CrowdStrike Falcon Malware - Verify Containment Actions

This Playbook is part of the CrowdStrike Falcon Pack.

Supported versions

Supported Cortex XSOAR versions: 6.5.0 and later.

This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. This playbook verifies and sets the policy actions applied by CrowdStrike Falcon.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

This playbook does not use any integrations.

Scripts

• Set

Commands

This playbook does not use any commands.

Playbook Inputs

---

Name	Description	Default Value	Required
PolicyBehaviourDetails	The path that contains the detection results.		Optional

Playbook Outputs

---

Path	Description	Type
Policy.State	Is the policy active?	string
Host.State	Is the host isolated?	string
Process.State	Was the process contained?	string

Playbook Image

---