CrowdStrike Falcon - Retrieve File

This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. This playbook retrieves and unzips files from CrowdStrike Falcon and returns a list of the files that were and were not retrieved.

CrowdStrike Falcon · 8 tasks · 4 inputs · 2 outputs

Details

ID	`CrowdStrike Falcon - Retrieve File`
From Version	6.5.0
Tasks	8

README

This playbook is part of the ‘Malware Investigation And Response’ pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response.
This playbook retrieves and unzips files from CrowdStrike Falcon and returns a list of the files that were and were not retrieved.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

CrowdStrikeFalcon

Scripts

Set
UnzipFile
IsIntegrationAvailable

Commands

cs-falcon-rtr-retrieve-file

Playbook Inputs

Name	Description	Default Value	Required
HostId	The ID of the host to use.		Optional
PathsToGet	The path to retrieve the file from the host.		Optional
ZipPassword	Default password to unzip files retrieved by CrowdStrike Falcon.	infected	Optional
FileNames	The names of the file to retrieve. This is used to validate that all the intended files were retrieved, not to specify which ones will be retrieved.		Optional

Playbook Outputs

Path	Description	Type
ExtractedFiles	A list of file names that were extracted from the ZIP file.	string
NonRetrievedFiles	A list of files that were not retrieved.	string

Playbook Image

CrowdStrike Falcon - Retrieve File

Inputs

HostId — The ID of the host to use.
PathsToGet — The path to retrieve the file from the host.
ZipPassword — Default password to unzip files retrieved by CrowdStrike Falcon.
FileNames — The names of the file to retrieve. This is used to validate that all the intended files were retrieved, not to specify which ones will be retrieved.

Outputs

ExtractedFiles — A list of file names that were extracted from the ZIP file.
NonRetrievedFiles — A list of files that were not retrieved.

Commands used

cs-falcon-rtr-retrieve-file

Flowchart

Source

playbook-CrowdStrike_Falcon_-_Retrieve_File.yml

Download History Raw

id: CrowdStrike Falcon - Retrieve File
version: -1
fromversion: 6.5.0
name: CrowdStrike Falcon - Retrieve File
description: |-
  This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response.
  This playbook retrieves and unzips files from CrowdStrike Falcon and returns a list of the files that were and were not retrieved.
starttaskid: '0'
tasks:
  '0':
    id: '0'
    taskid: 15c3515f-c5ca-4fc0-827b-297313a31e67
    type: start
    task:
      id: 15c3515f-c5ca-4fc0-827b-297313a31e67
      version: -1
      name: ''
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - "6"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '1':
    id: '1'
    taskid: f7414601-135b-4d4a-8994-0c4e68a68c0b
    type: regular
    task:
      id: f7414601-135b-4d4a-8994-0c4e68a68c0b
      version: -1
      name: Retrieve file
      description: Gets the RTR extracted file contents for the specified file path.
      script: '|||cs-falcon-rtr-retrieve-file'
      type: regular
      iscommand: true
      brand: ''
    nexttasks:
      '#none#':
      - '2'
    scriptarguments:
      file_path:
        complex:
          root: inputs.PathsToGet
          transformers:
          - operator: uniq
      host_ids:
        complex:
          root: inputs.HostId
          transformers:
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 890,
          "y": 560
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '2':
    id: '2'
    taskid: 7ba9331f-6e55-4841-8dab-6db7297c169c
    type: regular
    task:
      id: 7ba9331f-6e55-4841-8dab-6db7297c169c
      version: -1
      name: Unzip file
      description: Unzips a file using fileName or entryID to specify a file. Unzipped files will be loaded to the War Room and file names will be put into the context.
      scriptName: UnzipFile
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '4'
    scriptarguments:
      entryID:
        complex:
          root: File
          accessor: EntryID
          transformers:
          - operator: LastArrayElement
      nonsensitive_password:
        complex:
          root: inputs.ZipPassword
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 890,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '3':
    id: '3'
    taskid: b15be011-39c5-4bd1-872f-9d1885d33431
    type: title
    task:
      id: b15be011-39c5-4bd1-872f-9d1885d33431
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ''
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1280
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '4':
    id: '4'
    taskid: 2c74a6ab-ea5a-4219-8d31-7c921193ae8f
    type: condition
    task:
      id: 2c74a6ab-ea5a-4219-8d31-7c921193ae8f
      version: -1
      name: 'Have all files been retrieved? '
      type: condition
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#default#':
      - '5'
      yes:
      - '3'
    separatecontext: false
    conditions:
    - label: yes
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.FileNames
                filters:
                - - operator: inList
                    left:
                      value:
                        simple: inputs.FileNames
                      iscontext: true
                    right:
                      value:
                        simple: ExtractedFiles
                      iscontext: true
            iscontext: true
    view: |-
      {
        "position": {
          "x": 890,
          "y": 900
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '5':
    id: '5'
    taskid: 1ded9b31-a6c6-4157-8f14-b1d4c212c3e8
    type: regular
    task:
      id: 1ded9b31-a6c6-4157-8f14-b1d4c212c3e8
      version: -1
      name: Set files that were not retrieved
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '3'
    scriptarguments:
      append:
        simple: 'true'
      key:
        simple: NonRetrievedFiles
      value:
        complex:
          root: inputs.FileNames
          filters:
          - - operator: notInList
              left:
                value:
                  simple: inputs.FileNames
                iscontext: true
              right:
                value:
                  simple: ExtractedFiles
                iscontext: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1040,
          "y": 1100
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: e5c3001b-7ebf-4e51-810f-c50c3ebd9274
    type: condition
    task:
      id: e5c3001b-7ebf-4e51-810f-c50c3ebd9274
      version: -1
      name: Is CrowdStrike Falcon enabled?
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'.
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "7"
    scriptarguments:
      brandname:
        simple: CrowdstrikeFalcon
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 180
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: 0c9ac239-34cc-46eb-8662-7d573761dc7c
    type: condition
    task:
      id: 0c9ac239-34cc-46eb-8662-7d573761dc7c
      version: -1
      name: Are all required inputs provided?
      type: condition
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "1"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.PathsToGet
            iscontext: true
          right:
            value: {}
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.HostId
            iscontext: true
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.FileNames
            iscontext: true
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.ZipPassword
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 680,
          "y": 360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "4_3_yes": 0.19,
      "4_5_#default#": 0.6,
      "6_3_#default#": 0.13,
      "6_7_yes": 0.52
    },
    "paper": {
      "dimensions": {
        "height": 1295,
        "width": 970,
        "x": 450,
        "y": 50
      }
    }
  }
inputs:
- key: HostId
  value: {}
  required: false
  description: The ID of the host to use.
  playbookInputQuery:
- key: PathsToGet
  value: {}
  required: false
  description: The path to retrieve the file from the host.
  playbookInputQuery:
- key: ZipPassword
  value:
    simple: infected
  required: false
  description: Default password to unzip files retrieved by CrowdStrike Falcon.
  playbookInputQuery:
- key: FileNames
  value: {}
  required: false
  description: 'The names of the file to retrieve. This is used to validate that all the intended files were retrieved, not to specify which ones will be retrieved.   '
  playbookInputQuery:
outputs:
- contextPath: ExtractedFiles
  description: A list of file names that were extracted from the ZIP file.
  type: string
- contextPath: NonRetrievedFiles
  description: A list of files that were not retrieved.
  type: string
tests:
- Test Playbook - CrowdStrike Falcon - Retrieve File
marketplaces:
- xsoar
# Should not appear in marketplacev2