Tanium Threat Response - Request File Download

Request file download from Tanium Threat Response.
Tanium Threat Response · 10 tasks · 7 inputs · 1 output
Details

ID	`Tanium Threat Response - Request File Download`
From Version	5.0.0
Tasks	10
Inputs

connection-name — Connection name.
destination-type — Type of destination: ip_address or computer_name.
path — Path of file.
download-file — If true, the file will be downloaded, otherwise, only a file download object will be created.
delete-connection — If true, the connection will be deleted in the end of the playbook, otherwise, it will remain open.
remote — True if remote connection.
connection-timeout — Connection timeout, in milliseconds.
Outputs

File.ID — File download entry ID.
Commands used

tanium-tr-delete-connection tanium-tr-get-download-file-request-status tanium-tr-get-downloaded-file tanium-tr-request-file-download
Flowchart

Source

playbook-Tanium_Threat_Response_-_Request_File_Download.yml
Download History Raw
elasticcommonfields: {}
id: Tanium Threat Response - Request File Download
version: -1
fromversion: "5.0.0"
name: Tanium Threat Response - Request File Download
description: Request file download from Tanium Threat Response.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: d8c82418-fe27-4e68-880d-a871016a49af
    type: start
    task:
      elasticcommonfields: {}
      id: d8c82418-fe27-4e68-880d-a871016a49af
      version: -1
      description: ""
      name: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "13"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "1":
    id: "1"
    taskid: f4ec667e-ea1b-4dc2-852b-71f8430e65c4
    type: regular
    task:
      elasticcommonfields: {}
      id: f4ec667e-ea1b-4dc2-852b-71f8430e65c4
      version: -1
      name: tanium-tr-request-file-download
      description: Request a new file download
      script: Tanium Threat Response|||tanium-tr-request-file-download
      type: regular
      iscommand: true
      brand: Tanium Threat Response
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      connection-id:
        simple: ${inputs.connection-id}
      connection-name:
        simple: ${inputs.connection-name}
      path:
        simple: ${inputs.path}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "2":
    id: "2"
    taskid: b7d8cc10-03f7-4409-89ee-9a238281bbdc
    type: playbook
    task:
      elasticcommonfields: {}
      id: b7d8cc10-03f7-4409-89ee-9a238281bbdc
      version: -1
      name: GenericPolling
      description: |-
        Use this playbook as a sub-playbook to block execution of the master playbook until a remote action is complete.
        This playbook implements polling by continuously running the command in Step \#2 until the operation completes.
        The remote action should have the following structure:

        1. Initiate the operation.
        2. Poll to check if the operation completed.
        3. (optional) Get the results of the operation.
      playbookName: GenericPolling
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "12"
    scriptarguments:
      AdditionalPollingCommandArgNames:
        simple: connection-name,path
      AdditionalPollingCommandArgValues:
        simple: ${inputs.connection-name},${inputs.path}
      Ids:
        simple: ${Tanium.FileDownload.Downloaded}
      Interval:
        simple: "1"
      PollingCommandArgName:
        simple: request-date
      PollingCommandName:
        simple: tanium-tr-get-download-file-request-status
      Timeout:
        simple: "10"
      dt:
        simple: Tanium.FileDownload(val.Status != 'Completed').ID
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "3":
    id: "3"
    taskid: 544e1dad-1998-4feb-84e9-d6d564ffb89e
    type: title
    task:
      elasticcommonfields: {}
      id: 544e1dad-1998-4feb-84e9-d6d564ffb89e
      version: -1
      name: Done
      description: ""
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 1595
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "5":
    id: "5"
    taskid: e16c8bc0-4d21-47bd-8687-7ed108effcbb
    type: regular
    task:
      elasticcommonfields: {}
      id: e16c8bc0-4d21-47bd-8687-7ed108effcbb
      version: -1
      name: tanium-tr-delete-connection
      description: Delete a connection by connection name.
      script: Tanium Threat Response|||tanium-tr-delete-connection
      type: regular
      iscommand: true
      brand: Tanium Threat Response
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      connection-name:
        simple: ${inputs.connection-name}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "8":
    id: "8"
    taskid: 85c86dac-494b-45e0-8f8b-57c96feaac15
    type: condition
    task:
      elasticcommonfields: {}
      id: 85c86dac-494b-45e0-8f8b-57c96feaac15
      version: -1
      name: Delete connection?
      description: ""
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "5"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: inputs.delete-connection
            iscontext: true
          right:
            value:
              simple: "true"
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 1245
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "9":
    id: "9"
    taskid: 068c142a-e9c8-4b53-8bb5-db190ddcf269
    type: regular
    task:
      elasticcommonfields: {}
      id: 068c142a-e9c8-4b53-8bb5-db190ddcf269
      version: -1
      name: Get downloaded file
      description: Get the actual content of a downloaded file by file ID.
      script: Tanium Threat Response|||tanium-tr-get-downloaded-file
      type: regular
      iscommand: true
      brand: Tanium Threat Response
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      file-id:
        complex:
          root: Tanium
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: Tanium.FileDownload.Path
                iscontext: true
              right:
                value:
                  simple: inputs.path
                iscontext: true
          - - operator: isEqualString
              left:
                value:
                  simple: Tanium.FileDownload.ConnectionName
                iscontext: true
              right:
                value:
                  simple: inputs.connection-name
                iscontext: true
          accessor: FileDownload.ID
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "10":
    id: "10"
    taskid: 64bba2d4-252f-4a4a-8ed2-287d40c94def
    type: condition
    task:
      elasticcommonfields: {}
      id: 64bba2d4-252f-4a4a-8ed2-287d40c94def
      version: -1
      name: Should the file be downloaded?
      description: ""
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "8"
      "yes":
      - "9"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: inputs.download-file
            iscontext: true
          right:
            value:
              simple: "true"
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 895
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "12":
    id: "12"
    taskid: a54d98f3-e4c0-4031-82d0-12408af79302
    type: regular
    task:
      elasticcommonfields: {}
      id: a54d98f3-e4c0-4031-82d0-12408af79302
      version: -1
      name: tanium-tr-get-download-file-request-status
      description: Get the status of the download file request.
      script: Tanium Threat Response|||tanium-tr-get-download-file-request-status
      type: regular
      iscommand: true
      brand: Tanium Threat Response
    nexttasks:
      '#none#':
      - "10"
    scriptarguments:
      host:
        simple: ${Tanium.FileDownload.Host}
      path:
        simple: ${Tanium.FileDownload.Path}
      request-date:
        simple: ${Tanium.FileDownload.Downloaded}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "13":
    id: "13"
    taskid: 6b52dd00-5f7e-468b-8b8a-ba9161b7378e
    type: playbook
    task:
      elasticcommonfields: {}
      id: 6b52dd00-5f7e-468b-8b8a-ba9161b7378e
      version: -1
      description: ""
      name: Tanium Threat Response - Create Connection
      playbookName: Tanium Threat Response - Create Connection
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "1"
    scriptarguments:
      connection-name:
        simple: ${inputs.connection-name}
      connection-timeout:
        simple: ${inputs.connection-timeout}
      destination-type:
        simple: ${inputs.destination-type}
      remote:
        simple: ${inputs.remote}
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1610,
        "width": 492.5,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: connection-name
  value: {}
  required: true
  description: Connection name.
  playbookInputQuery:
- key: destination-type
  value: {}
  required: true
  description: 'Type of destination: ip_address or computer_name.'
  playbookInputQuery:
- key: path
  value: {}
  required: true
  description: Path of file.
  playbookInputQuery:
- key: download-file
  value:
    simple: "true"
  required: false
  description: If true, the file will be downloaded, otherwise, only a file download object will be created.
  playbookInputQuery:
- key: delete-connection
  value:
    simple: "true"
  required: false
  description: If true, the connection will be deleted in the end of the playbook, otherwise, it will remain open.
  playbookInputQuery:
- key: remote
  value: {}
  required: true
  description: True if remote connection.
  playbookInputQuery:
- key: connection-timeout
  value: {}
  required: false
  description: Connection timeout, in milliseconds.
  playbookInputQuery:
outputs:
- contextPath: File.ID
  description: File download entry ID.
  type: string
tests:
- No test