args:
- description: List of device IDs.
  isArray: true
  name: device_ids
  required: true
- description: Path(s) of the file(s) to remove.
  isArray: true
  name: file_path
- description: Hash(es) of the file(s) to remove.
  isArray: true
  name: file_hash
- description: Whether to run the command. This is used to prevent unwanted calls to the command.
  name: approve_action
  defaultValue: No
  predefined:
  - Yes
  - No
comment: This script allows removing specified files using Cortex XDR, CrowdStrike and Microsoft Defender (Advanced Threat Protection).
commonfields:
  id: RemoveFileWrapper
  version: -1
name: RemoveFileWrapper
outputs:

  # XDR outputs
- contextPath: PaloAltoNetworksXDR.ScriptRun.action_id
  description: The ID of the initiated action.
  type: Number
- contextPath: PaloAltoNetworksXDR.ScriptRun.endpoints_count
  description: The number of endpoints the action was initiated on.
  type: Number

  # CrowdStrike outputs
- contextPath: CrowdStrike.Command.rm.HostID
  description: The host ID.
  type: String
- contextPath: CrowdStrike.Command.rm.Error
  description: The error message raised if the command failed.
  type: String

  # MSDE outputs
- contextPath: MicrosoftATP.MachineAction.ID
  description: The machine action ID.
  type: String
- contextPath: MicrosoftATP.MachineAction.Type
  description: The type of the action.
  type: String
- contextPath: MicrosoftATP.MachineAction.Scope
  description: The scope of the action.
  type: String
- contextPath: MicrosoftATP.MachineAction.Requestor
  description: The ID of the user that executed the action.
  type: String
- contextPath: MicrosoftATP.MachineAction.RequestorComment
  description: The comment that was written when issuing the action.
  type: String
- contextPath: MicrosoftATP.MachineAction.Status
  description: The current status of the command.
  type: String
- contextPath: MicrosoftATP.MachineAction.MachineID
  description: The machine ID on which the action was executed.
  type: String
- contextPath: MicrosoftATP.MachineAction.ComputerDNSName
  description: The machine DNS name on which the action was executed.
  type: String
- contextPath: MicrosoftATP.MachineAction.CreationDateTimeUtc
  description: The date and time the action was created.
  type: Date
- contextPath: MicrosoftATP.MachineAction.LastUpdateTimeUtc
  description: The last date and time the action status was updated.
  type: Date
- contextPath: MicrosoftATP.MachineAction.RelatedFileInfo.FileIdentifier
  description: The file identifier.
  type: String
- contextPath: MicrosoftATP.MachineAction.RelatedFileInfo.FileIdentifierType
  description: 'The file identifier type. Possible values: "SHA1" ,"SHA256", and "MD5".'
  type: String

script: '-'
tags:
- basescript
timeout: '0'
type: python
subtype: python3
dockerimage: demisto/python3:3.12.13.10404775
fromversion: 6.0.0
tests:
- No tests (auto formatted)