Code42 File Search v2

This playbook searches for files via Code42 security events by either MD5 or SHA256 hash. The data is output to the Code42.FileEvents context for use.

Pack

Code42

Tasks

7

Inputs

• MD5 — MD5 hash to search for
• SHA256 — SHA256 hash to search for

Outputs

• Code42.FileEvents — Returned File Results.
• Code42.FileEvents.timestamp — The timestamp when the event occurred.
• Code42.FileEvents.event — Summary information about the event, including date observed, event type, and event source.
• Code42.FileEvents.user — Details about the user associated with the event (if any).
• Code42.FileEvents.destination — Details about the destination target of the event (if any).
• Code42.FileEvents.process — Details about the CPU process involved in the event (if any).
• Code42.FileEvents.risk — Details overall risk severity for the event and lists all associated risk indicators.
• Code42.FileEvents.git — Details about git repository involved in event (if any).
• Code42.FileEvents.report — Details about Salesforce reports involved in the event (if any).
• Code42.FileEvents.file — Details about file metadata for file involved in the event (if any).
• Code42.FileEvents.source — Info about the origin of a file involved in the event (if any).
• File — The file object.
• File.Name — File name.
• File.Path — File path.
• File.Size — File size in bytes.
• File.MD5 — MD5 hash of file.
• File.SHA256 — SHA256 hash of file.
• File.Hostname — Hostname where file event was captured.

Commands used

• code42-file-events-search