Server Message Block (SMB) Deprecated

Deprecated. Use the Server Message Block (SMB) v2 integration instead.

Details

ID	`Server Message Block (SMB)`
Provider	Microsoft
Category	Utilities
From Version	5.0.0
Docker Image	`demisto/smb:1.0.0.7685`
Supported Modules	Agentix Cloud Runtime Security Cloud Posture Security XSIAM EDR Cortex Cloud

README

Use the SMB integration to upload and download files from an SMB protocol.

The integration will utilize SMB2 protocol for communication if the remote SMB/CIFS service supports SMB2. Otherwise, the integration will automatically fall back to use SMB1 protocol.

Configure SMB on Cortex XSOAR

If you did not configure the Server IP / Hostname, Server NetBIOS (AD) Name, or Domain parameters, you can configure them later on as command arguments. In that case, the test command in the instance configuration will return an error.

Navigate to Settings > Integrations > Servers & Services.
Search for SMB.
Click Add instance to create and configure a new integration instance.
- Name: a textual name for the integration instance.
- Server IP / Hostname
- Port
- Server NetBIOS (AD) Name
- Domain
- Username
- Use system proxy settings
Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

Download a file: smb-download
Upload a file: smb-upload

1. Download a file

Downloads a file from an SMB server.

Base Command

smb-download

Input

Argument Name	Description	Required
hostname	Server IP address or hostname, for example, 1.2.3.4.	Optional
nbname	Name of the server NetBIOS (AD).	Optional
domain	The host domain.	Optional
file_path	The path to the file, starting from the share	Required
download_and_attach	If "yes", the file is downloaded and attached. If "no", only the output is attached. Default is "yes".	Optional

Command Example

!smb-download file_path=/Shared/test.txt

Context Output

playground - war room 2018-11-21 16-34-35

War Room Output

2. Upload a file

Uploads a file to an SMB server.

Base Command

smb-upload

Input

Argument Name	Description	Required
hostname	Server IP address or hostname, for example, 1.2.3.4.	Optional
nbname	Name of the server NetBIOS (AD).	Optional
domain	The host domain.	Optional
file-path	The path to the file, starting from the share, for example: Share/Folder/File.	Required
entryID	The entry ID to the file to send to the share.	Optional
content	The content of the file to send to the share	Optional

Troubleshooting

The following error might be due to an incorrect file path, or a permissions issue.

playground - war room 2018-11-21 16-35-18

Configuration parameters

hostname — Server IP / Hostname (e.g. 1.2.3.4)
port — Port (required)
nbname — Server NetBIOS (AD) Name
domain — Domain
credentials — Username (required)
proxy — Use system proxy settings

Commands (2)

smb-download Deprecated
Downloads a file from the SMB server.
smb-upload Deprecated
Uploads a file to the SMB server.

Source

SMB.py SMB.yml SMB_description.md

Download History Raw

import demistomock as demisto
from CommonServerPython import *
from CommonServerUserPython import *


''' IMPORTS '''


import tempfile
from smb.SMBConnection import SMBConnection

''' GLOBAL VARS '''


USER = demisto.params()['credentials']['identifier']
PASSWORD = demisto.params()['credentials']['password']
HOSTNAME = demisto.params()['hostname']
PORT = int(demisto.params()['port'])
NBNAME = demisto.params()['nbname']
DOMAIN = demisto.params().get('domain', None)


''' HELPER FUNCTIONS '''


def split_path(path):
    delim = '/' if '/' in path else '\\'
    path = path.strip(delim)
    return path.split(delim, 1)


def connect(hostname, domain, user, password, nb_name, port):
    if not domain:
        connection = SMBConnection(user, password, 'Demisto', nb_name, is_direct_tcp=True)
    else:
        connection = SMBConnection(user, password, 'Demisto', nb_name, domain=domain, is_direct_tcp=True)
    if not connection.connect(hostname, port):
        return_error('Authentication failed, verify instance configuration parameters and try again.')
    return connection


''' FUNCTIONS '''


def test_module():
    if HOSTNAME and NBNAME:
        connection = connect(hostname=HOSTNAME, domain=DOMAIN, user=USER, password=PASSWORD, nb_name=NBNAME, port=PORT)
        demisto.results('ok')
        connection.close()
    else:
        demisto.results('No hostname or NetBIOS name was configured, cannot perform a connection test.')


def smb_download():
    share, path = split_path(demisto.getArg('file_path'))
    hostname = demisto.args().get('hostname') if demisto.args().get('hostname') else HOSTNAME
    nbname = demisto.args().get('nbname') if demisto.args().get('nbname') else NBNAME
    domain = demisto.args().get('domain') if demisto.args().get('domain') else DOMAIN

    if not hostname:
        return_error('No hostname was configured for the integration, cannot establish connection.')
    elif not nbname:
        return_error('No NetBIOS name was configured for the integration, cannot establish connection.')
    connection = connect(hostname=hostname, domain=domain, user=USER, password=PASSWORD, nb_name=nbname, port=PORT)
    try:
        with tempfile.NamedTemporaryFile() as file_obj:
            file_attributes, filesize = connection.retrieveFile(share, path, file_obj)
            file_obj.seek(0)
            filename = path.split('/')[-1] if '/' in path else path.split('\\')[-1]
            if demisto.getArg('download_and_attach') == "yes":
                demisto.results(fileResult(filename, file_obj.read()))
            else:
                demisto.results(file_obj.read())
    finally:
        connection.close()


def smb_upload():
    share, path = split_path(demisto.getArg('file_path'))
    entryID = demisto.getArg('entryID')
    content = demisto.getArg('content')
    hostname = demisto.args().get('hostname') if demisto.args().get('hostname') else HOSTNAME
    nbname = demisto.args().get('nbname') if demisto.args().get('nbname') else NBNAME
    domain = demisto.args().get('domain') if demisto.args().get('domain') else DOMAIN

    if not hostname:
        return_error('No hostname was configured for the integration, cannot establish connection.')
    elif not nbname:
        return_error('No NetBIOS name was configured for the integration, cannot establish connection.')
    connection = connect(hostname=hostname, domain=domain, user=USER, password=PASSWORD, nb_name=nbname, port=PORT)
    try:
        if not entryID and not content:
            raise Exception("smb-upload requires one of the following arguments: content, entryID.")
        if entryID:
            file = demisto.getFilePath(entryID)
            filePath = file['path']
            with open(filePath, mode='rb') as f:
                content = f.read()

        with tempfile.NamedTemporaryFile() as file_obj:
            file_obj.write(content)
            file_obj.seek(0)
            file_bytes_transfered = connection.storeFile(share, path, file_obj)
            demisto.results("Transfered {} bytes of data.".format(file_bytes_transfered))
    finally:
        connection.close()


''' EXECUTION CODE '''

LOG('command is %s' % (demisto.command(),))

try:
    if demisto.command() == 'test-module':
        test_module()
    elif demisto.command() == 'smb-download':
        smb_download()
    elif demisto.command() == 'smb-upload':
        smb_upload()
except Exception as e:
    return_error(str(e))