Retrieve File from Endpoint - Generic Deprecated

Deprecated. Use `Retrieve File from Endpoint - Generic V3` instead. This playbook retrieves a file sample from an endpoint using the following playbooks: - Get File Sample From Path - Generic - Get File Sample By Hash - Generic v2

Common Playbooks · 4 tasks · 5 inputs · 0 outputs

Details

ID	`Retrieve File from Endpoint - Generic`
From Version	5.0.0
Tasks	4

README

Deprecated. Use Retrieve File from Endpoint - Generic V3 instead.
This playbook retrieves a file sample from an endpoint using the following playbooks:

Get File Sample From Path - Generic
Get File Sample By Hash - Generic v2

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

Get File Sample From Path - Generic
Get File Sample By Hash - Generic v2

Integrations

This playbook does not use any integrations.

Scripts

This playbook does not use any scripts.

Commands

This playbook does not use any commands.

Playbook Inputs

Name	Description	Default Value	Required
MD5	Get file sample from MD5 input.	File.MD5	Optional
SHA256	Get file sample from SHA256 input.	File.SHA256	Optional
Hostname	Hostname of the machine on which the file is located.	Endpoint.Hostname	Optional
Path	File path.	File.Path	Optional
UseD2	Determines whether a D2 agent will be used to retrieve the file. Default is no.	no	Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Retrieve File from Endpoint - Generic

Inputs

MD5 — Get file sample from MD5 input.
SHA256 — Get file sample from SHA256 input.
Hostname — Hostname of the machine on which the file is located.
Path — File path.
UseD2 — Determines whether a D2 agent will be used to retrieve the file. Default is no.

Flowchart

Source

playbook-Retrieve_File_from_Endpoint_-_Generic.yml playbook-Retrieve_File_from_Endpoint_-_Generic_V2.yml playbook-Retrieve_File_from_Endpoint_-_Generic_V2_README.md playbook-Retrieve_File_from_Endpoint_-_Generic_V3.yml playbook-Retrieve_File_from_Endpoint_-_Generic_V3_README.md

Download History Raw

'This playbook retrieves a file sample from an endpoint using the following playbooks:'
- Get File Sample From Path - Generic v2.
- Get File Sample By Hash - Generic v3.

## Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

### Sub-playbooks

* Get File Sample By Hash - Generic v3
* Get File Sample From Path - Generic V3

### Integrations

This playbook does not use any integrations.

### Scripts

This playbook does not use any scripts.

### Commands

This playbook does not use any commands.

## Playbook Inputs

---

| **Name** | **Description** | **Default Value** | **Required** |
| --- | --- | --- | --- |
| MD5 | The MD5 hash value for the file to retrieve. |  | Optional |
| SHA256 | The SHA256 hash value for the file to retrieve. |  | Optional |
| Host | Hostname of the machine on which the file is located for PS remote it can also be an IP address. |  | Optional |
| Path | The path of the file to retrieve.<br/>For example:<br/>C:\\users\\folder\\file.txt |  | Optional |
| Agent_ID | The ID of the agent in the relevant integration \(such as EDR\). |  | Optional |

## Playbook Outputs

---

| **Path** | **Description** | **Type** |
| --- | --- | --- |
| File.Size | The size of the file. | number |
| File.Type | The type of the file. | string |
| File.Info | General information of the file. | string |
| File.MD5 | The MD5 hash of the file. | string |
| File.SHA1 | The SHA1 hash of the file. | string |
| File.SHA256 | The SHA256 hash of the file. | string |
| File.SHA512 | The SHA512 hash of the file. | string |
| File.EntryID | File entry ID. | string |
| File.Extension | The file extension. | string |
| File.Name | The file name. | string |
| File.SSDeep | The file SSDeep. | string |

## Playbook Image

---

![Retrieve File from Endpoint - Generic V3](../doc_files/Retrieve_File_from_Endpoint_-_Generic_V3.png)