MDE - Retrieve File

This playbook is part of the ‘Malware Investigation And Response’ pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. This playbook uses the Live Response feature to retrieve a file from an endpoint. The playbook supports a supplied machine id as an input. Otherwise, it will take the Device ID incident field. The playbook supports only one element to be retrieved for each task (if needed more then one - use the playbook loop feature).

Microsoft Defender for Endpoint · 6 tasks · 2 inputs · 2 outputs

Details

ID	`MDE - Retrieve File`
From Version	6.5.0
Tasks	6

README

This playbook is part of the ‘Malware Investigation And Response’ pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response.
This playbook uses the Live Response feature to retrieve a file from an endpoint.
The playbook supports a supplied machine id as an input. Otherwise, it will take the Device ID incident field.
The playbook supports only one element to be retrieved for each task (if needed more then one - use the playbook loop feature).

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

MicrosoftDefenderAdvancedThreatProtection

Scripts

isError
UnzipFile

Commands

microsoft-atp-live-response-get-file

Playbook Inputs

Name	Description	Default Value	Required
paths	The file paths to be provided.		Optional
MachineID	The ID of the machine.		Optional

Playbook Outputs

Path	Description	Type
ExtractedFiles	A list of file names that were extracted from the ZIP file.	Unknown
MicrosoftATP.LiveResponseAction.status	The machine action status.	unknown

Playbook Image

MDE - Retrieve File

Inputs

paths — The file paths to be provided.
MachineID — The ID of the machine.

Outputs

ExtractedFiles — A list of file names that were extracted from the ZIP file.
MicrosoftATP.LiveResponseAction.status — The machine action status.

Commands used

microsoft-atp-live-response-get-file

Flowchart

Source

playbook-MDE_-_Retrieve_File.yml

Download History Raw

contentitemexportablefields:
  contentitemfields: {}
description: |-
  This playbook is part of the ‘Malware Investigation And Response’ pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response.
  This playbook uses the Live Response feature to retrieve a file from an endpoint. The playbook supports a supplied machine id as an input. Otherwise, it will take the Device ID incident field.
  The playbook supports only one element to be retrieved for each task (if needed more then one - use the playbook loop feature).
id: MDE - Retrieve File
inputs:
- description: The file paths to be provided.
  key: paths
  playbookInputQuery:
  required: false
  value: {}
- key: MachineID
  value: {}
  required: false
  description: The ID of the machine.
  playbookInputQuery:
name: MDE - Retrieve File
outputs:
- contextPath: ExtractedFiles
  description: A list of file names that were extracted from the ZIP file.
  type: Unknown
- contextPath: MicrosoftATP.LiveResponseAction.status
  description: The machine action status.
starttaskid: '0'
tasks:
  '0':
    id: '0'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '5'
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      id: 94cc3210-9c2d-4a3b-8959-b1f377dccbb0
      iscommand: false
      name: ''
      version: -1
      description: ''
    taskid: 94cc3210-9c2d-4a3b-8959-b1f377dccbb0
    timertriggers: []
    type: start
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": -130
        }
      }
    continueonerrortype: ""
  '1':
    continueonerror: true
    id: '1'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '4'
    note: false
    quietmode: 0
    scriptarguments:
      comment:
        simple: Retrieving file - XSOAR PB ${incident.id}
      machine_id:
        complex:
          root: inputs.MachineID
          transformers:
          - operator: If-Then-Else
            args:
              condition:
                value:
                  simple: lhs==rhs
              conditionB: {}
              conditionInBetween: {}
              else:
                value:
                  simple: inputs.MachineID
                iscontext: true
              equals: {}
              lhs:
                value:
                  simple: inputs.MachineID
                iscontext: true
              lhsB: {}
              options: {}
              optionsB: {}
              rhs: {}
              rhsB: {}
              then:
                value:
                  simple: incident.deviceid
                iscontext: true
          - operator: uniq
      path:
        complex:
          root: inputs.paths
          transformers:
          - operator: uniq
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      description: 'Collect a file from a device. NOTE: Backslashes in the path must be escaped.'
      id: f8457656-c30e-419a-8180-ed226398217d
      iscommand: true
      name: Retrieve File From MDE Live Response
      script: '|||microsoft-atp-live-response-get-file'
      type: regular
      version: -1
    taskid: f8457656-c30e-419a-8180-ed226398217d
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": -60,
          "y": 185
        }
      }
    continueonerrortype: ""
  '2':
    id: '2'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      id: 8a7e0229-c76b-4de6-8166-2f693b1ff2c2
      iscommand: false
      name: Done
      type: title
      version: -1
      description: ''
    taskid: 8a7e0229-c76b-4de6-8166-2f693b1ff2c2
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 730
        }
      }
    continueonerrortype: ""
  '3':
    evidencedata:
      customfields: {}
      description:
        simple: Retrieved Files
    id: '3'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '2'
    note: false
    quietmode: 0
    scriptarguments:
      entryID:
        complex:
          accessor: EntryID
          filters:
          - - ignorecase: true
              left:
                iscontext: true
                value:
                  simple: File.Extension
              operator: containsString
              right:
                value:
                  simple: gz
          - - operator: containsString
              left:
                value:
                  simple: File.Name
                iscontext: true
              right:
                value:
                  simple: Response Result
              ignorecase: true
          root: File
          transformers:
          - operator: LastArrayElement
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      description: Unzips a file using file name or entry ID to specify a file. Unzipped files are loaded to the War Room and names are put into the context.
      id: e2ab0b64-e4e8-464c-848c-5e1e182224d0
      iscommand: false
      name: Unzip results
      scriptName: UnzipFile
      type: regular
      version: -1
    taskid: e2ab0b64-e4e8-464c-848c-5e1e182224d0
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": -300,
          "y": 550
        }
      }
    continueonerrortype: ""
  '4':
    id: '4'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      yes:
      - '2'
      no:
      - '3'
    note: false
    quietmode: 0
    scriptarguments:
      entryId:
        simple: ${lastCompletedTaskEntries}
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      description: Checks whether specific entries returned an error. Use ${lastCompletedTaskEntries} to check the previous task entries. If an array is provided, will return 'yes' if one of the entries returned an error.
      id: 801e51fe-c520-4660-8dc9-65dc9d5b3721
      iscommand: false
      name: Any errors from the retrieval?
      scriptName: isError
      type: condition
      version: -1
    taskid: 801e51fe-c520-4660-8dc9-65dc9d5b3721
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": -60,
          "y": 360
        }
      }
    continueonerrortype: ""
  '5':
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              simple: inputs.paths
          operator: isNotEmpty
          right:
            value: {}
      - - left:
            iscontext: true
            value:
              simple: inputs.paths
          operator: match
          right:
            value:
              simple: ^[a-zA-Z]:(\\[\w_\d-])*([\\]|[.]*[a-zA-Z0-9_-])*?$
      label: yes
    id: '5'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#default#':
      - '2'
      yes:
      - '1'
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      description: Was file path provided?
      id: a682d3e4-e248-4b3e-8106-95fb3cb2d377
      iscommand: false
      name: File Path was provided?
      type: condition
      version: -1
    taskid: a682d3e4-e248-4b3e-8106-95fb3cb2d377
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 10
        }
      }
    continueonerrortype: ""
version: -1
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 925,
        "width": 842.5,
        "x": -300,
        "y": -130
      }
    }
  }
tests:
- Test Playbook - MDE - Retrieve File
fromversion: 6.5.0
system: true