Cisco Secure Endpoint - Remove Hash from Simple Custom Detection
This incident response workflow allows you to remove hashes involved in an incident from a simple custom detection list in Cisco Secure Endpoint through a playbook or using an automation rule. When using this workflow in a playbook, the user selects which hashes to remove. When using this workflow with an incident automation rule, all hashes in the incident will be removed.
Description
This incident response workflow allows you to remove hashes involved in an incident from a simple custom detection list in Cisco Secure Endpoint through a playbook or using an automation rule. When using this workflow in a playbook, the user selects which hashes to remove. When using this workflow with an incident automation rule, all hashes in the incident will be removed.
Target: Secure Endpoint v1
Steps:
- Create a table for observables
- Detect the start type and extract the supported observables
- Check if any supported observables were found (if not, end the workflow)
- Get the file list's GUID (if this fails, end the workflow)
- For each hash:
- Attempt to remove the hash from the file list
- Check if the hash was removed from the list successfully and update the workflow results
This workflow requires the following targets to be available before it can be run.
Integration targets
- Secure Endpoint