Code42 File Search v2

This playbook searches for files via Code42 security events by either MD5 or SHA256 hash. The data is output to the Code42.FileEvents context for use.

Code42 · 7 tasks · 2 inputs · 18 outputs

Inputs

  • MD5 — MD5 hash to search for
  • SHA256 — SHA256 hash to search for

Outputs

  • Code42.FileEvents — Returned File Results.
  • Code42.FileEvents.timestamp — The timestamp when the event occurred.
  • Code42.FileEvents.event — Summary information about the event, including date observed, event type, and event source.
  • Code42.FileEvents.user — Details about the user associated with the event (if any).
  • Code42.FileEvents.destination — Details about the destination target of the event (if any).
  • Code42.FileEvents.process — Details about the CPU process involved in the event (if any).
  • Code42.FileEvents.risk — Details overall risk severity for the event and lists all associated risk indicators.
  • Code42.FileEvents.git — Details about git repository involved in event (if any).
  • Code42.FileEvents.report — Details about Salesforce reports involved in the event (if any).
  • Code42.FileEvents.file — Details about file metadata for file involved in the event (if any).
  • Code42.FileEvents.source — Info about the origin of a file involved in the event (if any).
  • File — The file object.
  • File.Name — File name.
  • File.Path — File path.
  • File.Size — File size in bytes.
  • File.MD5 — MD5 hash of file.
  • File.SHA256 — SHA256 hash of file.
  • File.Hostname — Hostname where file event was captured.

Commands used

code42-file-events-search

Flowchart

yes yes yes yes Start Start Is Code42 Integration Active? Is Code42 Integration Act... Does SHA256 Exist? Does SHA256 Exist? Does MD5 Exist? Does MD5 Exist? Code42 Search by SHA256 - code42-file-events-search Code42 Search by SHA256 code42-file-events-search Code42 Search by MD5 - code42-file-events-search Code42 Search by MD5 code42-file-events-search Complete Complete