commonfields:
  id: quarantine-file
  version: -1
args:
- name: endpoint_id
  description: List of endpoint IDs.
  required: true
  isArray: true
- name: file_hash
  description: The hash of the file to quarantine. Supported types are SHA256, SHA1.
  required: true
- name: file_path
  description: The path of the file to quarantine.
  required: false
- name: timeout
  description: The polling timeout in seconds for the quarantine commands. The default is 300.
  required: false
  defaultValue: 300
- name: brands
  description: |-
    A comma-separated list of brands for which to execute the 'quarantine-file' command. If not specified, all available instances will run.
    Currently supported brands are: "Cortex XDR - IR", "Cortex Core - IR", "Microsoft Defender Advanced Threat Protection".
  isArray: true
  auto: PREDEFINED
  predefined:
  - "Cortex XDR - IR"
  - "Cortex Core - IR"
  - "Microsoft Defender Advanced Threat Protection"
- name: verbose
  description: Whether to retrieve a human-readable entry for every command. When set to false, human-readable will only summarize the final result.
  auto: PREDEFINED
  predefined:
  - 'true'
  - 'false'
  defaultValue: 'false'
- name: completed_results
  description: A list of completed jobs before quarantine (automatically filled by polling).
  deprecated: true
- name: pending_jobs
  description: A list of jobs for which to poll quarantine status (automatically filled by polling).
  deprecated: true
comment: This script executes the 'quarantine-file' command on a specified file via the appropriate agent. This script is used to isolate files identified as suspicious. Currently supported brands are "Cortex XDR - IR", "Cortex Core - IR", and "Microsoft Defender Advanced Threat Protection".
name: quarantine-file
supportedModules:
- agentix
- cloud
- cloud_runtime_security
- edr
- xsiam
outputs:
- contextPath: QuarantineFile.FilePath
  description: The path of the quarantined file.
  type: String
- contextPath: QuarantineFile.FileHash
  description: The hash of the quarantined file.
  type: String
- contextPath: QuarantineFile.Status
  description: Whether the command execution was successful or not.
  type: String
- contextPath: QuarantineFile.Message
  description: A success message if the command runs successfully, otherwise a message that contains the error.
  type: String
- contextPath: QuarantineFile.Brand
  description: The integration that executed the command. On the Cortex platform, the Core action runs as a Builtin command and is reported as "Cortex Builtin".
  type: String
- contextPath: QuarantineFile.EndpointID
  description: The endpoint_id which the command was executed on.
  type: String
script: '-'
timeout: '0'
type: python
subtype: python3
compliantpolicies:
- Quarantine File
dockerimage: demisto/python3:3.12.13.10404775
fromversion: 6.10.0
polling: true
tests:
- QuarantineFile-Test