id: MDE - Search And Block Software version: -1 name: MDE - Search And Block Software description: This playbook will search a file or process activity of a software by a given image file name using Microsoft Defender For Endpoint. The analyst can then choose the files to block. starttaskid: "0" tasks: "0": id: "0" taskid: e2462455-b6f1-4456-847a-8d2cbfe68e11 type: start task: id: e2462455-b6f1-4456-847a-8d2cbfe68e11 version: -1 name: "" iscommand: false brand: "" description: '' nexttasks: '#none#': - "31" - "32" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 440, "y": -330 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "3": id: "3" taskid: f16ed52e-b396-43c3-85e0-74ca45de4ce0 type: condition task: id: f16ed52e-b396-43c3-85e0-74ca45de4ce0 version: -1 name: Has query results? type: condition iscommand: false brand: "" description: '' nexttasks: '#default#': - "6" "yes": - "26" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: MicrosoftATP.Hunt accessor: Result iscontext: true right: value: {} continueonerrortype: "" view: |- { "position": { "x": 990, "y": 520 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "4": id: "4" taskid: 2b9111c4-c7f3-4aff-8722-cb0e0de16aa9 type: title task: id: 2b9111c4-c7f3-4aff-8722-cb0e0de16aa9 version: -1 name: Done type: title iscommand: false brand: "" description: '' separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 440, "y": 2390 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "6": id: "6" taskid: 7ed6724b-75d4-45c8-8a3d-e39ffa900e22 type: regular task: id: 7ed6724b-75d4-45c8-8a3d-e39ffa900e22 version: -1 name: delete context - XDR Results description: |- Delete field from context. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script scriptName: DeleteContext type: regular iscommand: false brand: "" nexttasks: '#none#': - "21" scriptarguments: key: simple: PaloAltoNetworksXQL subplaybook: simple: "yes" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 740, "y": 1890 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "14": id: "14" taskid: 204f5af9-ee11-4c34-8429-3d0cc19a3685 type: condition task: id: 204f5af9-ee11-4c34-8429-3d0cc19a3685 version: -1 name: Has software name and timeframe from input? type: condition iscommand: false brand: "" description: '' nexttasks: '#default#': - "6" "yes": - "15" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: inputs.Filename iscontext: true right: value: {} - - operator: isNotEmpty left: value: complex: root: inputs.TimeFrame iscontext: true continueonerrortype: "" view: |- { "position": { "x": 740, "y": 170 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "15": id: "15" taskid: acdbc23e-ea80-4a6f-86a6-b210df33031d type: regular task: id: acdbc23e-ea80-4a6f-86a6-b210df33031d version: -1 name: Execute KQL query to search software description: 'Allows you to run programmatic queries like in Microsoft Defender ATP Portal (https://securitycenter.windows.com/hunting). Limitations: You can only run a query on data from the last 30 days. The results include a maximum of 10,000 rows. The number of executions is limited (up to 15 calls per minute, 15 minutes of running time every hour and 4 hours of running time a day).' script: '|||microsoft-atp-advanced-hunting' type: regular iscommand: true brand: "" nexttasks: '#none#': - "3" scriptarguments: query: simple: |- DeviceProcessEvents | where FileName in~ ("${inputs.Filename}") | project FileName, ProcessCreationTime, DeviceName, FolderPath, SHA256 time_range: complex: root: inputs.TimeFrame separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 990, "y": 350 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "16": id: "16" taskid: e1cad07d-ecc9-448d-8dfe-1b414f4d1f2b type: collection task: id: e1cad07d-ecc9-448d-8dfe-1b414f4d1f2b version: -1 name: Would you like to block the files found? type: collection iscommand: false brand: "" description: '' nexttasks: '#none#': - "17" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1220, "y": 850 } } note: false timertriggers: [] ignoreworker: false message: to: subject: body: methods: [] format: "" bcc: cc: timings: retriescount: 2 retriesinterval: 360 completeafterreplies: 1 completeafterv2: true completeaftersla: false form: questions: - id: "0" label: "" labelarg: simple: Would you like to block the files found? required: false gridcolumns: [] defaultrows: [] type: singleSelect options: [] optionsarg: - simple: Yes - All - simple: Yes - Choose specific files - simple: "No" fieldassociated: "" placeholder: "" tooltip: "" readonly: false title: Would you like to block the files found? description: "" sender: "" expired: false totalanswers: 0 skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "17": id: "17" taskid: 0d2ff43d-695e-4cac-8dad-b19811c882e6 type: condition task: id: 0d2ff43d-695e-4cac-8dad-b19811c882e6 version: -1 name: Block the files? type: condition iscommand: false brand: "" description: '' nexttasks: '#default#': - "6" Yes - Choose specific files: - "18" "yes": - "19" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: complex: root: Would you like to block the files found?.Answers accessor: "0" iscontext: true right: value: simple: "Yes" ignorecase: true - label: Yes - Choose specific files condition: - - operator: isEqualString left: value: complex: root: Would you like to block the files found?.Answers accessor: "0" iscontext: true right: value: simple: Yes - Choose specific files ignorecase: true continueonerrortype: "" view: |- { "position": { "x": 1220, "y": 1020 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "18": id: "18" taskid: d901ba98-06ad-476a-8bfc-13a7984e9b35 type: collection task: id: d901ba98-06ad-476a-8bfc-13a7984e9b35 version: -1 name: Choose specific files to block type: collection iscommand: false brand: "" description: '' nexttasks: '#none#': - "24" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1650, "y": 1200 } } note: false timertriggers: [] ignoreworker: false message: to: subject: body: methods: [] format: "" bcc: cc: timings: retriescount: 2 retriesinterval: 360 completeafterreplies: 1 completeafterv2: true completeaftersla: false form: questions: - id: "0" label: "" labelarg: simple: Choose specific files to block required: false gridcolumns: [] defaultrows: [] type: multiSelect options: [] optionsarg: - complex: root: MicrosoftATP.Hunt.Result accessor: FolderPath - {} fieldassociated: "" placeholder: "" tooltip: "" readonly: false title: Choose specific files to block description: "" sender: "" expired: false totalanswers: 0 skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "19": id: "19" taskid: e1a29a81-6e8b-4964-8378-317d6da13486 type: regular task: id: e1a29a81-6e8b-4964-8378-317d6da13486 version: -1 name: Set Indicators To Block description: Set a value in context under the key you entered. scriptName: Set type: regular iscommand: false brand: "" nexttasks: '#none#': - "29" scriptarguments: key: simple: IndicatorsToBlock value: complex: root: MicrosoftATP.Hunt.Result accessor: SHA256 separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1220, "y": 1200 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "21": id: "21" taskid: dbca7f71-0386-4a09-82b3-7127aa1272d3 type: regular task: id: dbca7f71-0386-4a09-82b3-7127aa1272d3 version: -1 name: delete context - Indicators To block description: |- Delete field from context. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script scriptName: DeleteContext type: regular iscommand: false brand: "" nexttasks: '#none#': - "27" scriptarguments: key: simple: PaloAltoNetworksXQL subplaybook: simple: "yes" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 740, "y": 2055 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "23": id: "23" taskid: 0eeeff57-dc6a-48f0-828f-2742507e80f2 type: regular task: id: 0eeeff57-dc6a-48f0-828f-2742507e80f2 version: -1 name: Set Indicators To Block - Process description: Set a value in context under the key you entered. scriptName: Set type: regular iscommand: false brand: "" nexttasks: '#none#': - "29" scriptarguments: append: simple: "true" key: simple: IndicatorsToBlock value: complex: root: MicrosoftATP.Hunt.Result filters: - - operator: in left: value: simple: MicrosoftATP.Hunt.Result.FolderPath iscontext: true right: value: simple: Choose specific files to block.Answers.0 iscontext: true ignorecase: true accessor: SHA256 separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1650, "y": 1540 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "24": id: "24" taskid: 04f5195a-5602-41dd-8161-23a159aabede type: condition task: id: 04f5195a-5602-41dd-8161-23a159aabede version: -1 name: Has relevant files to block? type: condition iscommand: false brand: "" description: '' nexttasks: '#default#': - "29" "yes": - "23" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: Choose specific files to block.Answers accessor: "0" iscontext: true right: value: {} continueonerrortype: "" view: |- { "position": { "x": 1650, "y": 1360 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "26": id: "26" taskid: 4252ff7c-9f2f-4ad0-8dfa-f2a5ac8227b4 type: regular task: id: 4252ff7c-9f2f-4ad0-8dfa-f2a5ac8227b4 version: -1 name: Set query results to layout description: Accepts a JSON object and returns a markdown. scriptName: JsonToTable type: regular iscommand: false brand: "" nexttasks: '#none#': - "16" scriptarguments: extend-context: simple: customquerymarkdown= value: complex: root: MicrosoftATP.Hunt accessor: Result separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1220, "y": 690 } } note: false timertriggers: [] ignoreworker: false fieldMapping: - incidentfield: Custom Query Results output: simple: ${customquerymarkdown} skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "27": id: "27" taskid: 73d00fa3-bca8-4100-874a-97f8bfebc839 type: regular task: id: 73d00fa3-bca8-4100-874a-97f8bfebc839 version: -1 name: Delete context - markdown description: |- Delete field from context. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script scriptName: DeleteContext type: regular iscommand: false brand: "" nexttasks: '#none#': - "4" scriptarguments: key: simple: customquerymarkdown separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 740, "y": 2220 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "29": id: "29" taskid: 716ee229-5da3-412b-8867-4d7dcd3b94bc type: regular task: id: 716ee229-5da3-412b-8867-4d7dcd3b94bc version: -1 name: Block indicators description: Creates a new indicator. script: '|||microsoft-atp-sc-indicator-create' type: regular iscommand: true brand: "" nexttasks: '#none#': - "6" scriptarguments: action: simple: Block expiration_time: complex: root: inputs.Indicator Expiration indicator_description: complex: root: inputs.Defender Indicator Title indicator_title: complex: root: inputs.Defender Indicator Title indicator_type: simple: FileSha256 indicator_value: complex: root: IndicatorsToBlock separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1220, "y": 1710 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "30": id: "30" taskid: 34b5f859-aa10-48cf-8f28-41ee793c6d73 type: condition task: id: 34b5f859-aa10-48cf-8f28-41ee793c6d73 version: -1 name: Is Defender For Endpoint enabled? type: condition iscommand: false brand: "" description: '' nexttasks: '#default#': - "4" "yes": - "14" separatecontext: false conditions: - label: "yes" condition: - - operator: isExists left: value: complex: root: modules filters: - - operator: isEqualString left: value: simple: modules.brand iscontext: true right: value: simple: Microsoft Defender Advanced Threat Protection - - operator: isEqualString left: value: simple: modules.state iscontext: true right: value: simple: active ignorecase: true accessor: brand iscontext: true continueonerrortype: "" view: |- { "position": { "x": 440, "y": 0 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "31": id: "31" taskid: d56940ed-4d06-417b-8025-ad1efff4c0ad type: regular task: id: d56940ed-4d06-417b-8025-ad1efff4c0ad version: -1 name: Delete context to avoid duplications - customquerymarkdown description: |- Delete field from context. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script scriptName: DeleteContext type: regular iscommand: false brand: "" nexttasks: '#none#': - "30" scriptarguments: key: simple: customquerymarkdown separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 640, "y": -180 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "32": id: "32" taskid: 66aa84a3-2c01-473f-8346-29a174cdae15 type: regular task: id: 66aa84a3-2c01-473f-8346-29a174cdae15 version: -1 name: Delete context to avoid duplications - MicrosoftATP description: |- Delete field from context. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script scriptName: DeleteContext type: regular iscommand: false brand: "" nexttasks: '#none#': - "30" scriptarguments: key: simple: MicrosoftATP separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 250, "y": -180 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false system: true view: |- { "linkLabelsPosition": { "14_6_#default#": 0.14, "17_18_Yes - Choose specific files": 0.52, "17_6_#default#": 0.25, "24_29_#default#": 0.9, "3_26_yes": 0.54, "3_6_#default#": 0.15 }, "paper": { "dimensions": { "height": 2785, "width": 1780, "x": 250, "y": -330 } } } inputs: - key: Filename value: {} required: false description: File name to search playbookInputQuery: - key: TimeFrame value: {} required: false description: 'Time in relative date or range format (for example: "1 day", "3 weeks ago", "between 2021-01-01 12:34:56 +02:00 and 2021-02-01 12:34:56 +02:00"). The default is the last 24 hours.' playbookInputQuery: - key: Defender Indicator Title value: simple: XSOAR Software Block required: false description: The indicator alert title in Defender. playbookInputQuery: - key: Indicator Expiration value: {} required: false description: 'DateTime string indicating when the indicator expires. Format: (