commonfields:
  id: MicrosoftAtpStopAndQuarantineFile
  version: -1
name: MicrosoftAtpStopAndQuarantineFile
script: ''
type: python
tags:
  - Utilities
comment: A polling wrapper script; Stop the execution of a file on a machine and delete it.
enabled: true
args:
  - description: The machine ID. When providing multiple values, each value is checked for the same hash.
    name: machine_id
    isArray: true
    required: true
  - description: |-
      The file SHA1 hash to stop and quarantine on the machine.
      When providing multiple values, each value is checked for the same machine_id.
    name: file_hash
    isArray: true
    required: true
  - description: Comment to associate with the action.
    name: comment
    required: true
  - deprecated: true
    description: Flag for the rate limit retry.
    name: ran_once_flag
outputs:
  - contextPath: MicrosoftATP.MachineAction.ID
    description: The machine action ID.
    type: String
  - contextPath: MicrosoftATP.MachineAction.Type
    description: The type of the action.
    type: String
  - contextPath: MicrosoftATP.MachineAction.Scope
    description: The scope of the action.
    type: String
  - contextPath: MicrosoftATP.MachineAction.Requestor
    description: The ID of the user that executed the action.
    type: String
  - contextPath: MicrosoftATP.MachineAction.RequestorComment
    description: The comment that was written when issuing the action.
    type: String
  - contextPath: MicrosoftATP.MachineAction.Status
    description: The current status of the command.
    type: String
  - contextPath: MicrosoftATP.MachineAction.MachineID
    description: The machine ID on which the action was executed.
    type: String
  - contextPath: MicrosoftATP.MachineAction.ComputerDNSName
    description: The machine DNS name on which the action was executed.
    type: String
  - contextPath: MicrosoftATP.MachineAction.CreationDateTimeUtc
    description: The date and time the action was created.
    type: Date
  - contextPath: MicrosoftATP.MachineAction.LastUpdateTimeUtc
    description: The last date and time the action status was updated.
    type: Date
  - contextPath: MicrosoftATP.MachineAction.RelatedFileInfo.FileIdentifier
    description: The file identifier.
    type: String
  - contextPath: MicrosoftATP.MachineAction.RelatedFileInfo.FileIdentifierType
    description: 'The file identifier type. Possible values: "SHA1" ,"SHA256", and "MD5".'
    type: String
scripttarget: 0
subtype: python3
dockerimage: demisto/python3:3.12.13.10116658
dependson:
  must:
  - microsoft-atp-stop-and-quarantine-file
fromversion: 6.1.0
isInternal: true
tests:
  - No tests (auto formatted)
marketplaces:
  - platform