id: CrowdStrike Falcon Malware - Verify Containment Actions version: -1 name: CrowdStrike Falcon Malware - Verify Containment Actions description: |- This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. This playbook verifies and sets the policy actions applied by CrowdStrike Falcon. starttaskid: '0' tasks: '0': id: '0' taskid: e7c7d902-36bd-4b88-8ef6-c3e596be918a type: start task: id: e7c7d902-36bd-4b88-8ef6-c3e596be918a version: -1 name: '' iscommand: false brand: '' description: '' nexttasks: '#none#': - "20" separatecontext: false view: |- { "position": { "x": 200, "y": -380 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" '1': id: '1' taskid: 15d703b6-7cd5-4a4e-856d-11141cec0875 type: condition task: id: 15d703b6-7cd5-4a4e-856d-11141cec0875 version: -1 name: Is policy enabled? type: condition iscommand: false brand: '' description: 'Is policy enabled?' nexttasks: '#default#': - '2' yes: - '3' separatecontext: false conditions: - label: yes condition: - - operator: isEqualString left: value: simple: Detection.Behavior.policy_disabled iscontext: true right: value: simple: 'false' ignorecase: true view: |- { "position": { "x": 450, "y": 200 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" '2': id: '2' taskid: 0aed7220-4345-4618-884a-e09854131ef8 type: regular task: id: 0aed7220-4345-4618-884a-e09854131ef8 version: -1 name: Set policy status not active description: Sets a value in context under the key you entered. scriptName: Set type: regular iscommand: false brand: '' nexttasks: '#none#': - '4' scriptarguments: key: simple: Policy.State value: simple: Not Active separatecontext: false view: |- { "position": { "x": 450, "y": 380 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" '3': id: '3' taskid: 76f47710-f7d5-477e-8580-796e1083c4fd type: regular task: id: 76f47710-f7d5-477e-8580-796e1083c4fd version: -1 name: Set policy status active description: Set a value in context under the key you entered. scriptName: Set type: regular iscommand: false brand: '' nexttasks: '#none#': - '10' - '12' scriptarguments: key: simple: Policy.State value: simple: Active separatecontext: false view: |- { "position": { "x": 1170, "y": 380 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" '4': id: '4' taskid: be369256-7e95-4bf2-81b6-3cf05ceb26c8 type: title task: id: be369256-7e95-4bf2-81b6-3cf05ceb26c8 version: -1 name: Done type: title iscommand: false brand: '' description: '' separatecontext: false view: |- { "position": { "x": 200, "y": 1180 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" '5': id: '5' taskid: 498d0b00-bd30-4bb8-8e24-ecf6d97e8e5d type: condition task: id: 498d0b00-bd30-4bb8-8e24-ecf6d97e8e5d version: -1 name: Was host isolated? type: condition iscommand: false brand: '' description: 'Was host isolated?' nexttasks: '#default#': - '8' yes: - '7' separatecontext: false conditions: - label: yes condition: - - operator: isEqualString left: value: simple: Detection.Behavior.quarantine_machine iscontext: true right: value: simple: 'true' ignorecase: true view: |- { "position": { "x": 830, "y": 680 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" '7': id: '7' taskid: 2ddbc174-fc63-4b7c-8a86-282ca82d80c2 type: regular task: id: 2ddbc174-fc63-4b7c-8a86-282ca82d80c2 version: -1 name: Set host isolated description: Set a value in context under the key you entered. scriptName: Set type: regular iscommand: false brand: '' nexttasks: '#none#': - '11' scriptarguments: key: simple: Host.State value: simple: Isolated separatecontext: false view: |- { "position": { "x": 1030, "y": 860 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" '8': id: '8' taskid: efd68ab1-05fb-479b-8b00-dfd720f014b9 type: regular task: id: efd68ab1-05fb-479b-8b00-dfd720f014b9 version: -1 name: Set host no isolated description: Set a value in context under the key you entered. scriptName: Set type: regular iscommand: false brand: '' nexttasks: '#none#': - '11' scriptarguments: key: simple: Host.State value: simple: Not Isolated separatecontext: false view: |- { "position": { "x": 630, "y": 860 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" '9': id: '9' taskid: d71558d5-a17b-4077-856b-e2c7819cb716 type: title task: id: d71558d5-a17b-4077-856b-e2c7819cb716 version: -1 name: Policy State type: title iscommand: false brand: '' description: '' nexttasks: '#none#': - '19' separatecontext: false view: |- { "position": { "x": 450, "y": -75 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" '10': id: '10' taskid: 7259fb74-92b6-4084-8f04-ee58d84a0671 type: title task: id: 7259fb74-92b6-4084-8f04-ee58d84a0671 version: -1 name: Host State type: title iscommand: false brand: '' description: '' nexttasks: '#none#': - '5' separatecontext: false view: |- { "position": { "x": 830, "y": 555 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" '11': id: '11' taskid: 15f02b8f-ff2c-46ca-8f8d-87958f36e139 type: title task: id: 15f02b8f-ff2c-46ca-8f8d-87958f36e139 version: -1 name: Done Host State type: title iscommand: false brand: '' description: '' nexttasks: '#none#': - '4' separatecontext: false view: |- { "position": { "x": 840, "y": 1030 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" '12': id: '12' taskid: 64484bbc-8000-46e9-8d21-4f8a06eb8d75 type: title task: id: 64484bbc-8000-46e9-8d21-4f8a06eb8d75 version: -1 name: Process State type: title iscommand: false brand: '' description: '' nexttasks: '#none#': - '13' separatecontext: false view: |- { "position": { "x": 1930, "y": 555 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" '13': id: '13' taskid: 748be87f-33af-415f-8b5a-3fe0bed1677e type: condition task: id: 748be87f-33af-415f-8b5a-3fe0bed1677e version: -1 name: Was process handled? type: condition iscommand: false brand: '' description: 'Was process handled?' nexttasks: '#default#': - '17' Process blocked: - '18' process killed: - '15' process suspended: - '14' separatecontext: false conditions: - label: process killed condition: - - operator: isEqualString left: value: simple: Detection.Behavior.kill_process iscontext: true right: value: simple: 'true' ignorecase: true - label: process suspended condition: - - operator: isEqualString left: value: simple: Detection.Behavior.suspend_process iscontext: true right: value: simple: 'true' ignorecase: true - label: Process blocked condition: - - operator: isEqualString left: value: simple: Detection.Behavior.process_blocked iscontext: true right: value: simple: 'true' ignorecase: true view: |- { "position": { "x": 1930, "y": 670 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" '14': id: '14' taskid: a5b33061-f3d9-4eb1-8459-c00fc5978435 type: regular task: id: a5b33061-f3d9-4eb1-8459-c00fc5978435 version: -1 name: Set process suspended description: Set a value in context under the key you entered. scriptName: Set type: regular iscommand: false brand: '' nexttasks: '#none#': - '16' scriptarguments: key: simple: Process.State value: simple: Suspended separatecontext: false view: |- { "position": { "x": 1930, "y": 860 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" '15': id: '15' taskid: dd702688-dfae-4463-8e0f-8d5e8ae552cc type: regular task: id: dd702688-dfae-4463-8e0f-8d5e8ae552cc version: -1 name: Set process killed description: Set a value in context under the key you entered. scriptName: Set type: regular iscommand: false brand: '' nexttasks: '#none#': - '16' scriptarguments: key: simple: Process.State value: simple: Killed separatecontext: false view: |- { "position": { "x": 1530, "y": 860 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" '16': id: '16' taskid: b87386a4-4266-425b-868f-7da9bcedcf8c type: title task: id: b87386a4-4266-425b-868f-7da9bcedcf8c version: -1 name: Done Host State type: title iscommand: false brand: '' description: '' nexttasks: '#none#': - '4' separatecontext: false view: |- { "position": { "x": 1740, "y": 1030 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" '17': id: '17' taskid: f20c30ab-2b68-4522-830c-79b4c8f53253 type: regular task: id: f20c30ab-2b68-4522-830c-79b4c8f53253 version: -1 name: Set no action taken description: Set a value in context under the key you entered. scriptName: Set type: regular iscommand: false brand: '' nexttasks: '#none#': - '16' scriptarguments: key: simple: Process.State value: simple: No Action Taken separatecontext: false view: |- { "position": { "x": 2730, "y": 860 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" '18': id: '18' taskid: 53a03f32-0e2a-44c4-8511-9569737270b2 type: regular task: id: 53a03f32-0e2a-44c4-8511-9569737270b2 version: -1 name: Set process blocked description: Set a value in context under the key you entered. scriptName: Set type: regular iscommand: false brand: '' nexttasks: '#none#': - '16' scriptarguments: key: simple: Process.State value: simple: Blocked separatecontext: false view: |- { "position": { "x": 2330, "y": 860 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" '19': id: '19' taskid: 282d6e1e-fc71-4571-8089-0ebc1404c838 type: regular task: id: 282d6e1e-fc71-4571-8089-0ebc1404c838 version: -1 name: Get full detection details description: Set a value in context under the key you entered. scriptName: Set type: regular iscommand: false brand: '' nexttasks: '#none#': - '1' scriptarguments: key: simple: Detection.Behavior value: complex: root: inputs.PolicyBehaviourDetails separatecontext: false view: |- { "position": { "x": 450, "y": 45 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "20": id: "20" taskid: e5ba8aa5-c0b8-4a58-85fe-7566ede7a5a3 type: condition task: id: e5ba8aa5-c0b8-4a58-85fe-7566ede7a5a3 version: -1 name: Is there a policy object? description: Is there a policy object? type: condition iscommand: false brand: "" nexttasks: '#default#': - "4" "yes": - "9" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: simple: inputs.PolicyBehaviourDetails iscontext: true continueonerrortype: "" view: |- { "position": { "x": 200, "y": -250 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false view: |- { "linkLabelsPosition": {}, "paper": { "dimensions": { "height": 1625, "width": 2910, "x": 200, "y": -380 } } } inputs: - key: PolicyBehaviourDetails value: {} required: false description: The path that contains the detection results. playbookInputQuery: outputs: - contextPath: Policy.State description: Is the policy active? type: string - contextPath: Host.State description: Is the host isolated? type: string - contextPath: Process.State description: Was the process contained? type: string tests: - Test Playbook - CrowdStrike Falcon Malware - Verify Containment Actions fromversion: 6.5.0 contentitemexportablefields: contentitemfields: {} system: true marketplaces: - xsoar # Should not appear in marketplacev2