Get File Sample By Hash - Generic v3

This playbook returns a file sample correlating to a hash in the War Room using the following sub-playbooks: - Get binary file by MD5 hash from Carbon Black telemetry data - VMware Carbon Black EDR v2. - Get the threat (file) associated with a specific SHA256 hash - Cylance Protect v2. - Get the file associated with a specific MD5 or SHA256 hash - Code42.

Common Playbooks · 5 tasks · 3 inputs · 11 outputs

Details

ID	`Get File Sample By Hash - Generic v3`
From Version	5.0.0
Tasks	5

README

This playbook returns a file sample correlating to a hash in the War Room using the following sub-playbooks:

Get binary file by MD5 hash from Carbon Black telemetry data - VMware Carbon Black EDR v2.
Get the threat (file) associated with a specific SHA256 hash - Cylance Protect v2.
Get the file associated with a specific MD5 or SHA256 hash - Code42.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

Get the binary file from Carbon Black by its MD5 hash
Code42 File Download
Get File Sample By Hash - Cylance Protect v2

Integrations

This playbook does not use any integrations.

Scripts

This playbook does not use any scripts.

Commands

This playbook does not use any commands.

Playbook Inputs

Name	Description	Required
MD5	The MD5 hash value for the file to retrieve.	Optional
SHA256	The SHA256 hash value for the file to retrieve.	Optional
NewFilename	A new name for the retrieved file. If left empty, the filename will not change.	Optional

Playbook Outputs

Path	Description	Type
File.Size	The size of the file.	number
File.Type	The type of the file.	string
File.Info	General information of the file.	string
File.MD5	The MD5 hash of the file.	string
File.SHA1	The SHA1 hash of the file.	string
File.SHA256	The SHA256 hash of the file.	string
File.SHA512	The SHA512 hash of the file.	string
File.SSDeep	The SSDeep of the file.	string
File.Extension	The file extension.	string
File.EntryID	The file entry ID.	string
File.Name	The file name.	string

Playbook Image

Get File Sample By Hash - Generic v3

Inputs

MD5 — The MD5 hash value for the file to retrieve.
SHA256 — The SHA256 hash value for the file to retrieve.
NewFilename — A new name for the retrieved file. If left empty, the filename will not change.

Outputs

File.Size — The size of the file.
File.Type — The type of the file.
File.Info — General information of the file.
File.MD5 — The MD5 hash of the file.
File.SHA1 — The SHA1 hash of the file.
File.SHA256 — The SHA256 hash of the file.
File.SHA512 — The SHA512 hash of the file.
File.SSDeep — The SSDeep of the file.
File.Extension — The file extension.
File.EntryID — The file entry ID.
File.Name — The file name.

Flowchart

Source

playbook-Get_File_Sample_By_Hash_-_Generic_v3.yml

Download History Raw

id: Get File Sample By Hash - Generic v3
version: -1
name: Get File Sample By Hash - Generic v3
description: |-
  This playbook returns a file sample correlating to a hash in the War Room using the following sub-playbooks:
  - Get binary file by MD5 hash from Carbon Black telemetry data - VMware Carbon Black EDR v2.
  - Get the threat (file) associated with a specific SHA256 hash - Cylance Protect v2.
  - Get the file associated with a specific MD5 or SHA256 hash - Code42.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: e1c3bf5a-d7ba-4062-8877-ad2799d1db03
    type: start
    task:
      id: e1c3bf5a-d7ba-4062-8877-ad2799d1db03
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "5"
      - "6"
      - "7"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: b5e5705d-8e32-41bb-8c3b-63c78bd2d14f
    type: title
    task:
      id: b5e5705d-8e32-41bb-8c3b-63c78bd2d14f
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: e912d085-264f-42f7-8a0f-b5aa82b96072
    type: playbook
    task:
      id: e912d085-264f-42f7-8a0f-b5aa82b96072
      version: -1
      name: Get File Sample By Hash - Cylance Protect v2
      description: This playbook returns a file sample to the War Room given the file's SHA256 hash, using Cylance Protect v2 integration.
      playbookName: Get File Sample By Hash - Cylance Protect v2
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      SHA256:
        complex:
          root: inputs.SHA256
          transformers:
          - operator: uniq
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 265,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: 1ac553d1-5315-4391-8875-63c8ca4e9fa2
    type: playbook
    task:
      id: 1ac553d1-5315-4391-8875-63c8ca4e9fa2
      version: -1
      name: Get the binary file from Carbon Black by its MD5 hash
      description: This playbook retrieves a binary file by its MD5 hash from the Carbon Black telemetry data.
      playbookName: Get the binary file from Carbon Black by its MD5 hash
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      MD5:
        complex:
          root: inputs.MD5
          transformers:
          - operator: uniq
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": -185,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: 9c2c0ffb-724a-40eb-8069-a8beb5de0775
    type: playbook
    task:
      id: 9c2c0ffb-724a-40eb-8069-a8beb5de0775
      version: -1
      name: Code42 File Download
      description: This playbook downloads a file via Code42 by either MD5 or SHA256 hash.
      playbookName: Code42 File Download
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      Filename:
        complex:
          root: inputs.NewFilename
      MD5:
        complex:
          root: inputs.MD5
          transformers:
          - operator: uniq
      SHA256:
        complex:
          root: inputs.SHA256
          transformers:
          - operator: uniq
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 705,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 385,
        "width": 1270,
        "x": -185,
        "y": 50
      }
    }
  }
inputs:
- key: MD5
  value: {}
  required: false
  description: The MD5 hash value for the file to retrieve.
  playbookInputQuery:
- key: SHA256
  value: {}
  required: false
  description: The SHA256 hash value for the file to retrieve.
  playbookInputQuery:
- key: NewFilename
  value: {}
  required: false
  description: A new name for the retrieved file. If left empty, the filename will not change.
  playbookInputQuery:
outputs:
- contextPath: File.Size
  description: The size of the file.
  type: number
- contextPath: File.Type
  description: The type of the file.
  type: string
- contextPath: File.Info
  description: General information of the file.
  type: string
- contextPath: File.MD5
  description: The MD5 hash of the file.
  type: string
- contextPath: File.SHA1
  description: The SHA1 hash of the file.
  type: string
- contextPath: File.SHA256
  description: The SHA256 hash of the file.
  type: string
- contextPath: File.SHA512
  description: The SHA512 hash of the file.
  type: string
- contextPath: File.SSDeep
  description: The SSDeep of the file.
  type: string
- contextPath: File.Extension
  description: The file extension.
  type: string
- contextPath: File.EntryID
  description: The file entry ID.
  type: string
- contextPath: File.Name
  description: The file name.
  type: string
tests:
- No tests (auto formatted)
fromversion: 5.0.0
contentitemexportablefields:
  contentitemfields: {}