Code42 File Search

Details

ID	`Code42 File Search`
From Version	5.0.0
Tasks	7

README

This playbook searches for files via Code42 security events by either MD5 or SHA256 hash. The data is output to the Code42.SecurityData context for use.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

Code42

Scripts

This playbook does not use any scripts.

Playbook Inputs

Name	Description	Default Value	Required
MD5	MD5 hash to search for	File.MD5	Optional
SHA256	SHA256 hash to search for	File.SHA256	Optional

Playbook Outputs

Path	Description	Type
Code42.SecurityData	Returned File Results	unknown
Code42.SecurityData.EventTimestamp	Timestamp for event	unknown
Code42.SecurityData.FileCreated	File creation date	unknown
Code42.SecurityData.EndpointID	Code42 device ID	unknown
Code42.SecurityData.DeviceUsername	Username that device is associated with in Code42	unknown
Code42.SecurityData.EmailFrom	Sender email address for email exfiltration events	unknown
Code42.SecurityData.EmailTo	Recipient email address for email exfiltration events	unknown
Code42.SecurityData.EmailSubject	Email subject line for email exfiltration events	unknown
Code42.SecurityData.EventID	Security Data event ID	unknown
Code42.SecurityData.EventType	Type of Security Data event	unknown
Code42.SecurityData.FileCategory	Type of file as determined by Code42 engine	unknown
Code42.SecurityData.FileOwner	Owner of file	unknown
Code42.SecurityData.FileName	File name	unknown
Code42.SecurityData.FilePath	Path to file	unknown
Code42.SecurityData.FileSize	Size of file in bytes	unknown
Code42.SecurityData.FileModified	File modification date	unknown
Code42.SecurityData.FileMD5	MD5 hash of file	unknown
Code42.SecurityData.FileHostname	Hostname where file event was captured	unknown
Code42.SecurityData.DevicePrivateIPAddress	Private IP addresses of device where event was captured	unknown
Code42.SecurityData.DevicePublicIPAddress	Public IP address of device where event was captured	unknown
Code42.SecurityData.RemovableMediaType	Type of removable media	unknown
Code42.SecurityData.RemovableMediaCapacity	Total capacity of removable media in bytes	unknown
Code42.SecurityData.RemovableMediaMediaName	Full name of removable media	unknown
Code42.SecurityData.RemovableMediaName	Name of removable media	unknown
Code42.SecurityData.RemovableMediaSerialNumber	Serial number for removable medial device	unknown
Code42.SecurityData.RemovableMediaVendor	Vendor name for removable device	unknown
Code42.SecurityData.FileSHA256	SHA256 hash of file	unknown
Code42.SecurityData.FileShared	Whether file is shared using cloud file service	unknown
Code42.SecurityData.FileSharedWith	Accounts that file is shared with on cloud file service	unknown
Code42.SecurityData.Source	Source of file event, Cloud or Endpoint	unknown
Code42.SecurityData.ApplicationTabURL	URL associated with application read event	unknown
Code42.SecurityData.ProcessName	Process name for application read event	unknown
Code42.SecurityData.ProcessOwner	Process owner for application read event	unknown
Code42.SecurityData.WindowTitle	Process name for application read event	unknown
Code42.SecurityData.FileURL	URL of file on cloud file service	unknown
Code42.SecurityData.Exposure	Exposure type for event	unknown
Code42.SecurityData.SharingTypeAdded	Type of sharing added to file	unknown
File	The file object.	unknown
File.Name	File name	unknown
File.Path	File path	unknown
File.Size	File size in bytes	unknown
File.MD5	MD5 hash of file	unknown
File.SHA256	SHA256 hash of file	unknown
File.Hostname	Hostname where file event was captured	unknown

Playbook Image

Code42 File Search

Inputs

MD5 — MD5 hash to search for
SHA256 — SHA256 hash to search for

Outputs

Code42.SecurityData — Returned File Results
Code42.SecurityData.EventTimestamp — Timestamp for event
Code42.SecurityData.FileCreated — File creation date
Code42.SecurityData.EndpointID — Code42 device ID
Code42.SecurityData.DeviceUsername — Username that device is associated with in Code42
Code42.SecurityData.EmailFrom — Sender email address for email exfiltration events
Code42.SecurityData.EmailTo — Recipient email address for email exfiltration events
Code42.SecurityData.EmailSubject — Email subject line for email exfiltration events
Code42.SecurityData.EventID — Security Data event ID
Code42.SecurityData.EventType — Type of Security Data event
Code42.SecurityData.FileCategory — Type of file as determined by Code42 engine
Code42.SecurityData.FileOwner — Owner of file
Code42.SecurityData.FileName — File name
Code42.SecurityData.FilePath — Path to file
Code42.SecurityData.FileSize — Size of file in bytes
Code42.SecurityData.FileModified — File modification date
Code42.SecurityData.FileMD5 — MD5 hash of file
Code42.SecurityData.FileHostname — Hostname where file event was captured
Code42.SecurityData.DevicePrivateIPAddress — Private IP addresses of device where event was captured
Code42.SecurityData.DevicePublicIPAddress — Public IP address of device where event was captured
Code42.SecurityData.RemovableMediaType — Type of removable media
Code42.SecurityData.RemovableMediaCapacity — Total capacity of removable media in bytes
Code42.SecurityData.RemovableMediaMediaName — Full name of removable media
Code42.SecurityData.RemovableMediaName — Name of removable media
Code42.SecurityData.RemovableMediaSerialNumber — Serial number for removable medial device
Code42.SecurityData.RemovableMediaVendor — Vendor name for removable device
Code42.SecurityData.FileSHA256 — SHA256 hash of file
Code42.SecurityData.FileShared — Whether file is shared using cloud file service
Code42.SecurityData.FileSharedWith — Accounts that file is shared with on cloud file service
Code42.SecurityData.Source — Source of file event, Cloud or Endpoint
Code42.SecurityData.ApplicationTabURL — URL associated with application read event
Code42.SecurityData.ProcessName — Process name for application read event
Code42.SecurityData.ProcessOwner — Process owner for application read event
Code42.SecurityData.WindowTitle — Process name for application read event
Code42.SecurityData.FileURL — URL of file on cloud file service
Code42.SecurityData.Exposure — Exposure type for event
Code42.SecurityData.SharingTypeAdded — Type of sharing added to file
File — The file object.
File.Name — File name
File.Path — File path
File.Size — File size in bytes
File.MD5 — MD5 hash of file
File.SHA256 — SHA256 hash of file
File.Hostname — Hostname where file event was captured

Commands used

code42-file-events-search

Flowchart

Source

playbook-Code42_File_Search.yml playbook-Code42_File_Search_v2.yml playbook-Code42_File_Search_v2_README.md

Download History Raw

id: Code42 File Search
version: -1
name: Code42 File Search
description: This playbook searches for files via Code42 security events by either MD5 or SHA256 hash. The data is output to the Code42.SecurityData context for use.
starttaskid: '0'
tasks:
  '0':
    id: '0'
    taskid: d045a003-2e7f-4f47-80c7-3882baf399b6
    type: start
    task:
      id: d045a003-2e7f-4f47-80c7-3882baf399b6
      version: -1
      name: ''
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '1'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 280,
          "y": -140
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '1':
    id: '1'
    taskid: 746c1a4e-7084-45f1-86e6-e9764ffbbf5c
    type: condition
    task:
      id: 746c1a4e-7084-45f1-86e6-e9764ffbbf5c
      version: -1
      name: Is Code42 Integration Active?
      description: ''
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '7'
      'yes':
      - '2'
      - '3'
    separatecontext: false
    conditions:
    - label: 'yes'
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: brand
                      iscontext: true
                    right:
                      value:
                        simple: Code42
                - - operator: isEqualString
                    left:
                      value:
                        simple: state
                      iscontext: true
                    right:
                      value:
                        simple: active
            iscontext: true
    view: |-
      {
        "position": {
          "x": 280,
          "y": 160
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '2':
    id: '2'
    taskid: 935cb1d6-e328-4a8e-888f-347c3b33ce11
    type: condition
    task:
      id: 935cb1d6-e328-4a8e-888f-347c3b33ce11
      version: -1
      name: Does SHA256 Exist?
      description: ''
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '7'
      'yes':
      - '5'
    separatecontext: false
    conditions:
    - label: 'yes'
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.SHA256
            iscontext: true
    view: |-
      {
        "position": {
          "x": 20,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '3':
    id: '3'
    taskid: 1d0dfb1f-6874-41e9-8593-fca2a96c58c4
    type: condition
    task:
      id: 1d0dfb1f-6874-41e9-8593-fca2a96c58c4
      version: -1
      name: Does MD5 Exist?
      description: ''
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '7'
      'yes':
      - '6'
    separatecontext: false
    conditions:
    - label: 'yes'
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.MD5
            iscontext: true
    view: |-
      {
        "position": {
          "x": 532.5,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '5':
    id: '5'
    taskid: e03a5e72-1695-4322-8072-22f076aeceed
    type: regular
    task:
      id: e03a5e72-1695-4322-8072-22f076aeceed
      version: -1
      name: Code42 Search by SHA256
      description: ''
      script: '|||code42-file-events-search'
      type: regular
      iscommand: true
      brand: ''
    nexttasks:
      '#none#':
      - '7'
    scriptarguments:
      hash:
        simple: ${inputs.SHA256}
      add-to-context: {}
      hostname: {}
      json: {}
      results: {}
      username: {}
      min_risk_score: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 20,
          "y": 630
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '6':
    id: '6'
    taskid: 9eda738e-0108-4e18-8d30-d3a20089c0a6
    type: regular
    task:
      id: 9eda738e-0108-4e18-8d30-d3a20089c0a6
      version: -1
      name: Code42 Search by MD5
      description: ''
      script: '|||code42-file-events-search'
      type: regular
      iscommand: true
      brand: ''
    nexttasks:
      '#none#':
      - '7'
    scriptarguments:
      add-to-context: {}
      hash:
        simple: ${inputs.MD5}
      hostname: {}
      json: {}
      results: {}
      username: {}
      min_risk_score: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 532.5,
          "y": 630
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '7':
    id: '7'
    taskid: 7f03d6ab-3bb8-4bd5-867b-fe853fa38684
    type: title
    task:
      id: 7f03d6ab-3bb8-4bd5-867b-fe853fa38684
      version: -1
      name: Complete
      type: title
      iscommand: false
      brand: ''
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 280,
          "y": 1040
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1245,
        "width": 892.5,
        "x": 20,
        "y": -140
      }
    }
  }
inputs:
- key: MD5
  value:
    complex:
      root: File
      accessor: MD5
      transformers:
      - operator: uniq
  required: false
  description: MD5 hash to search for
- key: SHA256
  value:
    complex:
      root: File
      accessor: SHA256
      transformers:
      - operator: uniq
  required: false
  description: SHA256 hash to search for
outputs:
- contextPath: Code42.SecurityData
  description: Returned File Results
  type: unknown
- contextPath: Code42.SecurityData.EventTimestamp
  description: Timestamp for event
- contextPath: Code42.SecurityData.FileCreated
  description: File creation date
- contextPath: Code42.SecurityData.EndpointID
  description: Code42 device ID
- contextPath: Code42.SecurityData.DeviceUsername
  description: Username that device is associated with in Code42
- contextPath: Code42.SecurityData.EmailFrom
  description: Sender email address for email exfiltration events
- contextPath: Code42.SecurityData.EmailTo
  description: Recipient email address for email exfiltration events
- contextPath: Code42.SecurityData.EmailSubject
  description: Email subject line for email exfiltration events
- contextPath: Code42.SecurityData.EventID
  description: Security Data event ID
- contextPath: Code42.SecurityData.EventType
  description: Type of Security Data event
- contextPath: Code42.SecurityData.FileCategory
  description: Type of file as determined by Code42 engine
- contextPath: Code42.SecurityData.FileOwner
  description: Owner of file
- contextPath: Code42.SecurityData.FileName
  description: File name
- contextPath: Code42.SecurityData.FilePath
  description: Path to file
- contextPath: Code42.SecurityData.FileSize
  description: Size of file in bytes
- contextPath: Code42.SecurityData.FileModified
  description: File modification date
- contextPath: Code42.SecurityData.FileMD5
  description: MD5 hash of file
- contextPath: Code42.SecurityData.FileHostname
  description: Hostname where file event was captured
- contextPath: Code42.SecurityData.DevicePrivateIPAddress
  description: Private IP addresses of device where event was captured
- contextPath: Code42.SecurityData.DevicePublicIPAddress
  description: Public IP address of device where event was captured
- contextPath: Code42.SecurityData.RemovableMediaType
  description: Type of removable media
- contextPath: Code42.SecurityData.RemovableMediaCapacity
  description: Total capacity of removable media in bytes
- contextPath: Code42.SecurityData.RemovableMediaMediaName
  description: Full name of removable media
- contextPath: Code42.SecurityData.RemovableMediaName
  description: Name of removable media
- contextPath: Code42.SecurityData.RemovableMediaSerialNumber
  description: Serial number for removable medial device
- contextPath: Code42.SecurityData.RemovableMediaVendor
  description: Vendor name for removable device
- contextPath: Code42.SecurityData.FileSHA256
  description: SHA256 hash of file
- contextPath: Code42.SecurityData.FileShared
  description: Whether file is shared using cloud file service
- contextPath: Code42.SecurityData.FileSharedWith
  description: Accounts that file is shared with on cloud file service
- contextPath: Code42.SecurityData.Source
  description: Source of file event, Cloud or Endpoint
- contextPath: Code42.SecurityData.ApplicationTabURL
  description: URL associated with application read event
- contextPath: Code42.SecurityData.ProcessName
  description: Process name for application read event
- contextPath: Code42.SecurityData.ProcessOwner
  description: Process owner for application read event
- contextPath: Code42.SecurityData.WindowTitle
  description: Process name for application read event
- contextPath: Code42.SecurityData.FileURL
  description: URL of file on cloud file service
- contextPath: Code42.SecurityData.Exposure
  description: Exposure type for event
- contextPath: Code42.SecurityData.SharingTypeAdded
  description: Type of sharing added to file
- contextPath: File
  description: The file object.
  type: unknown
- contextPath: File.Name
  description: File name
- contextPath: File.Path
  description: File path
- contextPath: File.Size
  description: File size in bytes
- contextPath: File.MD5
  description: MD5 hash of file
- contextPath: File.SHA256
  description: SHA256 hash of file
- contextPath: File.Hostname
  description: Hostname where file event was captured
fromversion: 5.0.0
tests:
- No tests (auto formatted)