Get File Sample From Path - Carbon Black Enterprise Response

Returns a file sample to the war-room from a path on an endpoint using Carbon Black Enterprise Response

Pack

Carbon_Black_Enterprise_Response

Tasks

5

Inputs

• Hostname — The host to get file from
• Path — Path of the file on the endpoint

Outputs

• CbLiveResponse.Commands.CbCommandID — Unique command identifier.
• CbLiveResponse.Commands.CommandName — The command name.
• CbLiveResponse.Commands.Status — The command status ('pending', 'in progress', 'complete', 'error', or 'canceled').
• CbLiveResponse.Commands.CommandCompletionTime — The command completion time (0 if not complete).
• CbLiveResponse.Commands.OperandObject — The source path of the file.
• CbLiveResponse.Commands.FileID — Unique file ID.
• CbLiveResponse.File.Size — File size.
• CbLiveResponse.File.SHA1 — File SHA1 hash.
• CbLiveResponse.File.SHA256 — File SHA256 hash.
• CbLiveResponse.File.Name — File name.
• CbLiveResponse.File.SSDeep — File SSDeep hash.
• CbLiveResponse.File.EntryID — File EntryID.
• CbLiveResponse.File.Info — File info.
• CbLiveResponse.File.Type — File type.
• CbLiveResponse.File.MD5 — File MD5.
• CbLiveResponse.File.Extension — File extension.
• File.Size — The size of the file in bytes.
• File.MD5 — The MD5 hash of the file.
• File.SHA1 — The SHA1 hash of the file.
• File.SHA256 — The SHA256 hash of the file.
• File.Name — The name of the file.
• File.SSDeep — The SSDeep hash of the file (same as displayed in file entries).
• File.EntryID — File entry ID.
• File.Info — Information about the file.
• File.Type — The file type.
• File.Extension — The extension of the file.