Carbon Black Live Response - Download File

Download file from a sensor.

Carbon Black Enterprise Live Response · 8 tasks · 2 inputs · 10 outputs

Details

IDCarbon Black Live Response - Download File
From Version5.0.0
Tasks8

Inputs

  • SensorId — Sensor ID.
  • Path — File path to download.

Outputs

  • File.Size — File size.
  • File.SHA1 — File SHA1.
  • File.SHA256 — File SHA256.
  • File.Name — File name.
  • File.SSDeep — File SSDeep.
  • File.EntryID — File EntryID.
  • File.Info — File info.
  • File.Type — File type.
  • File.MD5 — File MD5.
  • File.Extension — File extension.

Commands used

cb-command-info cb-file-get cb-get-file-from-endpoint cb-session-close

Flowchart

Start Start Carbon Black Live Response - Create active session - Carbon Black Live Response - Create active session Carbon Black Live Respons... Carbon Black Live Response - ... Start downloading file - cb-get-file-from-endpoint Start downloading file cb-get-file-from-endpoint Download file - cb-file-get Download file cb-file-get File downloaded successfully File downloaded successfully Close session - cb-session-close Close session cb-session-close Carbon Black Live Response - Wait Until Command Complete - Carbon Black Live Response - Wait Until Command Complete Carbon Black Live Respons... Carbon Black Live Response - ... Get command info - cb-command-info Get command info cb-command-info

Source

playbook-Carbon_Black_Live_Response_-_Download_file.yml
Download History Raw 
id: Carbon Black Live Response - Download File
version: -1
name: Carbon Black Live Response - Download File
description: Download file from a sensor.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: aceb3dc4-8d87-42f2-8689-cef3a0bb831d
    type: start
    task:
      id: aceb3dc4-8d87-42f2-8689-cef3a0bb831d
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "1":
    id: "1"
    taskid: 2634dc8a-846d-421d-886f-3ea11b43a821
    type: playbook
    task:
      id: 2634dc8a-846d-421d-886f-3ea11b43a821
      version: -1
      name: Carbon Black Live Response - Create active session
      description: Create an active session.
      playbookName: Carbon Black Live Response - Create active session
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      sensor:
        complex:
          root: inputs.SensorId
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "2":
    id: "2"
    taskid: cb1983f0-7129-476f-8ebb-be8b7888fc4d
    type: regular
    task:
      id: cb1983f0-7129-476f-8ebb-be8b7888fc4d
      version: -1
      name: Start downloading file
      description: Retrieve a file from a path on the endpoint.
      script: '|||cb-get-file-from-endpoint'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      download:
        simple: "false"
      path:
        complex:
          root: inputs.Path
      sensor: {}
      session:
        complex:
          root: CbLiveResponse.Sessions
          accessor: CbSessionID
      wait-timeout: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "4":
    id: "4"
    taskid: 5dd1b383-635b-4e6f-8834-475e898e27d4
    type: regular
    task:
      id: 5dd1b383-635b-4e6f-8834-475e898e27d4
      version: -1
      name: Download file
      description: Download a file from Cb server in a given session.
      script: '|||cb-file-get'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      file-id:
        complex:
          root: CbLiveResponse.Commands
          accessor: FileID
      session:
        complex:
          root: CbLiveResponse.Sessions
          accessor: CbSessionID
    continueonerror: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 895
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "5":
    id: "5"
    taskid: 66449819-fe18-4c59-8e28-a85ee83920e0
    type: title
    task:
      id: 66449819-fe18-4c59-8e28-a85ee83920e0
      version: -1
      name: File downloaded successfully
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1245
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "6":
    id: "6"
    taskid: 4767d80a-3861-4fd5-8d1e-a10db951c394
    type: regular
    task:
      id: 4767d80a-3861-4fd5-8d1e-a10db951c394
      version: -1
      name: Close session
      description: Close the given session.
      script: '|||cb-session-close'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      session:
        complex:
          root: CbLiveResponse.Sessions
          accessor: CbSessionID
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "7":
    id: "7"
    taskid: 4d87be63-17a9-4b3a-848c-05f7ac469b53
    type: playbook
    task:
      id: 4d87be63-17a9-4b3a-848c-05f7ac469b53
      version: -1
      name: Carbon Black Live Response - Wait Until Command Complete
      description: Polling command status until finished with an error or complete.
      playbookName: Carbon Black Live Response - Wait Until Command Complete
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "13"
    scriptarguments:
      CommnadId:
        complex:
          root: CbLiveResponse.Commands
          accessor: CbCommandID
      SessionId:
        complex:
          root: CbLiveResponse.Sessions
          accessor: CbSessionID
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 50,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "13":
    id: "13"
    taskid: 85ff63bb-eeb6-410e-8e30-0dafed3c1231
    type: regular
    task:
      id: 85ff63bb-eeb6-410e-8e30-0dafed3c1231
      version: -1
      name: Get command info
      description: Display information on command. Used for getting the file ID.
      script: '|||cb-command-info'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      command:
        complex:
          root: CbLiveResponse.Commands
          accessor: CbCommandID
      session:
        complex:
          root: CbLiveResponse.Sessions
          accessor: CbSessionID
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1260,
        "width": 380,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: SensorId
  value: {}
  required: true
  description: Sensor ID.
  playbookInputQuery:
- key: Path
  value: {}
  required: true
  description: File path to download.
  playbookInputQuery:
outputs:
- contextPath: File.Size
  description: File size.
  type: number
- contextPath: File.SHA1
  description: File SHA1.
  type: string
- contextPath: File.SHA256
  description: File SHA256.
  type: string
- contextPath: File.Name
  description: File name.
  type: string
- contextPath: File.SSDeep
  description: File SSDeep.
  type: string
- contextPath: File.EntryID
  description: File EntryID.
  type: string
- contextPath: File.Info
  description: File info.
  type: string
- contextPath: File.Type
  description: File type.
  type: string
- contextPath: File.MD5
  description: File MD5.
  type: string
- contextPath: File.Extension
  description: File extension.
  type: string
fromversion: 5.0.0
tests:
- No test