Code42 File Download

This playbook downloads a file via Code42 by either MD5 or SHA256 hash.

Code42 · 7 tasks · 4 inputs · 10 outputs

Details

ID	`Code42 File Download`
From Version	5.0.0
Tasks	7

README

This playbook downloads a file via Code42 by either MD5 or SHA256 hash.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

Code42

Scripts

This playbook does not use any scripts.

Commands

code42-download-file

Playbook Inputs

Name	Description	Default Value	Required
XFC ID	XFC Event ID to search for		Optional
MD5	MD5 hash to search for	File.MD5	Optional
SHA256	SHA256 hash to search for	File.SHA256	Optional
Filename	The name of the file to save as.		Optional

Playbook Outputs

Path	Description	Type
File.Size	The size of the file.	unknown
File.SHA1	The SHA1 hash of the file.	unknown
File.SHA256	The SHA256 hash of the file.	unknown
File.Name	The name of the file.	unknown
File.SSDeep	The SSDeep hash of the file.	unknown
File.EntryID	The entry ID of the file.	unknown
File.Info	File information.	unknown
File.Type	The file type.	unknown
File.MD5	The MD5 hash of the file.	unknown
File.Extension	The file extension.	unknown

Playbook Image

Code42 File Download

Inputs

MD5 — MD5 hash to search for
SHA256 — SHA256 hash to search for
Filename — The name of the file to save as.
XFC ID — The XFC ID of the file to download.

Outputs

File.Size — The size of the file.
File.SHA1 — The SHA1 hash of the file.
File.SHA256 — The SHA256 hash of the file.
File.Name — The name of the file.
File.SSDeep — The SSDeep hash of the file.
File.EntryID — The entry ID of the file.
File.Info — File information.
File.Type — The file type.
File.MD5 — The MD5 hash of the file.
File.Extension — The file extension.

Commands used

code42-download-file code42-download-file-by-xfc-id

Flowchart

Source

playbook-Code42_File_Download.yml

Download History Raw

id: Code42 File Download
version: -1
name: Code42 File Download
description: This playbook downloads a file via Code42 by either MD5 or SHA256 hash.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: f45944a7-0362-48e3-8adb-7022ef46ef0e
    type: start
    task:
      id: f45944a7-0362-48e3-8adb-7022ef46ef0e
      version: -1
      name: ""
      description: Begins the playbook.
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 265,
          "y": 40
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 22138dd2-186a-4001-83b5-006026235ffc
    type: condition
    task:
      id: 22138dd2-186a-4001-83b5-006026235ffc
      version: -1
      name: Is Code42 Integration Active?
      description: Checks to see if a Code42 Integration is active.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "3"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: brand
                      iscontext: true
                    right:
                      value:
                        simple: Code42
                - - operator: isEqualString
                    left:
                      value:
                        simple: state
                      iscontext: true
                    right:
                      value:
                        simple: active
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 265,
          "y": 175
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 698d902d-578c-4567-858d-807573f8e997
    type: condition
    task:
      id: 698d902d-578c-4567-858d-807573f8e997
      version: -1
      name: What type of hash was supplied?
      description: Check whether the values provided in arguments are equal. If either
        of the arguments are missing, no is returned.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "7"
      MD5:
      - "6"
      SHA256:
      - "5"
      XFCID:
      - "8"
    separatecontext: false
    conditions:
    - label: MD5
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.MD5
            iscontext: true
          right:
            value: {}
    - label: SHA256
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.SHA256
            iscontext: true
    - label: XFCID
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.XFC ID
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 265,
          "y": 350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: 3b2c3188-d267-4e9d-8f27-54993aa266ee
    type: regular
    task:
      id: 3b2c3188-d267-4e9d-8f27-54993aa266ee
      version: -1
      name: Code42 Download by SHA256
      description: Downloads a file from Code42 servers.
      script: Code42|||code42-download-file
      type: regular
      iscommand: true
      brand: Code42
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      filename:
        simple: ${inputs.Filename}
      hash:
        simple: ${inputs.SHA256}
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -150,
          "y": 545
        }
      }
    note: false
    evidencedata:
      description:
        simple: A file that triggered the alert.
      customfields: {}
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: 6b09d948-56b3-4236-87d5-06469c6a67b2
    type: regular
    task:
      id: 6b09d948-56b3-4236-87d5-06469c6a67b2
      version: -1
      name: Code42 Download by MD5
      description: Downloads a file from Code42 servers.
      script: Code42|||code42-download-file
      type: regular
      iscommand: true
      brand: Code42
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      filename:
        simple: ${inputs.Filename}
      hash:
        simple: ${inputs.MD5}
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 265,
          "y": 545
        }
      }
    note: false
    evidencedata:
      description:
        simple: A file that triggered the alert.
      customfields: {}
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: a31058a7-f7d7-4c3b-8d52-633b15b8b385
    type: title
    task:
      id: a31058a7-f7d7-4c3b-8d52-633b15b8b385
      version: -1
      name: Complete
      type: title
      description: The playbook is complete.
      iscommand: false
      brand: ""
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 265,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: e47b7f60-ecf8-4834-8aac-6bbc935dc87b
    type: regular
    task:
      id: e47b7f60-ecf8-4834-8aac-6bbc935dc87b
      version: -1
      name: code42-download-file-by-xfc-id
      description: Downloads a file from Incydr using the XFC Event ID.
      script: Code42|||code42-download-file-by-xfc-id
      type: regular
      iscommand: true
      brand: Code42
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      filename:
        simple: ${inputs.Filename}
      xfc_id:
        simple: ${inputs.XFC ID}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 675,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 745,
        "width": 1205,
        "x": -150,
        "y": 40
      }
    }
  }
inputs:
- key: MD5
  value:
    complex:
      root: File
      accessor: MD5
      transformers:
      - operator: uniq
  required: false
  description: MD5 hash to search for
  playbookInputQuery: null
- key: SHA256
  value:
    complex:
      root: File
      accessor: SHA256
      transformers:
      - operator: uniq
  required: false
  description: SHA256 hash to search for
  playbookInputQuery: null
- key: Filename
  value: {}
  required: false
  description: The name of the file to save as.
  playbookInputQuery: null
- key: XFC ID
  value: {}
  required: false
  description: The XFC ID of the file to download.
  playbookInputQuery: null
outputs:
- contextPath: File.Size
  description: The size of the file.
- contextPath: File.SHA1
  description: The SHA1 hash of the file.
- contextPath: File.SHA256
  description: The SHA256 hash of the file.
- contextPath: File.Name
  description: The name of the file.
- contextPath: File.SSDeep
  description: The SSDeep hash of the file.
- contextPath: File.EntryID
  description: The entry ID of the file.
- contextPath: File.Info
  description: File information.
- contextPath: File.Type
  description: The file type.
- contextPath: File.MD5
  description: The MD5 hash of the file.
- contextPath: File.Extension
  description: The file extension.
tests:
- No Test
fromversion: 5.0.0