Get File Sample From Path - Generic V2 Deprecated

Deprecated. Use `Get File Sample From Path - Generic V3` instead. This playbook returns a file sample correlating to a path into the War Room using the following sub-playbooks: inputs: 1) Get File Sample From Path - D2. 2) Get File Sample From Path - VMware Carbon Black EDR (Live Response API).

Common Playbooks · 6 tasks · 4 inputs · 11 outputs

Details

IDGet File Sample From Path - Generic V2
From Version5.0.0
Tasks6

README

Deprecated. Use Get File Sample From Path - Generic V3 instead.
This playbook returns a file sample correlating to a path into the War Room using the following sub-playbooks:
inputs:
1) Get File Sample From Path - D2.
2) Get File Sample From Path - VMware Carbon Black EDR (Live Response API).

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • Get File Sample From Path - D2
  • Get File Sample From Path - VMware Carbon Black EDR - Live Response API

Integrations

This playbook does not use any integrations.

Scripts

This playbook does not use any scripts.

Commands

This playbook does not use any commands.

Playbook Inputs


Name Description Default Value Required
UseD2 Determines whether a D2 agent will be used to retrieve the file.
Options:
no (default)
yes
  Optional
Hostname Hostname of the machine on which the file is located.   Optional
Path The path of the file to retrieve.
For example:
C:\users\folder\file.txt
  Optional
Agent_ID The ID of the agent, or of the endpoint, in the relevant integration (such as EDR).   Optional

Playbook Outputs


Path Description Type
File.Size The size of the file. number
File.Type The type of the file. string
File.Info General information of the file. string
File.MD5 The MD5 hash of the file. string
File.SHA1 The SHA1 hash of the file. string
File.SHA256 The SHA256 hash of the file. string
File.SHA512 The SHA512 hash of the file. string
File.EntryID The file entry ID. string
File.Extension The file extension. string
File.Name The file name. string
File.SSDeep File SSDeep. string

Playbook Image


Get File Sample From Path - Generic V2

Inputs

  • UseD2 — Determines whether a D2 agent will be used to retrieve the file. Options: no (default) yes
  • Hostname — Hostname of the machine on which the file is located.
  • Path — The path of the file to retrieve. For example: C:\users\folder\file.txt
  • Agent_ID — The ID of the agent, or of the endpoint, in the relevant integration (such as EDR).

Outputs

  • File.Size — The size of the file.
  • File.Type — The type of the file.
  • File.Info — General information of the file.
  • File.MD5 — The MD5 hash of the file.
  • File.SHA1 — The SHA1 hash of the file.
  • File.SHA256 — The SHA256 hash of the file.
  • File.SHA512 — The SHA512 hash of the file.
  • File.EntryID — The file entry ID.
  • File.Extension — The file extension.
  • File.Name — The file name.
  • File.SSDeep — File SSDeep.

Flowchart

yes Start Start Use D2 agent? Use D2 agent? Done Done Get File Sample From Path - D2 - Get File Sample From Path - D2 Get File Sample From Path... Get File Sample From Path - D2 Use VMware Carbon Black EDR (Live Response API) Use VMware Carbon Black E... Get File Sample From Path - VMware Carbon Black EDR - Live Response API - Get File Sample From Path - VMware Carbon Black EDR - Live Response API Get File Sample From Path... Get File Sample From Path - V...
id: Get File Sample From Path - Generic V2
version: -1
name: Get File Sample From Path - Generic V2
deprecated: true
description: |
  Deprecated. Use `Get File Sample From Path - Generic V3` instead.
  This playbook returns a file sample correlating to a path into the War Room using the following sub-playbooks:
  inputs:
  1) Get File Sample From Path - D2.
  2) Get File Sample From Path - VMware Carbon Black EDR (Live Response API).
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 5d887731-fb71-4226-872c-a9e8dbddac42
    type: start
    task:
      id: 5d887731-fb71-4226-872c-a9e8dbddac42
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "1":
    id: "1"
    taskid: 8adb1ff3-5400-4f88-8a2b-4511ae8303f5
    type: condition
    task:
      id: 8adb1ff3-5400-4f88-8a2b-4511ae8303f5
      version: -1
      name: Use D2 agent?
      description: Yes, if we want to use the D2 agent to get the file.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "11"
      "yes":
      - "10"
    scriptarguments:
      left:
        simple: ${inputs.UseD2}
      right:
        simple: "True"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: inputs.UseD2
            iscontext: true
          right:
            value:
              simple: "yes"
    view: |-
      {
        "position": {
          "x": 265,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "8":
    id: "8"
    taskid: f81d6908-8ce9-452b-8dde-689f44256933
    type: title
    task:
      id: f81d6908-8ce9-452b-8dde-689f44256933
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "10":
    id: "10"
    taskid: acf75e5f-0da0-483e-82e2-2dbf09a0362c
    type: playbook
    task:
      id: acf75e5f-0da0-483e-82e2-2dbf09a0362c
      version: -1
      name: Get File Sample From Path - D2
      description: |-
        Returns a file sample to the War Room from a path on an endpoint using Demisto Dissolvable Agent (D2).

        Input:
        * Credentials - credentials to use when trying to deploy Demisto Dissolvable Agent (D2)  (default: Admin)
        * ${Endpoint.Hostname} - deploy agent on target endpoint
        * ${File.Path} - file's path to collect
      playbookName: Get File Sample From Path - D2
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      Credentials:
        simple: Admin
      Hostname:
        simple: ${inputs.Hostname}
      Path:
        simple: ${inputs.Path}
    separatecontext: false
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": -9,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  "11":
    id: "11"
    taskid: 906138a1-e3ee-4711-889a-4ebcc8c2a1c6
    type: title
    task:
      id: 906138a1-e3ee-4711-889a-4ebcc8c2a1c6
      version: -1
      name: Use VMware Carbon Black EDR (Live Response API)
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "12"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "12":
    id: "12"
    taskid: 03fe6fe7-8aa7-4329-8c0b-6cf3847128d7
    type: playbook
    task:
      id: 03fe6fe7-8aa7-4329-8c0b-6cf3847128d7
      version: -1
      name: Get File Sample From Path - VMware Carbon Black EDR - Live Response API
      description: |-
        This playbook retrieves a file from a path on an endpoint using VMware Carbon Black EDR (Live Response API).
        Make sure to provide the Carbon Black sensor ID of the endpoint from which you want to retrieve the file.
      playbookName: Get File Sample From Path - VMware Carbon Black EDR - Live Response API
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      Path:
        complex:
          root: inputs.Path
      Sensor_ID:
        complex:
          root: inputs.Agent_ID
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 480,
          "y": 510
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
system: true
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 705,
        "width": 869,
        "x": -9,
        "y": 50
      }
    }
  }
inputs:
- key: UseD2
  value: {}
  required: false
  description: |-
    Determines whether a D2 agent will be used to retrieve the file.
    Options:
    no (default)
    yes
  playbookInputQuery:
- key: Hostname
  value: {}
  required: false
  description: Hostname of the machine on which the file is located.
  playbookInputQuery:
- key: Path
  value: {}
  required: false
  description: |
    The path of the file to retrieve.
    For example:
    C:\users\folder\file.txt
  playbookInputQuery:
- key: Agent_ID
  value: {}
  required: false
  description: The ID of the agent, or of the endpoint, in the relevant integration (such as EDR).
  playbookInputQuery:
outputs:
- contextPath: File.Size
  description: The size of the file.
  type: number
- contextPath: File.Type
  description: The type of the file.
  type: string
- contextPath: File.Info
  description: General information of the file.
  type: string
- contextPath: File.MD5
  description: The MD5 hash of the file.
  type: string
- contextPath: File.SHA1
  description: The SHA1 hash of the file.
  type: string
- contextPath: File.SHA256
  description: The SHA256 hash of the file.
  type: string
- contextPath: File.SHA512
  description: The SHA512 hash of the file.
  type: string
- contextPath: File.EntryID
  description: The file entry ID.
  type: string
- contextPath: File.Extension
  description: The file extension.
  type: string
- contextPath: File.Name
  description: The file name.
  type: string
- contextPath: File.SSDeep
  description: File SSDeep.
  type: string
tests:
- Calculate Severity - Generic v2 - Test
- Test Convert file hash to corresponding hashes
- Detonate URL - Generic Test
- Detonate File - Generic Test
- test-domain-indicator
- Account Enrichment - Generic v2.1 - Test
- Generic Polling Test
- URL Enrichment - Generic v2 - Test
- Send Investigation Summary Reports - Test
- Endpoint Enrichment - Generic v2.1 - Test
- Wait Until Datetime - Test
- Detonate File - No Files test
- Domain Enrichment - Generic v2 - Test
- Calculate Severity - Standard - Test
- Retrieve File from Endpoint - Generic V2 Test
- Extract Indicators From File - Generic v2 - Test
- Field polling test
- Email Address Enrichment - Generic v2.1 - Test
- File Enrichment - Generic v2 - Test
- IP Enrichment - Generic v2 - Test
fromversion: 5.0.0