Get the binary file from Carbon Black by its MD5 hash

This playbook retrieves a binary file by its MD5 hash from the Carbon Black telemetry data.

Carbon Black Enterprise Response · 5 tasks · 1 input · 11 outputs

Details

IDGet the binary file from Carbon Black by its MD5 hash
From Version5.0.0
Tasks5

README

This playbook retrieves the binary file by its MD5 hash from the Carbon Black telemetry data.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

integration-Carbon_Black_Enterprise_Response

Scripts

IsIntegrationAvailable

Commands

cb-binary-download

Playbook Inputs

Name Description Default Value Required
MD5 MD5 hash of the binary file to be retrieved, File.MD5 Optional

Playbook Outputs

Path Description Type
File.Size The size of the file. number
File.Type The type of the file. string
File.Info General information of the file. string
File.MD5 The MD5 hash of the file. string
File.SHA1 The SHA1 hash of the file. string
File.SHA256 The SHA256 hash of the file. string
File.SHA512 The SHA512 hash of the file. string
File.SSDeep The file SSDeep. string
File.Name The file name. string
File.EntryID File entry ID. string
File.Extension The file extension. string

Playbook Image

Get binary file from Carbon Black by its MD5 hash

Inputs

  • MD5 — MD5 hash of the binary file to be retrieved.

Outputs

  • File.Size — The size of the file.
  • File.Type — The type of the file.
  • File.Info — General information of the file.
  • File.MD5 — The MD5 hash of the file.
  • File.SHA1 — The SHA1 hash of the file.
  • File.SHA256 — The SHA256 hash of the file.
  • File.SHA512 — The SHA512 hash of the file.
  • File.SSDeep — The file SSDeep.
  • File.Name — The file name.
  • File.EntryID — File entry ID.
  • File.Extension — The file extension.

Commands used

cb-edr-binary-download

Flowchart

no yes yes Start Start Is VMware Carbon Black EDR v2 enabled? - IsIntegrationAvailable Is VMware Carbon Black ED... IsIntegrationAvailable Done Done Is the MD5 hash provided? Is the MD5 hash provided? Get the binary file from Carbon Black by its MD5 hash - cb-edr-binary-download Get the binary file from ... cb-edr-binary-download

Source

playbook-Get_binary_file_from_Carbon_Black_by_its_MD5_hash.yml
Download History Raw 
id: Get the binary file from Carbon Black by its MD5 hash
version: -1
name: Get the binary file from Carbon Black by its MD5 hash
description: This playbook retrieves a binary file by its MD5 hash from the Carbon
  Black telemetry data.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 64f62e76-d158-4d5a-8b02-a273e6f3b545
    type: start
    task:
      id: 64f62e76-d158-4d5a-8b02-a273e6f3b545
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "1":
    id: "1"
    taskid: 2af5f32e-9d78-4753-81e3-6be566ecf9fd
    type: condition
    task:
      id: 2af5f32e-9d78-4753-81e3-6be566ecf9fd
      version: -1
      name: 'Is VMware Carbon Black EDR v2 enabled? '
      description: Returns 'yes' if the integration brand is available. Otherwise
        returns 'no'.
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "2"
      "yes":
      - "3"
    scriptarguments:
      brandname:
        simple: VMware Carbon Black EDR v2
    results:
    - brandInstances
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 230
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "2":
    id: "2"
    taskid: f0b5b288-8a80-4828-8d85-585db9400a03
    type: title
    task:
      id: f0b5b288-8a80-4828-8d85-585db9400a03
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1010
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "3":
    id: "3"
    taskid: 906150a0-7387-437f-8bc7-998e2f0dc517
    type: condition
    task:
      id: 906150a0-7387-437f-8bc7-998e2f0dc517
      version: -1
      name: Is the MD5 hash provided?
      description: ''
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "4"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.MD5
            iscontext: true
    view: |-
      {
        "position": {
          "x": 770,
          "y": 460
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "4":
    id: "4"
    taskid: 417a3cd6-63f9-4c91-86f8-8e6903c288ca
    type: regular
    task:
      id: 417a3cd6-63f9-4c91-86f8-8e6903c288ca
      version: -1
      name: Get the binary file from Carbon Black by its MD5 hash
      description: Retrieve a binary from CarbonBlack based on its hash. Returns a
        .zip file containing the requested file and its metadata.
      script: '|||cb-edr-binary-download'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      md5:
        complex:
          root: inputs.MD5
      summary: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 980,
          "y": 660
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {
      "1_2_no": 0.66,
      "3_2_#default#": 0.46
    },
    "paper": {
      "dimensions": {
        "height": 1025,
        "width": 910,
        "x": 450,
        "y": 50
      }
    }
  }
inputs:
- key: MD5
  value:
    complex:
      root: File
      accessor: MD5
  required: false
  description: MD5 hash of the binary file to be retrieved.
  playbookInputQuery:
outputs:
- contextPath: File.Size
  description: The size of the file.
  type: number
- contextPath: File.Type
  description: The type of the file.
  type: string
- contextPath: File.Info
  description: General information of the file.
  type: string
- contextPath: File.MD5
  description: The MD5 hash of the file.
  type: string
- contextPath: File.SHA1
  description: The SHA1 hash of the file.
  type: string
- contextPath: File.SHA256
  description: The SHA256 hash of the file.
  type: string
- contextPath: File.SHA512
  description: The SHA512 hash of the file.
  type: string
- contextPath: File.SSDeep
  description: The file SSDeep.
  type: string
- contextPath: File.Name
  description: The file name.
  type: string
- contextPath: File.EntryID
  description: File entry ID.
  type: string
- contextPath: File.Extension
  description: The file extension.
  type: string
tests:
- Carbon Black Response Test
fromversion: 5.0.0