Get File Sample From Path - Generic V3

This playbook returns a file sample from a specified path and host that you input in the following playbooks: - PS Remote Get File Sample From Path - Get File Sample From Path - VMware Carbon Black EDR (Live Response API) - CrowdStrike Falcon - Retrieve File - MDE - Retrieve File - Cortex XDR - Retrieve File V2

Common Playbooks · 12 tasks · 3 inputs · 14 outputs

Inputs

  • Host — Hostname of the machine on which the file is located, for PS remote it can also be an IP address.
  • Path — The path of the file to retrieve. For example: C:\users\folder\file.txt
  • Agent_ID — The ID of the agent, or of the endpoint, in the relevant integration (such as EDR).

Outputs

  • File.Size — The size of the file.
  • File.Type — The type of the file.
  • File.Info — General information of the file.
  • File.MD5 — The MD5 hash of the file.
  • File.SHA1 — The SHA1 hash of the file.
  • File.SHA256 — The SHA256 hash of the file.
  • File.SHA512 — The SHA512 hash of the file.
  • File.EntryID — The file entry ID.
  • File.Extension — The file extension.
  • File.Name — The file name.
  • File.SSDeep — File SSDeep.
  • AcquiredFile — The acquired file details.
  • ExtractedFiles — A list of file names that were extracted from the ZIP file.
  • NonRetrievedFiles — A list of files that were not retrieved.

Flowchart

Start Start Done Done Use VMware Carbon Black EDR (Live Response API) Use VMware Carbon Black E... Get File Sample From Path - VMware Carbon Black EDR - Live Response API - Get File Sample From Path - VMware Carbon Black EDR - Live Response API Get File Sample From Path... Get File Sample From Path - V... PS Remote Get File Sample From Path - PS Remote Get File Sample From Path PS Remote Get File Sample... PS Remote Get File Sample Fro... Use Powershell Remoting Use Powershell Remoting Use Microsoft Defender for Endpoint Use Microsoft Defender fo... Use CrowdStrike Falcon Use CrowdStrike Falcon Use Cortex XDR Use Cortex XDR Cortex XDR - Retrieve File v2 - Cortex XDR - Retrieve File v2 Cortex XDR - Retrieve Fil... Cortex XDR - Retrieve File v2 CrowdStrike Falcon - Retrieve File - CrowdStrike Falcon - Retrieve File CrowdStrike Falcon - Retr... CrowdStrike Falcon - Retrieve... MDE - Retrieve File - MDE - Retrieve File MDE - Retrieve File MDE - Retrieve File