Get File Sample From Path - Carbon Black Enterprise Response

Returns a file sample to the war-room from a path on an endpoint using Carbon Black Enterprise Response

Carbon Black Enterprise Response · 5 tasks · 2 inputs · 26 outputs

Inputs

  • Hostname — The host to get file from
  • Path — Path of the file on the endpoint

Outputs

  • CbLiveResponse.Commands.CbCommandID — Unique command identifier.
  • CbLiveResponse.Commands.CommandName — The command name.
  • CbLiveResponse.Commands.Status — The command status ('pending', 'in progress', 'complete', 'error', or 'canceled').
  • CbLiveResponse.Commands.CommandCompletionTime — The command completion time (0 if not complete).
  • CbLiveResponse.Commands.OperandObject — The source path of the file.
  • CbLiveResponse.Commands.FileID — Unique file ID.
  • CbLiveResponse.File.Size — File size.
  • CbLiveResponse.File.SHA1 — File SHA1 hash.
  • CbLiveResponse.File.SHA256 — File SHA256 hash.
  • CbLiveResponse.File.Name — File name.
  • CbLiveResponse.File.SSDeep — File SSDeep hash.
  • CbLiveResponse.File.EntryID — File EntryID.
  • CbLiveResponse.File.Info — File info.
  • CbLiveResponse.File.Type — File type.
  • CbLiveResponse.File.MD5 — File MD5.
  • CbLiveResponse.File.Extension — File extension.
  • File.Size — The size of the file in bytes.
  • File.MD5 — The MD5 hash of the file.
  • File.SHA1 — The SHA1 hash of the file.
  • File.SHA256 — The SHA256 hash of the file.
  • File.Name — The name of the file.
  • File.SSDeep — The SSDeep hash of the file (same as displayed in file entries).
  • File.EntryID — File entry ID.
  • File.Info — Information about the file.
  • File.Type — The file type.
  • File.Extension — The extension of the file.

Flowchart

yes yes Start Start Is Carbon Black Enterprise Response enabled? - Exists Is Carbon Black Enterpris... Exists Done Done Get File - CBLiveGetFile_V2 Get File CBLiveGetFile_V2 Is there a file path and hostname? Is there a file path and ...