Get the binary file from Carbon Black by its MD5 hash

Details

ID	`Get the binary file from Carbon Black by its MD5 hash`
From Version	5.0.0
Tasks	5

README

This playbook retrieves the binary file by its MD5 hash from the Carbon Black telemetry data.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

integration-Carbon_Black_Enterprise_Response

Scripts

IsIntegrationAvailable

Commands

cb-binary-download

Playbook Inputs

Name	Description	Default Value	Required
MD5	MD5 hash of the binary file to be retrieved,	File.MD5	Optional

Playbook Outputs

Path	Description	Type
File.Size	The size of the file.	number
File.Type	The type of the file.	string
File.Info	General information of the file.	string
File.MD5	The MD5 hash of the file.	string
File.SHA1	The SHA1 hash of the file.	string
File.SHA256	The SHA256 hash of the file.	string
File.SHA512	The SHA512 hash of the file.	string
File.SSDeep	The file SSDeep.	string
File.Name	The file name.	string
File.EntryID	File entry ID.	string
File.Extension	The file extension.	string

Playbook Image

Get binary file from Carbon Black by its MD5 hash

Inputs

MD5 — MD5 hash of the binary file to be retrieved.

Outputs

File.Size — The size of the file.
File.Type — The type of the file.
File.Info — General information of the file.
File.MD5 — The MD5 hash of the file.
File.SHA1 — The SHA1 hash of the file.
File.SHA256 — The SHA256 hash of the file.
File.SHA512 — The SHA512 hash of the file.
File.SSDeep — The file SSDeep.
File.Name — The file name.
File.EntryID — File entry ID.
File.Extension — The file extension.

Commands used

cb-edr-binary-download

Flowchart

Source

playbook-Get_binary_file_from_Carbon_Black_by_its_MD5_hash.yml

Download History Raw

id: Get the binary file from Carbon Black by its MD5 hash
version: -1
name: Get the binary file from Carbon Black by its MD5 hash
description: This playbook retrieves a binary file by its MD5 hash from the Carbon
  Black telemetry data.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 64f62e76-d158-4d5a-8b02-a273e6f3b545
    type: start
    task:
      id: 64f62e76-d158-4d5a-8b02-a273e6f3b545
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "1":
    id: "1"
    taskid: 2af5f32e-9d78-4753-81e3-6be566ecf9fd
    type: condition
    task:
      id: 2af5f32e-9d78-4753-81e3-6be566ecf9fd
      version: -1
      name: 'Is VMware Carbon Black EDR v2 enabled? '
      description: Returns 'yes' if the integration brand is available. Otherwise
        returns 'no'.
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "2"
      "yes":
      - "3"
    scriptarguments:
      brandname:
        simple: VMware Carbon Black EDR v2
    results:
    - brandInstances
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 230
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "2":
    id: "2"
    taskid: f0b5b288-8a80-4828-8d85-585db9400a03
    type: title
    task:
      id: f0b5b288-8a80-4828-8d85-585db9400a03
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1010
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "3":
    id: "3"
    taskid: 906150a0-7387-437f-8bc7-998e2f0dc517
    type: condition
    task:
      id: 906150a0-7387-437f-8bc7-998e2f0dc517
      version: -1
      name: Is the MD5 hash provided?
      description: ''
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "4"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.MD5
            iscontext: true
    view: |-
      {
        "position": {
          "x": 770,
          "y": 460
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "4":
    id: "4"
    taskid: 417a3cd6-63f9-4c91-86f8-8e6903c288ca
    type: regular
    task:
      id: 417a3cd6-63f9-4c91-86f8-8e6903c288ca
      version: -1
      name: Get the binary file from Carbon Black by its MD5 hash
      description: Retrieve a binary from CarbonBlack based on its hash. Returns a
        .zip file containing the requested file and its metadata.
      script: '|||cb-edr-binary-download'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      md5:
        complex:
          root: inputs.MD5
      summary: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 980,
          "y": 660
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {
      "1_2_no": 0.66,
      "3_2_#default#": 0.46
    },
    "paper": {
      "dimensions": {
        "height": 1025,
        "width": 910,
        "x": 450,
        "y": 50
      }
    }
  }
inputs:
- key: MD5
  value:
    complex:
      root: File
      accessor: MD5
  required: false
  description: MD5 hash of the binary file to be retrieved.
  playbookInputQuery:
outputs:
- contextPath: File.Size
  description: The size of the file.
  type: number
- contextPath: File.Type
  description: The type of the file.
  type: string
- contextPath: File.Info
  description: General information of the file.
  type: string
- contextPath: File.MD5
  description: The MD5 hash of the file.
  type: string
- contextPath: File.SHA1
  description: The SHA1 hash of the file.
  type: string
- contextPath: File.SHA256
  description: The SHA256 hash of the file.
  type: string
- contextPath: File.SHA512
  description: The SHA512 hash of the file.
  type: string
- contextPath: File.SSDeep
  description: The file SSDeep.
  type: string
- contextPath: File.Name
  description: The file name.
  type: string
- contextPath: File.EntryID
  description: File entry ID.
  type: string
- contextPath: File.Extension
  description: The file extension.
  type: string
tests:
- Carbon Black Response Test
fromversion: 5.0.0