Skip to main content

Recovery Plan

This Playbook is part of the Common Playbooks Pack.#

Supported versions

Supported Cortex XSOAR versions: 6.6.0 and later.

This playbook handles all the recovery actions available with Cortex XSIAM, including the following tasks:

  • Unisolate endpoint
  • Restore quarantined file

Note: The playbook inputs enable manipulating the execution flow; read the input descriptions for details.


This playbook uses the following sub-playbooks, integrations, and scripts.


This playbook does not use any sub-playbooks.


This playbook does not use any integrations.


This playbook does not use any scripts.


  • core-unisolate-endpoint
  • core-restore-file

Playbook Inputs#

NameDescriptionDefault ValueRequired
unIsolateEndpointSet to True to cancel the endpoint isolation.TrueOptional
releaseFileSet to True to release the quarantined file.FalseOptional
endpointIDThe endpoint ID.Optional
FileHashThe file hash.Optional

Playbook Outputs#

There are no outputs for this playbook.

Playbook Image#

Recovery Plan