{ "blockly": false, "blockly_xml": "", "category": "Containment", "coa": { "data": { "description": "Accepts a hostname or device id as input and attempts to isolate (quarantine) the device in Crowdstrike. We then generate an observable report as well as a Markdown formatted report from the results. Both reports can be customized based on user preference.", "edges": [ { "id": "port_0_to_port_2", "sourceNode": "0", "sourcePort": "0_out", "targetNode": "2", "targetPort": "2_in" }, { "id": "port_5_to_port_1", "sourceNode": "5", "sourcePort": "5_out", "targetNode": "1", "targetPort": "1_in" }, { "conditions": [ { "index": 0 } ], "id": "port_2_to_port_7", "sourceNode": "2", "sourcePort": "2_out", "targetNode": "7", "targetPort": "7_in" }, { "id": "port_7_to_port_8", "sourceNode": "7", "sourcePort": "7_out", "targetNode": "8", "targetPort": "8_in" }, { "id": "port_8_to_port_3", "sourceNode": "8", "sourcePort": "8_out", "targetNode": "3", "targetPort": "3_in" }, { "id": "port_9_to_port_5", "sourceNode": "9", "sourcePort": "9_out", "targetNode": "5", "targetPort": "5_in" }, { "id": "port_3_to_port_9", "sourceNode": "3", "sourcePort": "3_out", "targetNode": "9", "targetPort": "9_in" } ], "hash": "81702a597569cf52a31eedffe0193bbff4825326", "nodes": { "0": { "data": { "advanced": { "join": [] }, "functionName": "on_start", "id": "0", "type": "start" }, "errors": {}, "id": "0", "type": "start", "warnings": {}, "x": 19.999999999999986, "y": -2.5579538487363607e-13 }, "1": { "data": { "advanced": { "join": [] }, "functionName": "on_finish", "id": "1", "type": "end" }, "errors": {}, "id": "1", "type": "end", "warnings": {}, "x": 19.999999999999986, "y": 1224 }, "2": { "data": { "advanced": { "customName": "input filter", "customNameId": 0, "description": "Determines if the provided inputs are present in the dataset.", "join": [], "note": "Determines if the provided inputs are present in the dataset." }, "conditions": [ { "comparisons": [ { "conditionIndex": 0, "op": "!=", "param": "playbook_input:device", "value": "" } ], "conditionIndex": 0, "customName": "input device present", "logic": "and" } ], "functionId": 1, "functionName": "input_filter", "id": "2", "type": "filter" }, "errors": {}, "id": "2", "type": "filter", "warnings": {}, "x": 60, "y": 148 }, "3": { "data": { "action": "quarantine device", "actionType": "contain", "advanced": { "customName": "quarantine device", "customNameId": 0, "description": "Quarantines device in Crowdstrike given either a Sensor ID (device_id) or hostname.", "join": [], "note": "Quarantines device in Crowdstrike given either a Sensor ID (device_id) or hostname." }, "connector": "CrowdStrike OAuth API", "connectorConfigs": [ "crowdstrike_oauth_api" ], "connectorId": "ae971ba5-3117-444a-8ac5-6ce779f3a232", "connectorVersion": "v1", "functionId": 1, "functionName": "quarantine_device", "id": "3", "loop": { "enabled": false, "exitAfterUnit": "m", "exitAfterValue": 10, "exitConditionEnabled": false, "exitLoopAfter": 2, "pauseUnit": "m", "pauseValue": 2 }, "parameters": { "device_id": "query_device:action_result.data.*.device_id", "hostname": "" }, "requiredParameters": [], "type": "action" }, "errors": {}, "id": "3", "type": "action", "warnings": {}, "x": 1.4210854715202004e-14, "y": 680 }, "5": { "customCode": null, "data": { "advanced": { "customName": "host observables", "customNameId": 0, "description": "Format a normalized output for each host", "join": [], "note": "Format a normalized output for each host." }, "functionId": 1, "functionName": "host_observables", "id": "5", "inputParameters": [ "quarantine_device:action_result.parameter.device_id", "query_device:action_result.data.*.hostname", "quarantine_device:action_result.status", "quarantine_device:action_result.message" ], "outputVariables": [ "observable_array" ], "type": "code" }, "errors": {}, "id": "5", "type": "code", "userCode": " \n host_observables__observable_array = []\n \n for device_id, hostname, status, status_message in zip(quarantine_device_parameter_device_id, query_device_result_item_0, quarantine_device_result_item_1, quarantine_device_result_message):\n # Initialize the observable dictionary\n observable = {\n \"source\": \"Crowdstrike OAuth API\", \n \"type\": \"Endpoint\", \n \"activity_name\": \"Network Isolation\",\n \"uid\": device_id,\n \"hostname\": hostname,\n \"status\": status,\n \"status_detail\": status_message,\n \"d3fend\": {\n \"d3f_tactic\": \"Isolate\",\n \"d3f_technique\": \"D3-NAM\",\n \"version\": \"1.0.0\"\n }\n }\n\n # Add the observable to the array\n host_observables__observable_array.append(observable)\n \n # Debug output for verification\n phantom.debug(host_observables__observable_array)\n \n", "warnings": {}, "x": 1.4210854715202004e-14, "y": 1048 }, "7": { "data": { "advanced": { "customName": "format fql", "customNameId": 0, "description": "Format the FQL query to get the input device information using its ID or hostname.", "join": [], "note": "Format the FQL query to get the input device information using its ID or hostname." }, "functionId": 2, "functionName": "format_fql", "id": "7", "parameters": [ "playbook_input:device" ], "template": "%%\nhostname:['{0}'],device_id:['{0}']\n%%", "type": "format" }, "errors": {}, "id": "7", "type": "format", "warnings": {}, "x": 1.4210854715202004e-14, "y": 328 }, "8": { "data": { "action": "query device", "actionType": "investigate", "advanced": { "customName": "query device", "customNameId": 0, "description": "Get information about the device to quarantine using its hostname or device id.", "join": [], "note": "Get information about the device to quarantine using its hostname or device id." }, "connector": "CrowdStrike OAuth API", "connectorConfigs": [ "crowdstrike_oauth_api" ], "connectorId": "ae971ba5-3117-444a-8ac5-6ce779f3a232", "connectorVersion": "v1", "functionId": 1, "functionName": "query_device", "id": "8", "loop": { "enabled": false, "exitAfterUnit": "m", "exitAfterValue": 10, "exitConditionEnabled": false, "exitLoopAfter": 2, "pauseUnit": "m", "pauseValue": 2 }, "parameters": { "filter": "format_fql:formatted_data.*", "limit": 50 }, "requiredParameters": [ { "data_type": "numeric", "default": 50, "field": "limit" } ], "type": "action" }, "errors": {}, "id": "8", "type": "action", "warnings": {}, "x": 1.4210854715202004e-14, "y": 504 }, "9": { "data": { "advanced": { "customName": "format quarantine report", "customNameId": 0, "description": "Format a summary table with the information gathered from the playbook.", "join": [], "note": "Format a summary table with the information gathered from the playbook." }, "functionId": 3, "functionName": "format_quarantine_report", "id": "9", "parameters": [ "quarantine_device:action_result.data.*.id", "quarantine_device:action_result.parameter.hostname", "quarantine_device:action_result.data.*.path", "quarantine_device:action_result.status" ], "template": "An attempt to isolate device(s) was performed via Splunk SOAR. The table below summarizes the information gathered.\n\n| Device ID | DNS Name | Device Path | Quarantine Status |\n| --- | --- | --- | --- |\n%%\n| {0} | {1} | {2} | {3} |\n%%", "type": "format" }, "errors": {}, "id": "9", "type": "format", "warnings": {}, "x": 1.4210854715202004e-14, "y": 856 } }, "notes": "Inputs: device (CrowdStrike Device ID or Hostname)\nInteractions: CrowdStrike OAuth API\nActions: quarantine device\nOutputs: observables, markdown report" }, "input_spec": [ { "contains": [ "host name" ], "description": "Device ID or hostname of the host to quarantine", "name": "device" } ], "output_spec": [ { "contains": [], "datapaths": [ "host_observables:custom_function:observable_array" ], "deduplicate": false, "description": "An array of observable dictionaries", "metadata": {}, "name": "observable" }, { "contains": [], "datapaths": [ "format_quarantine_report:formatted_data" ], "deduplicate": false, "description": "A report of the devices that were isolated via Splunk SOAR.", "metadata": {}, "name": "markdown_report" } ], "playbook_trigger": "artifact_created", "playbook_type": "data", "python_version": "3.13", "schema": "5.0.15", "version": "6.3.1.178" }, "create_time": "2025-04-08T14:45:48.561243+00:00", "draft_mode": false, "labels": [ "*" ], "tags": [ "CrowdStrike_OAuth_API", "host name", "containment", "D3-NAM" ] }