFields.initiatorpath iscontext: true right: value: simple: c:\windows\explorer.exe ignorecase: true transformers: - operator: SetIfEmpty args: applyIfEmpty: {} defaultValue: value: simple: inputs.FilePath iscontext: true interval_in_seconds: simple: "20" timeout_in_seconds: simple: "120" separatecontext: false continueonerror: true continueonerrortype: "" view: |- { "position": { "x": 453, "y": 184 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "9": id: "9" taskid: 2b43ad1d-1312-47cd-87af-a0e39b15ab76 type: regular task: id: 2b43ad1d-1312-47cd-87af-a0e39b15ab76 version: -1 name: Set quarantine files per endpoints to the Incident context description: commands.local.cmd.set.parent.incident.context script: Builtin|||setParentIncidentContext type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "2" scriptarguments: key: simple: QuarantinedFilesFromEndpoints value: complex: root: Core.quarantineFiles accessor: actionIds separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 453, "y": 887 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "13": id: "13" taskid: 1208d3af-a6d7-4126-86f2-1c84f8659895 type: condition task: id: 1208d3af-a6d7-4126-86f2-1c84f8659895 version: -1 name: Should quarantine file? description: Whether to quarantine the files based on the input values and the incident context. type: condition iscommand: false brand: "" nexttasks: '#default#': - "26" "yes": - "8" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: complex: root: inputs.FileContainment iscontext: true right: value: simple: "True" ignorecase: true - - operator: isEqualString left: value: complex: root: inputs.FileRemediation iscontext: true right: value: simple: Quarantine ignorecase: true - - operator: isEqualString left: value: complex: root: Core.quarantineFiles.status accessor: status iscontext: true right: value: simple: "False" ignorecase: true continueonerrortype: "" view: |- { "position": { "x": 453, "y": 42 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "15": id: "15" taskid: 410c04ef-0afc-4578-8b1b-b1a3de96debf type: condition task: id: 410c04ef-0afc-4578-8b1b-b1a3de96debf version: -1 name: Was the file quarantined? description: Checks if the quarantining of the file was successful. type: condition iscommand: false brand: "" nexttasks: '#default#': - "25" "yes": - "16" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEqualString left: value: complex: root: Core.GetActionStatus accessor: status iscontext: true right: value: simple: FAILED ignorecase: true - - operator: isNotEmpty left: value: complex: root: Core.GetActionStatus accessor: status iscontext: true continueonerrortype: "" view: |- { "position": { "x": 227, "y": 631 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "16": id: "16" taskid: 7e2c6273-86db-4fdd-8165-79a451736b14 type: regular task: id: 7e2c6273-86db-4fdd-8165-79a451736b14 version: -1 name: Set quarantine files to the context description: Set a value in context under the key you entered. scriptName: Set type: regular iscommand: false brand: Builtin nexttasks: '#none#': - "9" scriptarguments: key: simple: QuarantinedFilesFromEndpoints value: complex: root: Core.quarantineFiles accessor: actionIds separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 453, "y": 767 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "17": id: "17" taskid: fd83526a-3995-475b-8ea6-60233a3f1636 type: condition task: id: fd83526a-3995-475b-8ea6-60233a3f1636 version: -1 name: Should isolate automatically? description: Whether to isolate the device automatically based on the input values. type: condition iscommand: false brand: "" nexttasks: '#default#': - "2" Auto: - "7" Manual: - "23" separatecontext: false conditions: - label: Auto condition: - - operator: isEqualString left: value: complex: root: inputs.AutoContainment iscontext: true right: value: simple: "True" ignorecase: true - - operator: isNotEmpty left: value: complex: root: inputs.EndpointID iscontext: true - - operator: isNotEmpty left: value: complex: root: inputs.FilePath iscontext: true - - operator: isNotEmpty left: value: complex: root: inputs.FileHash iscontext: true - label: Manual condition: - - operator: isNotEqualString left: value: complex: root: inputs.AutoContainment iscontext: true right: value: simple: "True" ignorecase: true - - operator: isNotEmpty left: value: complex: root: inputs.EndpointID iscontext: true - - operator: isNotEmpty left: value: complex: root: inputs.FilePath iscontext: true - - operator: isNotEmpty left: value: complex: root: inputs.FileHash iscontext: true continueonerrortype: "" view: |- { "position": { "x": -40, "y": -251 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "18": id: "18" taskid: 8395bf84-b9be-42af-8c0b-cdf64c82b8fa type: regular task: id: 8395bf84-b9be-42af-8c0b-cdf64c82b8fa version: -1 name: Get file quarantine status description: Retrieves the quarantine status for a selected file. script: '|||core-get-quarantine-status' type: regular iscommand: true brand: "" nexttasks: '#none#': - "19" scriptarguments: endpoint_id: complex: root: inputs.EndpointID file_hash: complex: root: FileHash filters: - - operator: stringHasLength left: value: simple: FileHash iscontext: true right: value: simple: "64" file_path: complex: root: FilePath separatecontext: false continueonerror: true continueonerrortype: "" view: |- { "position": { "x": -40, "y": 184 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "19": id: "19" taskid: a04c8ae8-b9a2-4a06-8d64-8463dd6582d9 type: condition task: id: a04c8ae8-b9a2-4a06-8d64-8463dd6582d9 version: -1 name: Should quarantine file? description: Whether to quarantine the files based on the input values and the incident context. type: condition iscommand: false brand: "" nexttasks: '#default#': - "2" "yes": - "20" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: complex: root: inputs.FileContainment iscontext: true right: value: simple: "True" ignorecase: true - - operator: isEqualString left: value: complex: root: inputs.FileRemediation iscontext: true right: value: simple: Quarantine ignorecase: true - - operator: isEqualString left: value: complex: root: Core.quarantineFiles.status accessor: status iscontext: true right: value: simple: "False" ignorecase: true continueonerrortype: "" view: |- { "position": { "x": -40, "y": 329 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "20": id: "20" taskid: 48f240fd-334d-4f88-8e66-726f9971ba3c type: regular task: id: 48f240fd-334d-4f88-8e66-726f9971ba3c version: -1 name: File quarantine description: Quarantines a file on selected endpoints. You can select up to 1000 endpoints. script: '|||core-quarantine-files' type: regular iscommand: true brand: "" nexttasks: '#none#': - "15" scriptarguments: endpoint_id_list: complex: root: inputs.EndpointID file_hash: complex: root: FileHash filters: - - operator: stringHasLength left: value: simple: FileHash iscontext: true right: value: simple: "64" file_path: complex: root: FilePath interval_in_seconds: simple: "20" timeout_in_seconds: simple: "120" separatecontext: false continueonerror: true continueonerrortype: "" view: |- { "position": { "x": -40, "y": 497 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "23": id: "23" taskid: c4b074c0-d8a1-4ef8-80a4-0b3ba35a3e76 type: regular task: id: c4b074c0-d8a1-4ef8-80a4-0b3ba35a3e76 version: -1 name: Set file path to quarantine description: Set a value in context under the key you entered. scriptName: Set type: regular iscommand: false brand: "" nexttasks: '#none#': - "24" scriptarguments: key: simple: FilePath value: complex: root: inputs.FilePath transformers: - operator: RegexExtractAll args: error_if_no_match: {} ignore_case: {} multi_line: {} period_matches_newline: {} regex: value: simple: Path\":\"(.+?)\" unpack_matches: {} - operator: SetIfEmpty args: applyIfEmpty: {} defaultValue: value: simple: No value - operator: replace args: limit: {} replaceWith: value: simple: \ toReplace: value: simple: \\ separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -40, "y": -85 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "24": id: "24" taskid: e0e42cd2-c5a4-4148-855a-3f99dc7a6c91 type: regular task: id: e0e42cd2-c5a4-4148-855a-3f99dc7a6c91 version: -1 name: Set file hash to quarantine description: Set a value in context under the key you entered. scriptName: Set type: regular iscommand: false brand: "" nexttasks: '#none#': - "18" scriptarguments: key: simple: FileHash value: complex: root: inputs.FileHash transformers: - operator: RegexExtractAll args: error_if_no_match: {} ignore_case: {} multi_line: {} period_matches_newline: {} regex: value: simple: Hash\":\"(.+?)\" unpack_matches: {} - operator: SetIfEmpty args: applyIfEmpty: {} defaultValue: value: simple: No value separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -40, "y": 40 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "25": id: "25" taskid: 942487c5-0c60-4be2-aa56-4c85d6718a0f type: regular task: id: 942487c5-0c60-4be2-aa56-4c85d6718a0f version: -1 name: Manual action needed – file couldn't be quarantined description: |- Dear Analyst, The playbook was unable to quarantine the file due to the following possible reasons: - The file is not located on the local host. - The endpoint is currently disconnected. Please take manual action to quarantine the file. type: regular iscommand: false brand: "" nexttasks: '#none#': - "2" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -37, "y": 767 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "26": id: "26" taskid: 3480aab3-067b-4479-839e-72f46bc551b1 type: title task: id: 3480aab3-067b-4479-839e-72f46bc551b1 version: -1 name: Done type: title iscommand: false brand: "" description: '' separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 901, "y": 189 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false system: true view: |- { "linkLabelsPosition": { "13_26_#default#": 0.54, "13_8_yes": 0.41, "15_16_yes": 0.6, "17_23_Manual": 0.42, "17_2_#default#": 0.12, "19_20_yes": 0.44, "19_2_#default#": 0.15 }, "paper": { "dimensions": { "height": 1455, "width": 1536, "x": -254, "y": -369 } } } inputs: - key: FileContainment value: simple: "True" required: false description: Set to 'True' to quarantine the identified file. playbookInputQuery: - key: FileRemediation value: simple: Quarantine required: false description: "Choose 'Quarantine' or 'Delete' to avoid file remediation conflicts. \nFor example, choosing 'Quarantine' ignores the 'Delete file' task under the eradication playbook and will execute only file quarantine." playbookInputQuery: - key: FilePath value: {} required: false description: The path of the file to block. playbookInputQuery: - key: FileHash value: {} required: false description: The file hash to block. playbookInputQuery: - key: EndpointID value: {} required: false description: The endpoint ID to run commands over. playbookInputQuery: - key: AutoContainment value: {} required: false description: Whether to execute containment plan automatically. playbookInputQuery: outputs: - contextPath: QuarantinedFilesFromEndpoints description: The quarantined files from endpoint. type: unknown tests: - No tests (auto formatted) fromversion: 6.6.0 marketplaces: - marketplacev2 - platform supportedModules: - cloud_runtime_security - xsiam - edr