id: Eradication Plan - Delete File
version: -1
name: Eradication Plan - Delete File
description: "This playbook is one of the sub-playbooks in the eradication plan. \nThis playbook executes actions of file deletion, which is a crucial step in the eradication process."
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 48cbb13a-a0c0-4a27-815a-66e38f3387ff
    type: start
    task:
      id: 48cbb13a-a0c0-4a27-815a-66e38f3387ff
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "21"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 350,
          "y": 80
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 7c4ec73d-fff2-45de-8387-699ac5c64a2d
    type: regular
    task:
      id: 7c4ec73d-fff2-45de-8387-699ac5c64a2d
      version: -1
      name: Auto file deletion
      description: Initiates a new endpoint script execution to delete the specified file.
      script: '|||core-run-script-delete-file'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "19"
    scriptarguments:
      endpoint_ids:
        complex:
          root: inputs.EndpointID
      file_path:
        complex:
          root: inputs.FilePath
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 350,
          "y": 430
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: 040279ae-6f3d-42a1-8def-2c0565fd669f
    type: title
    task:
      id: 040279ae-6f3d-42a1-8def-2c0565fd669f
      version: -1
      name: Done - File Deletion
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 350,
          "y": 790
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "19":
    id: "19"
    taskid: e6efaf8f-a382-45a5-8286-e3e8b86eee8e
    type: regular
    task:
      id: e6efaf8f-a382-45a5-8286-e3e8b86eee8e
      version: -1
      name: Get command result
      description: Retrieve the results of a script execution action.
      script: '|||core-get-script-execution-results'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      action_id:
        complex:
          root: Core.GetActionStatus
          accessor: action_id
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 350,
          "y": 600
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "21":
    id: "21"
    taskid: a1a09dd3-d1de-40ae-898b-6fe92bd93c6e
    type: condition
    task:
      id: a1a09dd3-d1de-40ae-898b-6fe92bd93c6e
      version: -1
      name: Should delete the file?
      description: Whether to delete the file based on the input values.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "3"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.FilePath
            iscontext: true
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.EndpointID
            iscontext: true
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.FileRemediation
            iscontext: true
          right:
            value:
              simple: Delete
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 350,
          "y": 220
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "21_3_yes": 0.59
    },
    "paper": {
      "dimensions": {
        "height": 775,
        "width": 380,
        "x": 350,
        "y": 80
      }
    }
  }
inputs:
- key: FileRemediation
  value:
    simple: Delete
  required: false
  description: "Choose 'Quarantine' or 'Delete' to avoid file remediation conflicts. \nFor example, choosing 'Delete' ignores the 'Quarantine file' task under the containment playbook and executes only file deletion."
  playbookInputQuery:
- key: EndpointID
  value:
    complex:
      root: Endpoints
  required: false
  description: The endpoint ID.
  playbookInputQuery:
- key: FilePath
  value:
    complex:
      root: Path
  required: false
  description: The file path for the file deletion task.
  playbookInputQuery:
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.6.0
marketplaces:
- marketplacev2
- platform
supportedModules:
- cloud_runtime_security
- xsiam
- edr
- agentix
- cloud