Retrieve File from Endpoint - Generic Deprecated

Deprecated. Use `Retrieve File from Endpoint - Generic V3` instead. This playbook retrieves a file sample from an endpoint using the following playbooks: - Get File Sample From Path - Generic - Get File Sample By Hash - Generic v2

Common Playbooks · 4 tasks · 5 inputs · 0 outputs

Details

ID	`Retrieve File from Endpoint - Generic`
From Version	5.0.0
Tasks	4

README

Deprecated. Use Retrieve File from Endpoint - Generic V3 instead.
This playbook retrieves a file sample from an endpoint using the following playbooks:

Get File Sample From Path - Generic
Get File Sample By Hash - Generic v2

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

Get File Sample From Path - Generic
Get File Sample By Hash - Generic v2

Integrations

This playbook does not use any integrations.

Scripts

This playbook does not use any scripts.

Commands

This playbook does not use any commands.

Playbook Inputs

Name	Description	Default Value	Required
MD5	Get file sample from MD5 input.	File.MD5	Optional
SHA256	Get file sample from SHA256 input.	File.SHA256	Optional
Hostname	Hostname of the machine on which the file is located.	Endpoint.Hostname	Optional
Path	File path.	File.Path	Optional
UseD2	Determines whether a D2 agent will be used to retrieve the file. Default is no.	no	Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Retrieve File from Endpoint - Generic

Inputs

MD5 — Get file sample from MD5 input.
SHA256 — Get file sample from SHA256 input.
Hostname — Hostname of the machine on which the file is located.
Path — File path.
UseD2 — Determines whether a D2 agent will be used to retrieve the file. Default is no.

Flowchart

Source

playbook-Retrieve_File_from_Endpoint_-_Generic.yml playbook-Retrieve_File_from_Endpoint_-_Generic_V2.yml playbook-Retrieve_File_from_Endpoint_-_Generic_V2_README.md playbook-Retrieve_File_from_Endpoint_-_Generic_V3.yml playbook-Retrieve_File_from_Endpoint_-_Generic_V3_README.md

Download History Raw

id: Retrieve File from Endpoint - Generic
version: -1
name: Retrieve File from Endpoint - Generic
fromversion: 5.0.0
description: |-
  Deprecated. Use `Retrieve File from Endpoint - Generic V3` instead. 
  This playbook retrieves a file sample from an endpoint using the following playbooks:
  - Get File Sample From Path - Generic
  - Get File Sample By Hash - Generic v2
deprecated: true
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: aafd2bad-97ae-4462-85cb-8ef1cad54fc5
    type: start
    task:
      id: aafd2bad-97ae-4462-85cb-8ef1cad54fc5
      version: -1
      name: ""
      description: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
      - "4"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "2":
    id: "2"
    taskid: 91b91a1f-227c-433f-8fa0-80fd671e1a1d
    type: playbook
    task:
      id: 91b91a1f-227c-433f-8fa0-80fd671e1a1d
      version: -1
      name: Get File Sample From Path - Generic
      description: |-
        Returns a file sample to the war-room from a path on an endpoint using one or more integrations

        inputs:
        * UseD2 - if "True", use Demisto Dissolvable Agent (D2) to return the file (default: False)
      playbookName: Get File Sample From Path - Generic
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      Hostname:
        complex:
          root: inputs.Hostname
      Path:
        complex:
          root: inputs.Path
      UseD2:
        complex:
          root: inputs.UseD2
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "3":
    id: "3"
    taskid: 21df4e3f-565e-48ca-8937-7106ed312e6e
    type: title
    task:
      id: 21df4e3f-565e-48ca-8937-7106ed312e6e
      version: -1
      name: Done
      description: ""
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "4":
    id: "4"
    taskid: e6fa1361-9097-4532-8d10-e0c53b74aee7
    type: playbook
    task:
      id: e6fa1361-9097-4532-8d10-e0c53b74aee7
      version: -1
      name: Get File Sample By Hash - Generic v2
      description: |-
        This playbook returns a file sample correlating to a hash from the war-room using the following sub-playbooks:
        - Get File Sample By Hash - Carbon Black Enterprise Response
        - Get File Sample By Hash - Cylance Protect v2
      playbookName: Get File Sample By Hash - Generic v2
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      MD5:
        complex:
          root: inputs.MD5
      SHA256:
        complex:
          root: inputs.SHA256
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
    view: |-
      {
        "position": {
          "x": 480,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 385,
        "width": 810,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: MD5
  value:
    complex:
      root: File
      accessor: MD5
      transformers:
      - operator: uniq
  required: false
  description: Get file sample from MD5 input.
- key: SHA256
  value:
    complex:
      root: File
      accessor: SHA256
      transformers:
      - operator: uniq
  required: false
  description: Get file sample from SHA256 input.
- key: Hostname
  value:
    complex:
      root: Endpoint
      accessor: Hostname
      transformers:
      - operator: uniq
  required: false
  description: Hostname of the machine on which the file is located.
- key: Path
  value:
    complex:
      root: File
      accessor: Path
  required: false
  description: File path.
- key: UseD2
  value:
    simple: "no"
  required: false
  description: |-
    Determines whether a D2 agent will be used to retrieve the file.
    Default is no.
outputs: []
tests:
- No test