Skip to main content

Eradication Plan - Terminate Process

This Playbook is part of the Common Playbooks Pack.#

Supported versions

Supported Cortex XSOAR versions: 6.6.0 and later.

This playbook is one of the sub-playbooks in the eradication plan. This playbook handles the termination of the processes as a crucial step in the eradication action. The playbook executes actions of process termination, which is a crucial step in the eradication process. The process termination can be performed based on either the process ID or the process name.


This playbook uses the following sub-playbooks, integrations, and scripts.


This playbook does not use any sub-playbooks.


This playbook does not use any integrations.


  • PrintErrorEntry
  • Set


  • setParentIncidentContext
  • core-run-script-execute-commands
  • core-get-script-execution-results
  • core-run-script-kill-process

Playbook Inputs#

NameDescriptionDefault ValueRequired
ProcessTerminationChoose 'PID' to terminate the process by PID or 'Name' to terminate the process by process name.
Note: If neither option is selected, the process will not be terminated.
EndpointIDThe endpoint ID to run commands over.Optional
FilePathThe file path for the process termination.Optional
ProcessIDThe process ID to terminate.Optional

Playbook Outputs#

TerminatedProcessFromEndpointsThe terminated process from endpointunknown

Playbook Image#

Eradication Plan - Terminate Process