Cortex XDR - Get File Path from alerts by hash

This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. This playbook assists in retrieving file paths from the Cortex XDR incident by hash.

Cortex XDR by Palo Alto Networks · 5 tasks · 1 input · 1 output

Inputs

  • NonFoundHashes — List of hashes to run against.

Outputs

  • fileRetrieval — The path for the requested file.

Flowchart

Start Start Set Actor Process Path for this hash - SetAndHandleEmpty Set Actor Process Path fo... SetAndHandleEmpty Set Target Process Path for this hash - SetAndHandleEmpty Set Target Process Path f... SetAndHandleEmpty Set Actor Process Path for this hash - SetAndHandleEmpty Set Actor Process Path fo... SetAndHandleEmpty Done Done