Get File Sample From Path - Generic V3

This playbook returns a file sample from a specified path and host that you input in the following playbooks: - PS Remote Get File Sample From Path - Get File Sample From Path - VMware Carbon Black EDR (Live Response API) - CrowdStrike Falcon - Retrieve File - MDE - Retrieve File - Cortex XDR - Retrieve File V2

Common Playbooks · 12 tasks · 3 inputs · 14 outputs

Details

ID	`Get File Sample From Path - Generic V3`
From Version	6.0.0
Tasks	12

README

This playbook returns a file sample from a specified path and host that you input in the following playbooks:

PS Remote Get File Sample From Path
Get File Sample From Path - VMware Carbon Black EDR (Live Response API)
CrowdStrike Falcon - Retrieve File
MDE - Retrieve File
Cortex XDR - Retrieve File V2

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

MDE - Retrieve File
CrowdStrike Falcon - Retrieve File
Get File Sample From Path - VMware Carbon Black EDR - Live Response API
Cortex XDR - Retrieve File v2
PS Remote Get File Sample From Path

Integrations

This playbook does not use any integrations.

Scripts

This playbook does not use any scripts.

Commands

This playbook does not use any commands.

Playbook Inputs

Name	Description	Required
Host	Hostname of the machine on which the file is located, for PS remote it can also be an IP address.	Optional
Path	The path of the file to retrieve. For example: C:\users\folder\file.txt	Optional
Agent_ID	The ID of the agent, or of the endpoint, in the relevant integration (such as EDR).	Optional

Playbook Outputs

Path	Description	Type
File.Size	The size of the file.	number
File.Type	The type of the file.	string
File.Info	General information of the file.	string
File.MD5	The MD5 hash of the file.	string
File.SHA1	The SHA1 hash of the file.	string
File.SHA256	The SHA256 hash of the file.	string
File.SHA512	The SHA512 hash of the file.	string
File.EntryID	The file entry ID.	string
File.Extension	The file extension.	string
File.Name	The file name.	string
File.SSDeep	File SSDeep.	string
AcquiredFile	The acquired file details.	Unknown
ExtractedFiles	A list of file names that were extracted from the ZIP file.	string
NonRetrievedFiles	A list of files that were not retrieved.	string

Playbook Image

Get File Sample From Path - Generic V3

Inputs

Host — Hostname of the machine on which the file is located, for PS remote it can also be an IP address.
Path — The path of the file to retrieve. For example: C:\users\folder\file.txt
Agent_ID — The ID of the agent, or of the endpoint, in the relevant integration (such as EDR).

Outputs

File.Size — The size of the file.
File.Type — The type of the file.
File.Info — General information of the file.
File.MD5 — The MD5 hash of the file.
File.SHA1 — The SHA1 hash of the file.
File.SHA256 — The SHA256 hash of the file.
File.SHA512 — The SHA512 hash of the file.
File.EntryID — The file entry ID.
File.Extension — The file extension.
File.Name — The file name.
File.SSDeep — File SSDeep.
AcquiredFile — The acquired file details.
ExtractedFiles — A list of file names that were extracted from the ZIP file.
NonRetrievedFiles — A list of files that were not retrieved.

Flowchart

Source

playbook-Get_File_Sample_From_Path_-_Generic_V3.yml

Download History Raw

id: Get File Sample From Path - Generic V3
version: -1
contentitemexportablefields:
  contentitemfields: {}
name: Get File Sample From Path - Generic V3
description: |-
  This playbook returns a file sample from a specified path and host that you input in the following playbooks:
  - PS Remote Get File Sample From Path
  - Get File Sample From Path - VMware Carbon Black EDR (Live Response API)
  - CrowdStrike Falcon - Retrieve File
  - MDE - Retrieve File
  - Cortex XDR - Retrieve File V2
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 5d887731-fb71-4226-872c-a9e8dbddac42
    type: start
    task:
      id: 5d887731-fb71-4226-872c-a9e8dbddac42
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "11"
      - "14"
      - "15"
      - "16"
      - "17"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: f81d6908-8ce9-452b-8dde-689f44256933
    type: title
    task:
      id: f81d6908-8ce9-452b-8dde-689f44256933
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 515
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: 906138a1-e3ee-4711-889a-4ebcc8c2a1c6
    type: title
    task:
      id: 906138a1-e3ee-4711-889a-4ebcc8c2a1c6
      version: -1
      name: Use VMware Carbon Black EDR (Live Response API)
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "12"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 60,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: 6d73fcbe-5c0f-4dec-8fa4-9f0c1dd70a8d
    type: playbook
    task:
      id: 6d73fcbe-5c0f-4dec-8fa4-9f0c1dd70a8d
      version: -1
      name: Get File Sample From Path - VMware Carbon Black EDR - Live Response API
      description: |-
        This playbook retrieves a file from a path on an endpoint using VMware Carbon Black EDR (Live Response API).
        Make sure to provide the Carbon Black sensor ID of the endpoint from which you want to retrieve the file.
      playbookName: Get File Sample From Path - VMware Carbon Black EDR - Live Response API
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      Path:
        simple: ${inputs.Path}
      Sensor_ID:
        simple: ${inputs.Agent_ID}
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 60,
          "y": 340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: 9c4ed95f-7e7e-4dcc-8c09-29a421593849
    type: playbook
    task:
      id: 9c4ed95f-7e7e-4dcc-8c09-29a421593849
      version: -1
      name: PS Remote Get File Sample From Path
      description: This playbook leverages the Windows built-in PowerShell and WinRM capabilities to connect to a Windows host to acquire a file as forensic evidence for further analysis.
      playbookName: PS Remote Get File Sample From Path
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      AddHostNameToFile:
        simple: "true"
      FilePath:
        simple: ${inputs.Path}
      Host:
        simple: ${inputs.Host}
      ZipFile:
        simple: "true"
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 480,
          "y": 340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: 4ae1d82e-3106-42b4-848e-67f64641dd08
    type: title
    task:
      id: 4ae1d82e-3106-42b4-848e-67f64641dd08
      version: -1
      name: Use Powershell Remoting
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "13"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: c12382b6-414b-4613-8ba2-3a686f22ba19
    type: title
    task:
      id: c12382b6-414b-4613-8ba2-3a686f22ba19
      version: -1
      name: Use Microsoft Defender for Endpoint
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "20"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 900,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "16":
    id: "16"
    taskid: dd5f9bca-f2d6-4d83-8188-372acf9aafc5
    type: title
    task:
      id: dd5f9bca-f2d6-4d83-8188-372acf9aafc5
      version: -1
      name: Use CrowdStrike Falcon
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "19"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -360,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "17":
    id: "17"
    taskid: 9abf10fa-2f9e-4714-83ce-94f1e9388e92
    type: title
    task:
      id: 9abf10fa-2f9e-4714-83ce-94f1e9388e92
      version: -1
      name: Use Cortex XDR
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "18"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1310,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "18":
    id: "18"
    taskid: 291977e7-1951-462c-8875-7a8f13ad4636
    type: playbook
    task:
      id: 291977e7-1951-462c-8875-7a8f13ad4636
      version: -1
      name: Cortex XDR - Retrieve File v2
      description: |-
        This playbook retrieves files from selected endpoints. You can retrieve up to 20 files, from 10 endpoints.
        Inputs for this playbook are:
        - A comma-separated list of endpoint IDs.
        - A comma-separated list of file paths for your operating system, either Windows, Linux, or Mac. At least one file path is required.
      playbookName: Cortex XDR - Retrieve File v2
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      endpoint_ids:
        complex:
          root: inputs.Agent_ID
          transformers:
          - operator: uniq
      file_path:
        complex:
          root: inputs.Path
          transformers:
          - operator: uniq
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 1310,
          "y": 340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "19":
    id: "19"
    taskid: 093a8aa7-07c9-45e3-85de-b08c39983dce
    type: playbook
    task:
      id: 093a8aa7-07c9-45e3-85de-b08c39983dce
      version: -1
      name: CrowdStrike Falcon - Retrieve File
      description: |-
        This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response.
        This playbook retrieves and unzips files from CrowdStrike Falcon and returns a list of the files that were and were not retrieved.
      playbookName: CrowdStrike Falcon - Retrieve File
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      HostId:
        complex:
          root: inputs.Agent_ID
          transformers:
          - operator: uniq
      PathsToGet:
        complex:
          root: inputs.Path
          transformers:
          - operator: uniq
      ZipPassword:
        simple: infected
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": -360,
          "y": 340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "20":
    id: "20"
    taskid: 8232fa6d-94a4-4d02-8ea4-dd0d3144fcaa
    type: playbook
    task:
      id: 8232fa6d-94a4-4d02-8ea4-dd0d3144fcaa
      version: -1
      name: MDE - Retrieve File
      description: |-
        This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response.
        This playbook uses the Live Response feature to retrieve a file from an endpoint./nNote that the endpoint ID will be set from the incident field "DeviceID".
      playbookName: MDE - Retrieve File
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      MachineID:
        complex:
          root: inputs.Agent_ID
          transformers:
          - operator: uniq
      paths:
        complex:
          root: inputs.Path
          transformers:
          - operator: uniq
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 900,
          "y": 340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 530,
        "width": 2050,
        "x": -360,
        "y": 50
      }
    }
  }
inputs:
- key: Host
  value: {}
  required: false
  description: Hostname of the machine on which the file is located, for PS remote it can also be an IP address.
  playbookInputQuery:
- key: Path
  value: {}
  required: false
  description: |
    The path of the file to retrieve.
    For example:
    C:\users\folder\file.txt
  playbookInputQuery:
- key: Agent_ID
  value: {}
  required: false
  description: The ID of the agent, or of the endpoint, in the relevant integration (such as EDR).
  playbookInputQuery:
outputs:
- contextPath: File.Size
  description: The size of the file.
  type: number
- contextPath: File.Type
  description: The type of the file.
  type: string
- contextPath: File.Info
  description: General information of the file.
  type: string
- contextPath: File.MD5
  description: The MD5 hash of the file.
  type: string
- contextPath: File.SHA1
  description: The SHA1 hash of the file.
  type: string
- contextPath: File.SHA256
  description: The SHA256 hash of the file.
  type: string
- contextPath: File.SHA512
  description: The SHA512 hash of the file.
  type: string
- contextPath: File.EntryID
  description: The file entry ID.
  type: string
- contextPath: File.Extension
  description: The file extension.
  type: string
- contextPath: File.Name
  description: The file name.
  type: string
- contextPath: File.SSDeep
  description: File SSDeep.
  type: string
- contextPath: AcquiredFile
  description: The acquired file details.
  type: Unknown
- contextPath: ExtractedFiles
  description: A list of file names that were extracted from the ZIP file.
  type: string
- contextPath: NonRetrievedFiles
  description: A list of files that were not retrieved.
  type: string
tests:
- No tests.
fromversion: 6.0.0