{ "blockly": false, "blockly_xml": "", "category": "Network Restore", "coa": { "data": { "description": "Accepts a hostname or device id as input and tries to restore access for (unquarantines) the device in Crowdstrike. We then generate an observable report as well as a Markdown formatted report of the results. Both can be customized based on user preference.", "edges": [ { "id": "port_0_to_port_2", "sourceNode": "0", "sourcePort": "0_out", "targetNode": "2", "targetPort": "2_in" }, { "id": "port_5_to_port_1", "sourceNode": "5", "sourcePort": "5_out", "targetNode": "1", "targetPort": "1_in" }, { "conditions": [ { "index": 0 } ], "id": "port_2_to_port_7", "sourceNode": "2", "sourcePort": "2_out", "targetNode": "7", "targetPort": "7_in" }, { "id": "port_7_to_port_8", "sourceNode": "7", "sourcePort": "7_out", "targetNode": "8", "targetPort": "8_in" }, { "id": "port_9_to_port_5", "sourceNode": "9", "sourcePort": "9_out", "targetNode": "5", "targetPort": "5_in" }, { "id": "port_8_to_port_10", "sourceNode": "8", "sourcePort": "8_out", "targetNode": "10", "targetPort": "10_in" }, { "id": "port_10_to_port_9", "sourceNode": "10", "sourcePort": "10_out", "targetNode": "9", "targetPort": "9_in" } ], "hash": "45988d55dd87c4bf4f04e4989535ed09243af0a4", "nodes": { "0": { "data": { "advanced": { "join": [] }, "functionName": "on_start", "id": "0", "type": "start" }, "errors": {}, "id": "0", "type": "start", "warnings": {}, "x": 19.999999999999986, "y": -2.5579538487363607e-13 }, "1": { "data": { "advanced": { "join": [] }, "functionName": "on_finish", "id": "1", "type": "end" }, "errors": {}, "id": "1", "type": "end", "warnings": {}, "x": 19.999999999999986, "y": 1224 }, "10": { "data": { "action": "unquarantine device", "actionType": "correct", "advanced": { "customName": "unquarantine device", "customNameId": 0, "description": "Remove network isolation from a device in CrowdStrike.", "join": [], "note": "Remove network isolation from a device in CrowdStrike." }, "connector": "CrowdStrike OAuth API", "connectorConfigs": [ "crowdstrike_oauth_api" ], "connectorId": "ae971ba5-3117-444a-8ac5-6ce779f3a232", "connectorVersion": "v1", "functionId": 1, "functionName": "unquarantine_device", "id": "10", "loop": { "enabled": false, "exitAfterUnit": "m", "exitAfterValue": 10, "exitConditionEnabled": false, "exitLoopAfter": 2, "pauseUnit": "m", "pauseValue": 2 }, "parameters": { "device_id": "query_device:action_result.data.*.device_id", "hostname": "" }, "requiredParameters": [], "tab": "byAction", "type": "action" }, "errors": {}, "id": "10", "type": "action", "warnings": {}, "x": 1.4210854715202004e-14, "y": 680 }, "2": { "data": { "advanced": { "customName": "input filter", "customNameId": 0, "description": "Determines if the provided inputs are present in the dataset.", "join": [], "note": "Determines if the provided inputs are present in the dataset." }, "conditions": [ { "comparisons": [ { "conditionIndex": 0, "op": "!=", "param": "playbook_input:device", "value": "" } ], "conditionIndex": 0, "customName": "input device present", "logic": "and" } ], "functionId": 1, "functionName": "input_filter", "id": "2", "type": "filter" }, "errors": {}, "id": "2", "type": "filter", "warnings": {}, "x": 60, "y": 148 }, "5": { "customCode": null, "data": { "advanced": { "customName": "host observables", "customNameId": 0, "description": "Format a normalized output for each host", "join": [], "note": "Format a normalized output for each host." }, "functionId": 1, "functionName": "host_observables", "id": "5", "inputParameters": [ "unquarantine_device:action_result.parameter.device_id", "query_device:action_result.data.*.hostname", "unquarantine_device:action_result.status", "unquarantine_device:action_result.message" ], "outputVariables": [ "observable_array" ], "type": "code" }, "errors": {}, "id": "5", "type": "code", "userCode": " \n host_observables__observable_array = []\n \n for device_id, hostname, status, status_message in zip(unquarantine_device_parameter_device_id, query_device_result_item_0, unquarantine_device_result_item_1, unquarantine_device_result_message):\n # Initialize the observable dictionary\n observable = {\n \"source\": \"Crowdstrike OAuth API\", \n \"type\": \"Endpoint\",\n \"activity_name\": \"Network Restore\",\n \"uid\": device_id,\n \"hostname\": hostname,\n \"status\": status,\n \"status_detail\": status_message,\n \"d3fend\": {\n \"d3f_tactic\": \"Restore\",\n \"d3f_technique\": \"D3-RNA\",\n \"version\": \"1.0.0\"\n }\n }\n\n # Add the observable to the array\n host_observables__observable_array.append(observable)\n \n # Debug output for verification\n phantom.debug(host_observables__observable_array)\n \n", "warnings": {}, "x": 1.4210854715202004e-14, "y": 1040 }, "7": { "data": { "advanced": { "customName": "format fql", "customNameId": 0, "description": "Format the FQL query to get the input device information using its ID or hostname.", "join": [], "note": "Format the FQL query to get the input device information using its ID or hostname." }, "functionId": 2, "functionName": "format_fql", "id": "7", "parameters": [ "playbook_input:device" ], "template": "%%\nhostname:['{0}'],device_id:['{0}']\n%%", "type": "format" }, "errors": {}, "id": "7", "type": "format", "warnings": {}, "x": 1.4210854715202004e-14, "y": 328 }, "8": { "data": { "action": "query device", "actionType": "investigate", "advanced": { "customName": "query device", "customNameId": 0, "description": "Get information about the device to unquarantine using its hostname or device id.", "join": [], "note": "Get information about the device to unquarantine using its hostname or device id." }, "connector": "CrowdStrike OAuth API", "connectorConfigs": [ "crowdstrike_oauth_api" ], "connectorId": "ae971ba5-3117-444a-8ac5-6ce779f3a232", "connectorVersion": "v1", "functionId": 1, "functionName": "query_device", "id": "8", "loop": { "enabled": false, "exitAfterUnit": "m", "exitAfterValue": 10, "exitConditionEnabled": false, "exitLoopAfter": 2, "pauseUnit": "m", "pauseValue": 2 }, "parameters": { "filter": "format_fql:formatted_data.*", "limit": 50 }, "requiredParameters": [ { "data_type": "numeric", "default": 50, "field": "limit" } ], "type": "action" }, "errors": {}, "id": "8", "type": "action", "warnings": {}, "x": 1.4210854715202004e-14, "y": 504 }, "9": { "data": { "advanced": { "customName": "format unquarantine report", "customNameId": 0, "description": "Format a summary table with the information gathered from the playbook.", "join": [], "note": "Format a summary table with the information gathered from the playbook." }, "functionId": 3, "functionName": "format_unquarantine_report", "id": "9", "parameters": [ "unquarantine_device:action_result.parameter.device_id", "unquarantine_device:action_result.parameter.hostname", "unquarantine_device:action_result.data.*.path", "unquarantine_device:action_result.status" ], "template": "An attempt to remove device(s) from isolation was performed via Splunk SOAR. The table below summarizes the information gathered.\n\n| Device ID | DNS Name | Device Path | Unquarantine Status |\n| --- | --- | --- | --- |\n%%\n| {0} | {1} | {2} | {3} |\n%%", "type": "format" }, "errors": {}, "id": "9", "type": "format", "warnings": {}, "x": 1.4210854715202004e-14, "y": 856 } }, "notes": "Inputs: device (CrowdStrike Device ID or Hostname)\nInteractions: CrowdStrike OAuth API\nActions: unquarantine device\nOutputs: observables, markdown report" }, "input_spec": [ { "contains": [], "description": "Device ID or hostname of the host to quarantine", "name": "device" } ], "output_spec": [ { "contains": [], "datapaths": [ "host_observables:custom_function:observable_array" ], "deduplicate": false, "description": "An array of observable dictionaries", "metadata": {}, "name": "observable" }, { "contains": [], "datapaths": [ "format_unquarantine_report:formatted_data" ], "deduplicate": false, "description": "A report of the devices that were isolated via Splunk SOAR.", "metadata": {}, "name": "markdown_report" } ], "playbook_trigger": "artifact_created", "playbook_type": "data", "python_version": "3.13", "schema": "5.0.15", "version": "6.3.1.178" }, "create_time": "2025-04-08T13:59:03.337026+00:00", "draft_mode": false, "labels": [ "*" ], "tags": [ "CrowdStrike_OAuth_API", "host name", "restore", "D3-RNA" ] }