GCenter

This integration allows, via about twenty commands, to interact with the GCenter appliance via its API.
This integration was integrated and tested with version v2.5.3.102 of GCenter.
To simplify GCenter v2.5.3.102 is called GCenter in the Pack.

Configure GCenter in Cortex

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

gw-get-alert

Get an alert by it’s uid

Base Command

gw-get-alert

Input

Context Output

Command Example

!gw-get-alert uid="d7e612cb-567a-431b-a14b-9f9f4e88c9a4"

Context Example

{
    "sha256": "f16d19ac9697d9892b0f910601a61d041d64",
    "id": "45e6ed3c-1082-4d33-9514-162748d7d41f",
    "flow_id": 1544096072809159,
    "severity": 1,
    "src_ip": "192.168.0.2",
    "dest_ip": "192.168.0.1",
    "src_port": 80,
    "dest_port": 35168,
    "gcap": "test.domain.com",
    "type": "malcore",
    "proto": "TCP",
    "host": "test.domain.com",
    "app_proto": "http",
    "alert_type": "malware",
    "state": "Infected",
    "matched_event": "3d35e491-cfc8-4271-815b-ff018a036c7c",
    "domain_name": "nzpzxcox.com",
    "probability": 0.55555555,
    "timestamp_detected": "2022-03-21T11:34:47.000Z",
    "timestamp_analyzed": "2022-03-21T13:58:42.742Z",
    "dest_geoip": {},
    "src_geoip": {},
    "retrohunt": {
        "timestamp_package": "2022-06-06T22:00:01.632829+0000",
        "ioc_creation_date": "2022-05-27T18:37:30+00:00",
        "ioc_updated_date": "2022-06-06T21:05:12+00:00",
        "description": "'test.domain.com' is a Suspicious Host.",
        "ioc_type": "Host",
        "ioc_value": "test.domain.com",
        "matched_app_proto": "http",
        "matched_event_type": "http",
        "meta_data": {},
        "targeted_organizations": [],
        "targeted_platforms": [],
        "targeted_sectors": [],
        "threat_actor": [],
        "external_links": [],
        "relations": [],
        "campaigns": [],
        "categories": [],
        "families": [],
        "vulnerabilities": [],
        "ttp": [],
        "case_id": "1746d38d-58f3-4b43-b4ee-6f0b43527d49",
        "ioc_id": "183abf8e-b0a5-4ed0-a93f-e5d7927648b8",
        "risk": "Suspicious",
        "usage_mode": "hunting",
        "tlp": "green"
    },
    "powershell": {
        "file_id": "06-08-2022T11:37:11_1348935773_gcap-dean.org",
        "scores": {
            "proba_obfuscated": 0.2,
            "analysis": 241,
            "analysis_detailed": {}
        }
    },
    "shellcode": {
        "file_id": "file_id",
        "encodings": [
            {
                "name": "Bloxor",
                "count": 2
            }
        ],
        "calls": [
            {
                "call": "ws2_32_recv",
                "args": "{'sockfd': 'Socket_1-bind (4)', 'backlog': 19103712}",
                "ret": "90137289",
                "index": 0
            }
        ]
    },
    "malware": {
        "analyzed_clean": 11,
        "analyzed_infected": 5,
        "analyzed_suspicious": 0,
        "analyzed_other": 0,
        "analyzed_error": 0,
        "code": 1,
        "def_time": "2022-05-31T21:45:33Z",
        "scan_time": 3785,
        "threats_found": "Infected : Gen:Variant.Ulise.315566 (B)",
        "reporting_token": "No GBOX",
        "engines_report": {
            "0": {
                "id": "XXX",
                "threat_details": "Gen:Variant.Ulise.315566 (B)",
                "scan_result": "INFECTED"
            },
            "1": {
                "id": "XXX",
                "threat_details": "",
                "scan_result": "CLEAN"
            },
            "2": {
                "id": "XXX",
                "threat_details": "",
                "scan_result": "CLEAN"
            },
            "3": {
                "id": "XXX",
                "threat_details": "",
                "scan_result": "CLEAN"
            },
            "4": {
                "id": "XXX",
                "threat_details": "WinGo/TrojanDownloader.Agent.BD trojan",
                "scan_result": "INFECTED"
            },
            "5": {
                "id": "XXX",
                "threat_details": "",
                "scan_result": "CLEAN"
            },
            "6": {
                "id": "XXX",
                "threat_details": "",
                "scan_result": "CLEAN"
            },
            "7": {
                "id": "XXX",
                "threat_details": "Trojan.Donut.Win64.545",
                "scan_result": "INFECTED"
            },
            "8": {
                "id": "XXX",
                "threat_details": "",
                "scan_result": "CLEAN"
            },
            "9": {
                "id": "XXX",
                "threat_details": "",
                "scan_result": "CLEAN"
            },
            "10": {
                "id": "XXX",
                "threat_details": "",
                "scan_result": "CLEAN"
            },
            "11": {
                "id": "XXX",
                "threat_details": "",
                "scan_result": "CLEAN"
            },
            "12": {
                "id": "XXX",
                "threat_details": "",
                "scan_result": "CLEAN"
            },
            "13": {
                "id": "XXX",
                "threat_details": "",
                "scan_result": "CLEAN"
            },
            "14": {
                "id": "XXX",
                "threat_details": "W64/Donut.B.gen!Eldorado",
                "scan_result": "INFECTED"
            },
            "15": {
                "id": "XXX",
                "threat_details": "Trojan.Win64.Crypt",
                "scan_result": "INFECTED"
            }
        },
        "magic_details": "PE32+ executable (DLL) (GUI) x86-64, for MS Windows",
        "total_found": "5/16"
    },
    "sigflow": {
        "alert": {
            "action": "allowed",
            "signature_id": "202",
            "gid": "1",
            "category": "A Network Trojan was detected"
        },
        "packet": "XXXXXXXXXXXXXXXXXX",
        "in_iface": "mon5",
        "stream": 0,
        "payload": "XXXXXXXXXXXXXXXXXX",
        "payload_printable": "XXXXXXXXXXXXXXXXXX",
        "extra_keys": {}
    }
}

Human Readable Output

Elasticsearch alert entry

alert_type	app_proto	dest_geoip	dest_ip	dest_port	domain_name	flow_id	gcap	host	id	malware	matched_event	powershell	probability	proto	retrohunt	severity	sha256	shellcode	sigflow	src_geoip	src_ip	src_port	state	timestamp_analyzed	timestamp_detected	type
malware	http		192.168.0.1	35168	nzpzxcox.com	1544096072809159	test.domain.com	test.domain.com	45e6ed3c-1082-4d33-9514-162748d7d41f	analyzed_clean: 11 analyzed_infected: 5 analyzed_suspicious: 0 analyzed_other: 0 analyzed_error: 0 code: 1 def_time: 2022-05-31T21:45:33Z scan_time: 3785 threats_found: Infected : Gen:Variant.Ulise.315566 (B) reporting_token: No GBOX engines_report: {“0”: {“id”: “XXX”, “threat_details”: “Gen:Variant.Ulise.315566 (B)”, “scan_result”: “INFECTED”}, “1”: {“id”: “XXX”, “threat_details”: “”, “scan_result”: “CLEAN”}, “2”: {“id”: “XXX”, “threat_details”: “”, “scan_result”: “CLEAN”}, “3”: {“id”: “XXX”, “threat_details”: “”, “scan_result”: “CLEAN”}, “4”: {“id”: “XXX”, “threat_details”: “WinGo/TrojanDownloader.Agent.BD trojan”, “scan_result”: “INFECTED”}, “5”: {“id”: “XXX”, “threat_details”: “”, “scan_result”: “CLEAN”}, “6”: {“id”: “XXX”, “threat_details”: “”, “scan_result”: “CLEAN”}, “7”: {“id”: “XXX”, “threat_details”: “Trojan.Donut.Win64.545”, “scan_result”: “INFECTED”}, “8”: {“id”: “XXX”, “threat_details”: “”, “scan_result”: “CLEAN”}, “9”: {“id”: “XXX”, “threat_details”: “”, “scan_result”: “CLEAN”}, “10”: {“id”: “XXX”, “threat_details”: “”, “scan_result”: “CLEAN”}, “11”: {“id”: “XXX”, “threat_details”: “”, “scan_result”: “CLEAN”}, “12”: {“id”: “XXX”, “threat_details”: “”, “scan_result”: “CLEAN”}, “13”: {“id”: “XXX”, “threat_details”: “”, “scan_result”: “CLEAN”}, “14”: {“id”: “XXX”, “threat_details”: “W64/Donut.B.gen!Eldorado”, “scan_result”: “INFECTED”}, “15”: {“id”: “XXX”, “threat_details”: “Trojan.Win64.Crypt”, “scan_result”: “INFECTED”}} magic_details: PE32+ executable (DLL) (GUI) x86-64, for MS Windows total_found: 5/16	3d35e491-cfc8-4271-815b-ff018a036c7c	file_id: 06-08-2022T11:37:11_1348935773_gcap-dean.org scores: {“proba_obfuscated”: 0.2, “analysis”: 241, “analysis_detailed”: {}}	0.55555555	TCP	timestamp_package: 2022-06-06T22:00:01.632829+0000 ioc_creation_date: 2022-05-27T18:37:30+00:00 ioc_updated_date: 2022-06-06T21:05:12+00:00 description: ‘test.domain.com’ is a Suspicious Host. ioc_type: Host ioc_value: test.domain.com matched_app_proto: http matched_event_type: http meta_data: {} targeted_organizations: targeted_platforms: targeted_sectors: threat_actor: external_links: relations: campaigns: categories: families: vulnerabilities: ttp: case_id: 1746d38d-58f3-4b43-b4ee-6f0b43527d49 ioc_id: 183abf8e-b0a5-4ed0-a93f-e5d7927648b8 risk: Suspicious usage_mode: hunting tlp: green	1	f16d19ac9697d9892b0f910601a61d041d64	file_id: file_id encodings: {‘name’: ‘Bloxor’, ‘count’: 2} calls: {‘call’: ‘ws2_32_recv’, ‘args’: “{‘sockfd’: ‘Socket_1-bind (4)’, ‘backlog’: 19103712}”, ‘ret’: ‘90137289’, ‘index’: 0}	alert: {“action”: “allowed”, “signature_id”: “202”, “gid”: “1”, “category”: “A Network Trojan was detected”} packet: XXXXXXXXXXXXXXXXXX in_iface: mon5 stream: 0 payload: XXXXXXXXXXXXXXXXXX payload_printable: XXXXXXXXXXXXXXXXXX extra_keys: {}		192.168.0.2	80	Infected	2022-03-21T13:58:42.742Z	2022-03-21T11:34:47.000Z	malcore

gw-es-query

Get Elasticsearch data

Base Command

gw-es-query

Input

Context Output

There is no context output for this command.

Command Example

!gw-es-query index="suricata" query="{}"

gw-add-malcore-list-entry

Add malcore whitelist/blacklist entry

Base Command

gw-add-malcore-list-entry

Input

Context Output

Command Example

!gw-add-malcore-list-entry type="white" sha256="d955e262d7a05fc436e65c2a312593e4c7031482d90cebd29e69059053b1351e"

Context Example

{
    "sha256": "d955e262d7a05fc436e65c2a312593e4c7031482d90cebd29e69059053b1351e",
    "created": "2022-03-21T16:36:58.957178Z",
    "comment": "test",
    "threat": "undefined"
}

Human Readable Output

Malcore whitelist/blacklist entry

comment	created	sha256	threat
test	2022-03-21T16:36:58.957178Z	d955e262d7a05fc436e65c2a312593e4c7031482d90cebd29e69059053b1351e	undefined

gw-del-malcore-list-entry

Delete malcore whitelist/blacklist entry

Base Command

gw-del-malcore-list-entry

Input

Context Output

There is no context output for this command.

Command Example

!gw-del-malcore-list-entry type="white" sha256="d955e262d7a05fc436e65c2a312593e4c7031482d90cebd29e69059053b1351e"

gw-add-dga-list-entry

Add dga whitelist/blacklist entry

Base Command

gw-add-dga-list-entry

Input

Context Output

Command Example

!gw-add-dga-list-entry type="white" domain="test.domain.com"

Context Example

{
    "domain_name": "test.domain.com",
    "created": "2022-03-21T16:30:20.012035Z",
    "comment": "test",
    "is_wildcard": false
}

Human Readable Output

DGA whitelist/blacklist entry

comment	created	domain_name	is_wildcard
test	2022-03-21T16:30:20.012035Z	test.domain.com	false

gw-del-dga-list-entry

Delete dga whitelist/blacklist entry

Base Command

gw-del-dga-list-entry

Input

Context Output

There is no context output for this command.

Command Example

!gw-del-dga-list-entry type="white" domain="test.domain.com"

gw-add-ignore-asset-name

Ignore asset name

Base Command

gw-add-ignore-asset-name

Input

Context Output

Command Example

!gw-add-ignore-asset-name name="test_asset"

Context Example

{
    "id": "1",
    "created_at": "2022-03-21T16:37:54.657263Z",
    "created_by": "admin",
    "name": "test_asset",
    "is_startswith_pattern": true,
    "is_endswith_pattern": false
}

Human Readable Output

Asset name entry

created_at	created_by	id	is_endswith_pattern	is_startswith_pattern	name
2022-03-21T16:37:54.657263Z	admin	1	false	true	test_asset

gw-add-ignore-kuser-ip

Ignore kuser IP

Base Command

gw-add-ignore-kuser-ip

Input

Context Output

Command Example

!gw-add-ignore-kuser-ip ip="10.10.10.0"

Context Example

{
    "id": "2",
    "created_at": "2022-03-21T16:38:35.484082Z",
    "created_by": "admin",
    "ip": "10.10.10.0"
}

Human Readable Output

Kuser IP entry

created_at	created_by	id	ip
2022-03-21T16:38:35.484082Z	admin	2	10.10.10.0

gw-add-ignore-kuser-name

Ignore kuser name

Base Command

gw-add-ignore-kuser-name

Input

Context Output

Command Example

!gw-add-ignore-kuser-name name="test_kuser"

Context Example

{
    "id": "1",
    "created_at": "2022-03-21T16:39:18.435420Z",
    "created_by": "admin",
    "name": "test_kuser",
    "is_startswith_pattern": true,
    "is_endswith_pattern": false
}

Human Readable Output

Kuser name entry

created_at	created_by	id	is_endswith_pattern	is_startswith_pattern	name
2022-03-21T16:39:18.435420Z	admin	1	false	true	test_kuser

gw-add-ignore-mac-address

Ignore mac address

Base Command

gw-add-ignore-mac-address

Input

Context Output

Command Example

!gw-add-ignore-mac-address mac="50:50:50:50:50:50"

Context Example

{
    "id": "1",
    "created_at": "2022-03-21T16:39:48.363094Z",
    "created_by": "admin",
    "address": "00:50:50:50:50:50",
    "is_startswith_pattern": true
}

Human Readable Output

MAC adrress entry

address	created_at	created_by	id	is_startswith_pattern
00:50:50:50:50:50	2022-03-21T16:39:48.363094Z	admin	1	true

gw-del-ignore-asset-name

Delete an ignore asset ID

Base Command

gw-del-ignore-asset-name

Input

Context Output

There is no context output for this command.

Command Example

!gw-del-ignore-asset-name ignore_id=1

gw-del-ignore-kuser-ip

Delete an ignore kuser IP ID

Base Command

gw-del-ignore-kuser-ip

Input

Context Output

There is no context output for this command.

Command Example

!gw-del-ignore-kuser-ip ignore_id=1

gw-del-ignore-kuser-name

Delete an ignore kuser name ID

Base Command

gw-del-ignore-kuser-name

Input

Context Output

There is no context output for this command.

Command Example

!gw-del-ignore-kuser-name ignore_id=1

gw-del-ignore-mac-address

Delete an ignore mac address ID

Base Command

gw-del-ignore-mac-address

Input

Context Output

There is no context output for this command.

Command Example

!gw-del-ignore-mac-address ignore_id=1

gw-send-malware

Send malware

Base Command

gw-send-malware

Input

Context Output

Command Example

!gw-send-malware filename="test" file_id="331@dfca9ea2-5198-4d64-8c36-5282ac3b2dc5"

Context Example

{
    "id": "1",
    "created": "2022-03-21T16:42:11.996076Z",
    "username": "admin",
    "user_agent": "Mozilla/5.0",
    "ip_address": "10.10.10.10",
    "file_name": "Arch.jpg",
    "sha256": "1a9487d49d842ebdee5ad870065eb74dc7044",
    "is_clean": null,
    "is_analysis_successful": false,
    "malcore_code_result": "5",
    "threat_name": "",
    "nb_alerts": 0,
    "nb_engines": 0,
    "is_whiteblack_listed": false,
    "malcore_code_result_name": "Unknown",
    "status": "Unknown"
}

Human Readable Output

Malcore analysis result

created	file_name	id	ip_address	is_analysis_successful	is_clean	is_whiteblack_listed	malcore_code_result	malcore_code_result_name	nb_alerts	nb_engines	sha256	status	threat_name	user_agent	username
2022-03-21T16:42:11.996076Z	Arch.jpg	1	10.10.10.10	false		false	5	Unknown	0	0	1a9487d49d842ebdee5ad870065eb74dc7044	Unknown		Mozilla/5.0	admin

gw-send-powershell

Send powershell

Base Command

gw-send-powershell

Input

Context Output

Command Example

!gw-send-powershell filename="test" file_id="331@dfca9ea2-5198-4d64-8c36-5282ac3b2dc5"

Context Example

{
    "id": "2",
    "created": "2022-03-21T16:43:35.591406Z",
    "username": "admin",
    "user_agent": "Mozilla/5.0",
    "ip_address": "10.10.10.10",
    "file_name": "Arch.jpg",
    "sha256": "1a9487d49d842ebdee5ad870065eb74dc7044",
    "is_clean": true,
    "is_analysis_successful": true,
    "status": "Clean",
    "proba_obfuscated": 0,
    "analysis_score": 0,
    "is_whiteblack_listed": false
}

Human Readable Output

Powershell analysis result

analysis_score	created	file_name	id	ip_address	is_analysis_successful	is_clean	is_whiteblack_listed	proba_obfuscated	sha256	status	user_agent	username
0	2022-03-21T16:43:35.591406Z	Arch.jpg	2	10.10.10.10	true	true	false	0	1a9487d49d842ebdee5ad870065eb74dc7044	Clean	Mozilla/5.0	admin

gw-send-shellcode

Send shellcode

Base Command

gw-send-shellcode

Input

Context Output

Command Example

!gw-send-shellcode filename="test" file_id="331@dfca9ea2-5198-4d64-8c36-5282ac3b2dc5" deep=false timeout=120

Context Example

{
    "id": "3",
    "created": "2022-03-21T16:44:26.214241Z",
    "username": "admin",
    "user_agent": "Mozilla/5.0",
    "ip_address": "10.10.10.10",
    "file_name": "Arch.jpg",
    "sha256": "1a9487d49d842ebdee5ad870065eb74dc7044",
    "is_clean": true,
    "is_analysis_successful": true,
    "status": "Clean",
    "architecture": null,
    "encodings": [],
    "is_whiteblack_listed": false
}

Human Readable Output

Shellcode analysis result

architecture	created	encodings	file_name	id	ip_address	is_analysis_successful	is_clean	is_whiteblack_listed	sha256	status	user_agent	username
	2022-03-21T16:44:26.214241Z		Arch.jpg	3	10.10.10.10	true	true	false	1a9487d49d842ebdee5ad870065eb74dc7044	Clean	Mozilla/5.0	admin

gw-es-wrapper

Get Elasticsearch data using a wrapper

Base Command

gw-es-wrapper

Input

Context Output

There is no context output for this command.

Command Example

!gw-es-wrapper index="malware" aggs_term="src_ip" must_match="state=Infected" timerange="240" formatted="True"

Context Example

{
    "src_ip": [
        "10.10.10.10"
    ]
}

Human Readable Output

Elasticsearch wrapper result

src_ip
10.10.10.10

gw-get-malcore-list-entry

Get the malcore whitelist/blacklist

Base Command

gw-get-malcore-list-entry

Input

Context Output

Command Example

!gw-get-malcore-list-entry type=black

Context Example

[
    {
        "sha256": "d955e262d7a05fc436e65c2a312593e4c7031482d90cebd29e69059053b1351f",
        "created": "2022-09-13T08:16:21.400100Z",
        "comment": "added by cortex",
        "threat": "undefined"
    },
    {
        "sha256": "d955e262d7a05fc436e65c2a312593e4c7031482d90cebd29e69059053b1351e",
        "created": "2022-09-13T08:16:09.880381Z",
        "comment": "added by cortex",
        "threat": "undefined"
    }
]

Human Readable Output

Malcore whitelist/blacklist entry

comment	created	sha256	threat
added by cortex	2022-09-13T08:16:21.400100Z	d955e262d7a05fc436e65c2a312593e4c7031482d90cebd29e69059053b1351f	undefined
added by cortex	2022-09-13T08:16:09.880381Z	d955e262d7a05fc436e65c2a312593e4c7031482d90cebd29e69059053b1351e	undefined

gw-get-dga-list-entry

Get the dga whitelist/blacklist

Base Command

gw-get-dga-list-entry

Input

Context Output

Command Example

!gw-get-dga-list-entry type=black

Context Example

[
    {
        "domain_name": "test.domain.com",
        "created": "2022-03-21T16:30:20.012035Z",
        "comment": "added by cortex",
        "is_wildcard": false
    }
]

Human Readable Output

DGA whitelist/blacklist entry

comment	created	domain_name	is_wildcard
added by cortex	2022-03-21T16:30:20.012035Z	test.domain.com	false

gw-get-ignore-asset-name

Get all the ignored asset names

Base Command

gw-get-ignore-asset-name

Input

There are no input arguments for this command.

Context Output

Command Example

##### Context Example

```json
[
    {
        "id": "1",
        "created_at": "2022-09-13T13:31:18.427519Z",
        "created_by": "admin",
        "name": "test",
        "is_startswith_pattern": false,
        "is_endswith_pattern": true
    },
    {
        "id": "2",
        "created_at": "2022-09-13T13:31:31.049593Z",
        "created_by": "admin",
        "name": "test2",
        "is_startswith_pattern": true,
        "is_endswith_pattern": false
    }
]

Human Readable Output

Asset name entry

created_at	created_by	id	is_endswith_pattern	is_startswith_pattern	name
2022-09-13T13:31:18.427519Z	admin	1	true	false	test
2022-09-13T13:31:31.049593Z	admin	2	false	true	test2

gw-get-ignore-kuser-ip

Get all the ignored kuser IP

Base Command

gw-get-ignore-kuser-ip

Input

There are no input arguments for this command.

Context Output

Command Example

##### Context Example

```json
[
    {
        "id": "1",
        "created_at": "2022-09-13T12:06:29.575735Z",
        "created_by": "admin",
        "ip": "10.10.10.0"
    },
    {
        "id": "2",
        "created_at": "2022-09-13T13:30:26.791512Z",
        "created_by": "admin",
        "ip": "10.10.10.0"
    }
]

Human Readable Output

Kuser IP entry

created_at	created_by	id	ip
2022-09-13T12:06:29.575735Z	admin	1	10.10.10.0
2022-09-13T13:30:26.791512Z	admin	2	10.10.10.0

gw-get-ignore-kuser-name

Get all the ignored kuser name

Base Command

gw-get-ignore-kuser-name

Input

There are no input arguments for this command.

Context Output

Command Example

##### Context Example

```json
[
    {
        "id": "1",
        "created_at": "2022-09-13T13:27:50.136561Z",
        "created_by": "admin",
        "name": "test",
        "is_startswith_pattern": true,
        "is_endswith_pattern": false
    },
    {
        "id": "2",
        "created_at": "2022-09-13T13:28:02.072013Z",
        "created_by": "admin",
        "name": "test2",
        "is_startswith_pattern": false,
        "is_endswith_pattern": true
    }
]

Human Readable Output

Kuser name entry

created_at	created_by	id	is_endswith_pattern	is_startswith_pattern	name
2022-09-13T13:27:50.136561Z	admin	1	false	true	test
2022-09-13T13:28:02.072013Z	admin	2	true	false	test2

gw-get-ignore-mac-address

Get all the ignored mac addresses

Base Command

gw-get-ignore-mac-address

Input

There are no input arguments for this command.

Context Output

Command Example

##### Context Example

```json
[
    {
        "id": "1",
        "created_at": "2022-09-13T13:25:55.679624Z",
        "created_by": "admin",
        "address": "00:50:50:50:50:50",
        "is_startswith_pattern": true
    },
    {
        "id": "2",
        "created_at": "2022-09-13T13:26:11.338296Z",
        "created_by": "admin",
        "address": "00:40:40:40:40:40",
        "is_startswith_pattern": true
    }
]

Human Readable Output

MAC adrress entry

address	created_at	created_by	id	is_startswith_pattern
00:50:50:50:50:50	2022-09-13T13:25:55.679624Z	admin	1	true
00:40:40:40:40:40	2022-09-13T13:26:11.338296Z	admin	2	true

gw-get-file-infected

Get a file from an uuid.
If there is no uuid, get all the files infected from a time interval.

Base Command

gw-get-file-infected

Input

Context Output

Command Example

!gw-get-file-infected timerange="1440"

Context Example

[
    {
        "Content": "",
        "ContentFormat": "text",
        "File": "malcore_b34fc6de9763e3640f93dda3f7a97470af6f009089bca588272a03807ae9f5bf_2022-12-12_18-21-40.zip",
        "FileID": "f956f5cd-bad2-4f9c-ab75-cc6b16e58873",
        "Type": "3"
    }
]

Human Readable Output

Files infected entry

Contents	ContentsFormat	File	FileID	Type
	text	malcore_b34fc6de9763e3640f93dda3f7a97470af6f009089bca588272a03807ae9f5bf_2022-12-12_18-21-40.zip	f956f5cd-bad2-4f9c-ab75-cc6b16e58873	3