Skip to main content

Eradication Plan

This Playbook is part of the Common Playbooks Pack.#

Supported versions

Supported Cortex XSOAR versions: 6.6.0 and later.

This playbook handles all the eradication actions available with Cortex XSIAM, including the following sub-playbooks:

  • Eradication Plan - Reset user password
  • Eradication Plan - Delete file
  • Eradication Plan - Kill process (currently, the playbook supports terminating a process by name)

Note: The playbook inputs enable manipulating the execution flow. Read the input descriptions for details.


This playbook uses the following sub-playbooks, integrations, and scripts.


  • Eradication Plan - Terminate Process
  • Eradication Plan - Reset Password
  • Eradication Plan - Delete File


This playbook does not use any integrations.


  • Set


This playbook does not use any commands.

Playbook Inputs#

NameDescriptionDefault ValueRequired
AutoEradicateSet to True to execute the eradication playbook automatically.TrueOptional
EndpointIDThe endpoint ID.alert.agentidOptional
FilePathThe file path for the file deletion and for the process termination task.foundIncidents.CustomFields.initiatorpathOptional
UsernameThe username to reset the password for.foundIncidents.CustomFields.usernameOptional
FileRemediationChoose 'Quarantine' or 'Delete' to avoid file remediation conflicts.
For example, choosing 'Delete' ignores the 'Quarantine file' task under the containment playbook and executes only file deletion.
UserRemediationSet to 'True' to reset the user's password.TrueOptional
ProcessTerminationChoose 'PID' to terminate the process using the Process ID, or 'Name' to terminate the process using its name.
Please note that providing the file path is mandatory for the process termination.
If 'PID' is chosen, the input `ProcessID` should not be empty; otherwise, the termination will not proceed.
ProcessIDThe process ID to terminate.Optional

Playbook Outputs#

TerminatedProcessFromEndpointsThe terminated process from endpointunknown

Playbook Image#

Eradication Plan