Code42 File Search

Details

ID	`Code42 File Search`
From Version	5.0.0
Tasks	7

README

This playbook searches for files via Code42 security events by either MD5 or SHA256 hash. The data is output to the Code42.SecurityData context for use.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

Code42

Scripts

This playbook does not use any scripts.

Playbook Inputs

Name	Description	Default Value	Required
MD5	MD5 hash to search for	File.MD5	Optional
SHA256	SHA256 hash to search for	File.SHA256	Optional

Playbook Outputs

Path	Description	Type
Code42.SecurityData	Returned File Results	unknown
Code42.SecurityData.EventTimestamp	Timestamp for event	unknown
Code42.SecurityData.FileCreated	File creation date	unknown
Code42.SecurityData.EndpointID	Code42 device ID	unknown
Code42.SecurityData.DeviceUsername	Username that device is associated with in Code42	unknown
Code42.SecurityData.EmailFrom	Sender email address for email exfiltration events	unknown
Code42.SecurityData.EmailTo	Recipient email address for email exfiltration events	unknown
Code42.SecurityData.EmailSubject	Email subject line for email exfiltration events	unknown
Code42.SecurityData.EventID	Security Data event ID	unknown
Code42.SecurityData.EventType	Type of Security Data event	unknown
Code42.SecurityData.FileCategory	Type of file as determined by Code42 engine	unknown
Code42.SecurityData.FileOwner	Owner of file	unknown
Code42.SecurityData.FileName	File name	unknown
Code42.SecurityData.FilePath	Path to file	unknown
Code42.SecurityData.FileSize	Size of file in bytes	unknown
Code42.SecurityData.FileModified	File modification date	unknown
Code42.SecurityData.FileMD5	MD5 hash of file	unknown
Code42.SecurityData.FileHostname	Hostname where file event was captured	unknown
Code42.SecurityData.DevicePrivateIPAddress	Private IP addresses of device where event was captured	unknown
Code42.SecurityData.DevicePublicIPAddress	Public IP address of device where event was captured	unknown
Code42.SecurityData.RemovableMediaType	Type of removable media	unknown
Code42.SecurityData.RemovableMediaCapacity	Total capacity of removable media in bytes	unknown
Code42.SecurityData.RemovableMediaMediaName	Full name of removable media	unknown
Code42.SecurityData.RemovableMediaName	Name of removable media	unknown
Code42.SecurityData.RemovableMediaSerialNumber	Serial number for removable medial device	unknown
Code42.SecurityData.RemovableMediaVendor	Vendor name for removable device	unknown
Code42.SecurityData.FileSHA256	SHA256 hash of file	unknown
Code42.SecurityData.FileShared	Whether file is shared using cloud file service	unknown
Code42.SecurityData.FileSharedWith	Accounts that file is shared with on cloud file service	unknown
Code42.SecurityData.Source	Source of file event, Cloud or Endpoint	unknown
Code42.SecurityData.ApplicationTabURL	URL associated with application read event	unknown
Code42.SecurityData.ProcessName	Process name for application read event	unknown
Code42.SecurityData.ProcessOwner	Process owner for application read event	unknown
Code42.SecurityData.WindowTitle	Process name for application read event	unknown
Code42.SecurityData.FileURL	URL of file on cloud file service	unknown
Code42.SecurityData.Exposure	Exposure type for event	unknown
Code42.SecurityData.SharingTypeAdded	Type of sharing added to file	unknown
File	The file object.	unknown
File.Name	File name	unknown
File.Path	File path	unknown
File.Size	File size in bytes	unknown
File.MD5	MD5 hash of file	unknown
File.SHA256	SHA256 hash of file	unknown
File.Hostname	Hostname where file event was captured	unknown

Playbook Image

Code42 File Search

Inputs

MD5 — MD5 hash to search for
SHA256 — SHA256 hash to search for

Outputs

Code42.SecurityData — Returned File Results
Code42.SecurityData.EventTimestamp — Timestamp for event
Code42.SecurityData.FileCreated — File creation date
Code42.SecurityData.EndpointID — Code42 device ID
Code42.SecurityData.DeviceUsername — Username that device is associated with in Code42
Code42.SecurityData.EmailFrom — Sender email address for email exfiltration events
Code42.SecurityData.EmailTo — Recipient email address for email exfiltration events
Code42.SecurityData.EmailSubject — Email subject line for email exfiltration events
Code42.SecurityData.EventID — Security Data event ID
Code42.SecurityData.EventType — Type of Security Data event
Code42.SecurityData.FileCategory — Type of file as determined by Code42 engine
Code42.SecurityData.FileOwner — Owner of file
Code42.SecurityData.FileName — File name
Code42.SecurityData.FilePath — Path to file
Code42.SecurityData.FileSize — Size of file in bytes
Code42.SecurityData.FileModified — File modification date
Code42.SecurityData.FileMD5 — MD5 hash of file
Code42.SecurityData.FileHostname — Hostname where file event was captured
Code42.SecurityData.DevicePrivateIPAddress — Private IP addresses of device where event was captured
Code42.SecurityData.DevicePublicIPAddress — Public IP address of device where event was captured
Code42.SecurityData.RemovableMediaType — Type of removable media
Code42.SecurityData.RemovableMediaCapacity — Total capacity of removable media in bytes
Code42.SecurityData.RemovableMediaMediaName — Full name of removable media
Code42.SecurityData.RemovableMediaName — Name of removable media
Code42.SecurityData.RemovableMediaSerialNumber — Serial number for removable medial device
Code42.SecurityData.RemovableMediaVendor — Vendor name for removable device
Code42.SecurityData.FileSHA256 — SHA256 hash of file
Code42.SecurityData.FileShared — Whether file is shared using cloud file service
Code42.SecurityData.FileSharedWith — Accounts that file is shared with on cloud file service
Code42.SecurityData.Source — Source of file event, Cloud or Endpoint
Code42.SecurityData.ApplicationTabURL — URL associated with application read event
Code42.SecurityData.ProcessName — Process name for application read event
Code42.SecurityData.ProcessOwner — Process owner for application read event
Code42.SecurityData.WindowTitle — Process name for application read event
Code42.SecurityData.FileURL — URL of file on cloud file service
Code42.SecurityData.Exposure — Exposure type for event
Code42.SecurityData.SharingTypeAdded — Type of sharing added to file
File — The file object.
File.Name — File name
File.Path — File path
File.Size — File size in bytes
File.MD5 — MD5 hash of file
File.SHA256 — SHA256 hash of file
File.Hostname — Hostname where file event was captured

Commands used

code42-file-events-search

Flowchart

Source

playbook-Code42_File_Search.yml playbook-Code42_File_Search_v2.yml playbook-Code42_File_Search_v2_README.md

Download History Raw

id: Code42 File Search v2
version: -1
contentitemexportablefields:
  contentitemfields: {}
name: Code42 File Search v2
description: This playbook searches for files via Code42 security events by either MD5 or SHA256 hash. The data is output to the Code42.FileEvents context for use.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: d045a003-2e7f-4f47-80c7-3882baf399b6
    type: start
    task:
      id: d045a003-2e7f-4f47-80c7-3882baf399b6
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 280,
          "y": 40
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 746c1a4e-7084-45f1-86e6-e9764ffbbf5c
    type: condition
    task:
      id: 746c1a4e-7084-45f1-86e6-e9764ffbbf5c
      version: -1
      name: Is Code42 Integration Active?
      description: ''
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "2"
      - "3"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: brand
                      iscontext: true
                    right:
                      value:
                        simple: Code42
                - - operator: isEqualString
                    left:
                      value:
                        simple: state
                      iscontext: true
                    right:
                      value:
                        simple: active
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 280,
          "y": 200
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 935cb1d6-e328-4a8e-888f-347c3b33ce11
    type: condition
    task:
      id: 935cb1d6-e328-4a8e-888f-347c3b33ce11
      version: -1
      name: Does SHA256 Exist?
      description: ''
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "5"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.SHA256
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 40,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 1d0dfb1f-6874-41e9-8593-fca2a96c58c4
    type: condition
    task:
      id: 1d0dfb1f-6874-41e9-8593-fca2a96c58c4
      version: -1
      name: Does MD5 Exist?
      description: ''
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "6"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.MD5
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 520,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: 14d6c356-1a5d-49b6-881e-b2fb9e32e2b8
    type: regular
    task:
      id: 14d6c356-1a5d-49b6-881e-b2fb9e32e2b8
      version: -1
      name: Code42 Search by SHA256
      description: Search for Code42 Incydr File Events.
      script: Code42|||code42-file-events-search
      type: regular
      iscommand: true
      brand: Code42
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      add-to-context:
        simple: "true"
      hash:
        simple: ${inputs.SHA256}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 40,
          "y": 570
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: 399b0873-d519-4067-88cb-beb5b7558f80
    type: regular
    task:
      id: 399b0873-d519-4067-88cb-beb5b7558f80
      version: -1
      name: Code42 Search by MD5
      description: Search for Code42 Incydr File Events.
      script: Code42|||code42-file-events-search
      type: regular
      iscommand: true
      brand: Code42
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      add-to-context:
        simple: "true"
      hash:
        simple: ${inputs.MD5}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 520,
          "y": 570
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: 7f03d6ab-3bb8-4bd5-867b-fe853fa38684
    type: title
    task:
      id: 7f03d6ab-3bb8-4bd5-867b-fe853fa38684
      version: -1
      name: Complete
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 280,
          "y": 830
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
system: true
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 855,
        "width": 860,
        "x": 40,
        "y": 40
      }
    }
  }
inputs:
- key: MD5
  value:
    complex:
      root: File
      accessor: MD5
      transformers:
      - operator: uniq
  required: false
  description: MD5 hash to search for
  playbookInputQuery:
- key: SHA256
  value:
    complex:
      root: File
      accessor: SHA256
      transformers:
      - operator: uniq
  required: false
  description: SHA256 hash to search for
  playbookInputQuery:
outputs:
- contextPath: Code42.FileEvents
  description: Returned File Results.
  type: unknown
- contextPath: Code42.FileEvents.timestamp
  description: The timestamp when the event occurred.
- contextPath: Code42.FileEvents.event
  description: Summary information about the event, including date observed, event type, and event source.
- contextPath: Code42.FileEvents.user
  description: Details about the user associated with the event (if any).
- contextPath: Code42.FileEvents.destination
  description: Details about the destination target of the event (if any).
- contextPath: Code42.FileEvents.process
  description: Details about the CPU process involved in the event (if any).
- contextPath: Code42.FileEvents.risk
  description: Details overall risk severity for the event and lists all associated risk indicators.
- contextPath: Code42.FileEvents.git
  description: Details about git repository involved in event (if any).
- contextPath: Code42.FileEvents.report
  description: Details about Salesforce reports involved in the event (if any).
- contextPath: Code42.FileEvents.file
  description: Details about file metadata for file involved in the event (if any).
- contextPath: Code42.FileEvents.source
  description: Info about the origin of a file involved in the event (if any).
- contextPath: File
  description: The file object.
  type: unknown
- contextPath: File.Name
  description: File name.
- contextPath: File.Path
  description: File path.
- contextPath: File.Size
  description: File size in bytes.
- contextPath: File.MD5
  description: MD5 hash of file.
- contextPath: File.SHA256
  description: SHA256 hash of file.
- contextPath: File.Hostname
  description: Hostname where file event was captured.
fromversion: 6.10.0
tests:
- No tests (auto formatted)