Skip to main content

Code42 Exfiltration Playbook

This Playbook is part of the Code42 Pack.#

The Code42 Exfiltration playbook acts on Code42 Security Alerts, retrieves file event data, and allows security teams to remediate file exfiltration events by revoking access rights to cloud files or containing endpoints.


This playbook uses the following sub-playbooks, integrations, and scripts.


  • Active Directory - Get User Manager Details
  • Code42 File Download


  • jira-v2
  • CrowdstrikeFalcon
  • Code42


This playbook does not use any scripts.


  • code42-alert-resolve
  • cs-falcon-search-device
  • cs-falcon-contain-host
  • closeInvestigation
  • jira-create-issue
  • send-mail

Playbook Inputs#

NameDescriptionDefault ValueRequired
JiraProjectJira Project for created incident ticketSecurityOptional
JiraTypeType of Jira ticket to createInvestigationOptional
JiraSummarySummary to use with Jira ticket creationCode42 Security Alert for Demisto Incident ${}Optional
ContainHostsMaxMaximum number of network hosts to contain.2Optional
DemistoInstanceURLURL of Demisto instance for emails.

Playbook Outputs#

There are no outputs for this playbook.

Playbook Image#

Code42 Exfiltration Playbook