Get File Sample From Path - VMware Carbon Black EDR - Live Response API

This playbook retrieves a file from a path on an endpoint using VMware Carbon Black EDR (Live Response API). Make sure to provide the Carbon Black sensor ID of the endpoint from which you want to retrieve the file.

Pack

Carbon_Black_Enterprise_Live_Response

Tasks

11

Inputs

• Sensor_ID — The sensor ID. Provide the sensor ID to run the command with a new session. The session will be created and closed automatically.
• Path — The path of the file to retrieve. For example: C:\users\folder\file.txt

Outputs

• File.Size — The size of the file.
• File.Type — The type of the file.
• File.Info — General information of the file.
• File.MD5 — The MD5 hash of the file.
• File.SHA1 — The SHA1 hash of the file.
• File.SHA256 — The SHA256 hash of the file.
• File.SHA512 — The SHA512 hash of the file.
• File.SSDeep — The file SSDeep.
• File.Name — The file name.
• File.EntryID — File entry ID.
• File.Extension — The file extension.

Commands used

• cb-get-file-from-endpoint
• cb-list-sessions
• cb-session-close
• cb-session-create