D2 - Endpoint data collection

Uses Demisto's d2 agent to collect data from an endpoint for IR purposes. Input: * Hostname (default: ${Endpoint.Hostname}) * OS (default: windows) * Credentials (default: Admin) * Path (default: None)

D2 (Deprecated) · 11 tasks · 4 inputs · 0 outputs

Inputs

  • Host — Deploy D2 on target Host
  • OS — The default OS type of target host
  • Credentials — Name of the credential set from Demisto Settings -> Integrations -> Credentials
  • Path — If initialized, D2 will try and collect the file at target path

Flowchart

no yes yes yes Start Start Add the endpoint as a System to this incident - IncidentAddSystem Add the endpoint as a Sys... IncidentAddSystem d2 agent - Get process list - D2ExecuteCommand d2 agent - Get process list D2ExecuteCommand d2 agent - Get hardware details - D2ExecuteCommand d2 agent - Get hardware d... D2ExecuteCommand d2 agent - Get active users - ActiveUsersD2 d2 agent - Get active users ActiveUsersD2 Does 'Host' input exist? - Exists Does 'Host' input exist? Exists Any files on endpoint that we should collect? - Exists Any files on endpoint tha... Exists d2 agent - Collect file from endpoint - FetchFileD2 d2 agent - Collect file f... FetchFileD2 Done Done Collect data from endpoint Collect data from endpoint Is the OS type Windows? - AreValuesEqual Is the OS type Windows? AreValuesEqual