Get File Sample By Hash - Cylance Protect v2

This playbook returns a file sample to the War Room given the file's SHA256 hash, using Cylance Protect v2 integration.

Cylance Protect · 5 tasks · 2 inputs · 6 outputs

Details

ID	`Get File Sample By Hash - Cylance Protect v2`
From Version	5.0.0
Tasks	5

README

This playbook returns a file sample to the War Room given the file’s SHA256 hash, using Cylance Protect v2 integration.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

Cylance Protect v2

Scripts

This playbook does not use any scripts.

Commands

cylance-protect-download-threat

Playbook Inputs

Name	Description	Default Value	Required
SHA256		File.SHA256	Optional
unzip	Specifies whether the downloaded file will be unzipped. The command default is ‘no’. Yes - unzip automatically No - will not unzip		Optional

Playbook Outputs

Path	Description	Type
File.SHA256	SHA256 hash of the file.	unknown
File.Name	File name.	unknown
File.Size	File size.	unknown
File.Safelisted	Whether the file is on the Safe List.	unknown
File.Timestamp	Timestamp.	unknown
File.MD5	MD5 hash of the file.	unknown

Playbook Image

Get File Sample By Hash - Cylance Protect v2

Inputs

SHA256 — SHA256 hash of the file.
unzip — Specifies whether the downloaded file will be unzipped. The command default is 'no'. Yes - unzip automatically No - will not unzip

Outputs

File.SHA256 — SHA256 hash of the file.
File.Name — File name.
File.Size — File size.
File.Safelisted — Whether the file is on the safe list.
File.Timestamp — Timestamp.
File.MD5 — MD5 hash of the file.

Commands used

cylance-protect-download-threat

Flowchart

Source

playbook-Get_File_Sample_By_Hash_-_Cylance_Protect_v2.yml

Download History Raw

id: Get File Sample By Hash - Cylance Protect v2
version: -1
contentitemexportablefields:
  contentitemfields: {}
name: Get File Sample By Hash - Cylance Protect v2
description: This playbook returns a file sample to the War Room given the file's
  SHA256 hash, using Cylance Protect v2 integration.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: cfa6c853-3dae-449f-810e-8a0303dda6b0
    type: start
    task:
      id: cfa6c853-3dae-449f-810e-8a0303dda6b0
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "1":
    id: "1"
    taskid: a23dc210-7967-4632-81a5-ca345c80f56b
    type: condition
    task:
      id: a23dc210-7967-4632-81a5-ca345c80f56b
      version: -1
      name: Is Cylance Protect v2 enabled?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "3"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Cylance Protect v2
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "2":
    id: "2"
    taskid: d346aafe-2acb-49f6-81ae-dc461600d941
    type: title
    task:
      id: d346aafe-2acb-49f6-81ae-dc461600d941
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 710
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "3":
    id: "3"
    taskid: d3cb43ee-f52d-4112-8a87-4202337b4d29
    type: condition
    task:
      id: d3cb43ee-f52d-4112-8a87-4202337b4d29
      version: -1
      name: Is there a file to download?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "4"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.SHA256
            iscontext: true
    view: |-
      {
        "position": {
          "x": 320,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "4":
    id: "4"
    taskid: 6184269d-ba29-45f7-8c03-21613d4979d2
    type: regular
    task:
      id: 6184269d-ba29-45f7-8c03-21613d4979d2
      version: -1
      name: Cylance Protect - download threat
      description: Downloads the threat (file) attached to a specific SHA256 hash.
      script: '|||cylance-protect-download-threat'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      sha256:
        complex:
          root: inputs.SHA256
      threshold: {}
      unzip:
        complex:
          root: inputs.unzip
          transformers:
          - operator: toLowerCase
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 700,
          "y": 540
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
system: true
view: |-
  {
    "linkLabelsPosition": {
      "1_2_#default#": 0.28,
      "3_2_#default#": 0.35,
      "3_4_yes": 0.55
    },
    "paper": {
      "dimensions": {
        "height": 725,
        "width": 1030,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: SHA256
  value:
    complex:
      root: File
      accessor: SHA256
  required: false
  description: SHA256 hash of the file.
  playbookInputQuery:
- key: unzip
  value: {}
  required: false
  description: |-
    Specifies whether the downloaded file will be unzipped. The command default is 'no'.
    Yes - unzip automatically
    No - will not unzip
  playbookInputQuery:
outputs:
- contextPath: File.SHA256
  description: SHA256 hash of the file.
- contextPath: File.Name
  description: File name.
- contextPath: File.Size
  description: File size.
- contextPath: File.Safelisted
  description: Whether the file is on the safe list.
- contextPath: File.Timestamp
  description: Timestamp.
- contextPath: File.MD5
  description: MD5 hash of the file.
tests:
- No test
fromversion: 5.0.0