RemoteAccess v2

This integration transfers files between Cortex XSOAR and a remote machine and executes commands on the remote machine.

Some changes have been made that might affect your existing content.
If you are upgrading from a previous version of this integration, see Breaking Changes.

Note: This integration was integrated and tested on a remote machine with Centos-7 operating system. It does not work with Windows operation system.

Configure RemoteAccess v2 in Cortex

Configure SSH From Remote

For login using root:

1. Edit the /etc/ssh/sshd_config file.

• set PermitRootLogin to yes
• set PasswordAuthentication to yes

1. Restart the sshd server: service sshd restart

Configure the instance with SSH certificate

Currently, the only type of certificate that is supported is RSA private keys (.PEM) files.
In case access is required to an instance in the cloud, use the PEM file provided by the cloud provider.

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

ssh

Run the specified command on the remote system with SSH.

Base Command

ssh

Input

Context Output

Command Example

!ssh command="echo test"

Context Example

{
    "RemoteAccess": {
        "Command": [
            {
                "command": "echo test",
                "error": "",
                "output": "test\n",
                "success": true
            }
        ]
    }
}

Human Readable Output

Command echo test Outputs

command	output	success
echo test	test	true

copy-to

Copies the given file from Cortex XSOAR to the remote machine.

Base Command

copy-to

Input

Context Output

There is no context output for this command.

Command Example

!copy-to entry_id=104@49493d71-eef6-4bb4-8075-4be38d9bc340 destination_path="test/cortex_copied_file"

Human Readable Output

The file corresponding to entry ID: 104@49493d71-eef6-4bb4-8075-4be38d9bc340 was copied to remote host

copy-from

Copies the given file from the remote machine to Cortex XSOAR.

Base Command

copy-from

Input

Context Output

Command Example

!copy-from file_path="test/remote_file.txt" file_name="CopiedRemoteFile"

Context Example

{
    "File": {
        "EntryID": "165@49493d71-eef6-4bb4-8075-4be38d9bc340",
        "Info": "text/plain",
        "MD5": "c5253b90e791d18439a84511c382616b",
        "Name": "CopiedRemoteFile",
        "SHA1": "98c94e6e64b7a52576870fc07a0da5f33243c505",
        "SHA256": "bf98cd7cda320c300218397d9ee1df263415aac7f0f41c8f57dee7944e68fba0",
        "SHA512": "6f2199d786a13c7b8cd6d268166a26f4423d4aa1e4ba59565e9130da01555d83d190870dade6098fe7992425e0d2d9128841b92f419dbf4193a6112c4cf7264f",
        "SSDeep": "3:9bLbEin:6i",
        "Size": 16,
        "Type": "ASCII text, with no line terminators"
    }
}

Human Readable Output

Breaking changes from the previous version of this integration - RemoteAccess v2

• Removed the Interactive terminal mode instance parameter.
• Removed the Terminal Type instance parameter.

Commands

Arguments

The following argument names were changed, added, or removed in this version

Outputs

The following outputs were removed in this version