Get File Sample From Path - Generic V2 Deprecated
Deprecated. Use `Get File Sample From Path - Generic V3` instead. This playbook returns a file sample correlating to a path into the War Room using the following sub-playbooks: inputs: 1) Get File Sample From Path - D2. 2) Get File Sample From Path - VMware Carbon Black EDR (Live Response API).
Common Playbooks · 6 tasks · 4 inputs · 11 outputs
Details
| ID | Get File Sample From Path - Generic V2 |
|---|---|
| From Version | 5.0.0 |
| Tasks | 6 |
README
Deprecated. Use Get File Sample From Path - Generic V3 instead.
This playbook returns a file sample correlating to a path into the War Room using the following sub-playbooks:
inputs:
1) Get File Sample From Path - D2.
2) Get File Sample From Path - VMware Carbon Black EDR (Live Response API).
Dependencies
This playbook uses the following sub-playbooks, integrations, and scripts.
Sub-playbooks
- Get File Sample From Path - D2
- Get File Sample From Path - VMware Carbon Black EDR - Live Response API
Integrations
This playbook does not use any integrations.
Scripts
This playbook does not use any scripts.
Commands
This playbook does not use any commands.
Playbook Inputs
| Name | Description | Default Value | Required |
|---|---|---|---|
| UseD2 | Determines whether a D2 agent will be used to retrieve the file. Options: no (default) yes |
Optional | |
| Hostname | Hostname of the machine on which the file is located. | Optional | |
| Path | The path of the file to retrieve. For example: C:\users\folder\file.txt |
Optional | |
| Agent_ID | The ID of the agent, or of the endpoint, in the relevant integration (such as EDR). | Optional |
Playbook Outputs
| Path | Description | Type |
|---|---|---|
| File.Size | The size of the file. | number |
| File.Type | The type of the file. | string |
| File.Info | General information of the file. | string |
| File.MD5 | The MD5 hash of the file. | string |
| File.SHA1 | The SHA1 hash of the file. | string |
| File.SHA256 | The SHA256 hash of the file. | string |
| File.SHA512 | The SHA512 hash of the file. | string |
| File.EntryID | The file entry ID. | string |
| File.Extension | The file extension. | string |
| File.Name | The file name. | string |
| File.SSDeep | File SSDeep. | string |
Playbook Image

Inputs
UseD2— Determines whether a D2 agent will be used to retrieve the file. Options: no (default) yesHostname— Hostname of the machine on which the file is located.Path— The path of the file to retrieve. For example: C:\users\folder\file.txtAgent_ID— The ID of the agent, or of the endpoint, in the relevant integration (such as EDR).
Outputs
File.Size— The size of the file.File.Type— The type of the file.File.Info— General information of the file.File.MD5— The MD5 hash of the file.File.SHA1— The SHA1 hash of the file.File.SHA256— The SHA256 hash of the file.File.SHA512— The SHA512 hash of the file.File.EntryID— The file entry ID.File.Extension— The file extension.File.Name— The file name.File.SSDeep— File SSDeep.
Flowchart
id: Get File Sample From Path - Generic V2 version: -1 name: Get File Sample From Path - Generic V2 deprecated: true description: | Deprecated. Use `Get File Sample From Path - Generic V3` instead. This playbook returns a file sample correlating to a path into the War Room using the following sub-playbooks: inputs: 1) Get File Sample From Path - D2. 2) Get File Sample From Path - VMware Carbon Black EDR (Live Response API). starttaskid: "0" tasks: "0": id: "0" taskid: 5d887731-fb71-4226-872c-a9e8dbddac42 type: start task: id: 5d887731-fb71-4226-872c-a9e8dbddac42 version: -1 name: "" iscommand: false brand: "" description: '' nexttasks: '#none#': - "1" separatecontext: false view: |- { "position": { "x": 265, "y": 50 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "1": id: "1" taskid: 8adb1ff3-5400-4f88-8a2b-4511ae8303f5 type: condition task: id: 8adb1ff3-5400-4f88-8a2b-4511ae8303f5 version: -1 name: Use D2 agent? description: Yes, if we want to use the D2 agent to get the file. type: condition iscommand: false brand: "" nexttasks: '#default#': - "11" "yes": - "10" scriptarguments: left: simple: ${inputs.UseD2} right: simple: "True" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: simple: inputs.UseD2 iscontext: true right: value: simple: "yes" view: |- { "position": { "x": 265, "y": 195 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "8": id: "8" taskid: f81d6908-8ce9-452b-8dde-689f44256933 type: title task: id: f81d6908-8ce9-452b-8dde-689f44256933 version: -1 name: Done type: title iscommand: false brand: "" description: '' separatecontext: false view: |- { "position": { "x": 265, "y": 690 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "10": id: "10" taskid: acf75e5f-0da0-483e-82e2-2dbf09a0362c type: playbook task: id: acf75e5f-0da0-483e-82e2-2dbf09a0362c version: -1 name: Get File Sample From Path - D2 description: |- Returns a file sample to the War Room from a path on an endpoint using Demisto Dissolvable Agent (D2). Input: * Credentials - credentials to use when trying to deploy Demisto Dissolvable Agent (D2) (default: Admin) * ${Endpoint.Hostname} - deploy agent on target endpoint * ${File.Path} - file's path to collect playbookName: Get File Sample From Path - D2 type: playbook iscommand: false brand: "" nexttasks: '#none#': - "8" scriptarguments: Credentials: simple: Admin Hostname: simple: ${inputs.Hostname} Path: simple: ${inputs.Path} separatecontext: false loop: iscommand: false exitCondition: "" wait: 1 max: 0 view: |- { "position": { "x": -9, "y": 370 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 "11": id: "11" taskid: 906138a1-e3ee-4711-889a-4ebcc8c2a1c6 type: title task: id: 906138a1-e3ee-4711-889a-4ebcc8c2a1c6 version: -1 name: Use VMware Carbon Black EDR (Live Response API) type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "12" separatecontext: false view: |- { "position": { "x": 480, "y": 370 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "12": id: "12" taskid: 03fe6fe7-8aa7-4329-8c0b-6cf3847128d7 type: playbook task: id: 03fe6fe7-8aa7-4329-8c0b-6cf3847128d7 version: -1 name: Get File Sample From Path - VMware Carbon Black EDR - Live Response API description: |- This playbook retrieves a file from a path on an endpoint using VMware Carbon Black EDR (Live Response API). Make sure to provide the Carbon Black sensor ID of the endpoint from which you want to retrieve the file. playbookName: Get File Sample From Path - VMware Carbon Black EDR - Live Response API type: playbook iscommand: false brand: "" nexttasks: '#none#': - "8" scriptarguments: Path: complex: root: inputs.Path Sensor_ID: complex: root: inputs.Agent_ID separatecontext: true loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 480, "y": 510 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 system: true view: |- { "linkLabelsPosition": {}, "paper": { "dimensions": { "height": 705, "width": 869, "x": -9, "y": 50 } } } inputs: - key: UseD2 value: {} required: false description: |- Determines whether a D2 agent will be used to retrieve the file. Options: no (default) yes playbookInputQuery: - key: Hostname value: {} required: false description: Hostname of the machine on which the file is located. playbookInputQuery: - key: Path value: {} required: false description: | The path of the file to retrieve. For example: C:\users\folder\file.txt playbookInputQuery: - key: Agent_ID value: {} required: false description: The ID of the agent, or of the endpoint, in the relevant integration (such as EDR). playbookInputQuery: outputs: - contextPath: File.Size description: The size of the file. type: number - contextPath: File.Type description: The type of the file. type: string - contextPath: File.Info description: General information of the file. type: string - contextPath: File.MD5 description: The MD5 hash of the file. type: string - contextPath: File.SHA1 description: The SHA1 hash of the file. type: string - contextPath: File.SHA256 description: The SHA256 hash of the file. type: string - contextPath: File.SHA512 description: The SHA512 hash of the file. type: string - contextPath: File.EntryID description: The file entry ID. type: string - contextPath: File.Extension description: The file extension. type: string - contextPath: File.Name description: The file name. type: string - contextPath: File.SSDeep description: File SSDeep. type: string tests: - Calculate Severity - Generic v2 - Test - Test Convert file hash to corresponding hashes - Detonate URL - Generic Test - Detonate File - Generic Test - test-domain-indicator - Account Enrichment - Generic v2.1 - Test - Generic Polling Test - URL Enrichment - Generic v2 - Test - Send Investigation Summary Reports - Test - Endpoint Enrichment - Generic v2.1 - Test - Wait Until Datetime - Test - Detonate File - No Files test - Domain Enrichment - Generic v2 - Test - Calculate Severity - Standard - Test - Retrieve File from Endpoint - Generic V2 Test - Extract Indicators From File - Generic v2 - Test - Field polling test - Email Address Enrichment - Generic v2.1 - Test - File Enrichment - Generic v2 - Test - IP Enrichment - Generic v2 - Test fromversion: 5.0.0