CBLiveGetFile_V2
This automation translates an endpoints hostname/IP to the Carbon Black sensor ID. It then opens a session to the endpoint to download the given file paths and closes the session.
python · Carbon Black Enterprise Response
Details
| ID | CBLiveGetFile_V2 |
|---|---|
| Language | python |
| From Version | 5.0.0 |
| Docker Image | demisto/python3:3.12.13.10116658 |
| Tags | carbon-black endpoint |
README
This automation translate endpoint (hostname/IP) to sensor id, Than it downloads given file paths by opening session and closing it.
Script Data
| Name | Description |
|---|---|
| Script Type | python3 |
| Tags | carbon-black, endpoint |
| Cortex XSOAR Version | 4.1.0 |
Inputs
| Argument Name | Description |
|---|---|
| endpoint | hostname of a Carbon Black sensor (Could be IP). |
| path | Comma seprated files path to download from the endpoint.. |
| timeout | Session timeout (ms). |
Outputs
| Path | Description | Type |
|---|---|---|
| CbLiveResponse.Commands.CbCommandID | Unique command identifier. | Number |
| CbLiveResponse.Commands.CommandName | The command name. | String |
| CbLiveResponse.Commands.Status | The command Status (‘pending’, ‘in progress’, ‘complete’, ‘error’, ‘canceled’). | String |
| CbLiveResponse.Commands.CommandCompletionTime | The command completion time (0 if not complete). | String |
| CbLiveResponse.Commands.OperandObject | The source path of the file. | String |
| CbLiveResponse.Commands.FileID | Unique file ID. | Number |
| CbLiveResponse.File.Size | File size. | String |
| CbLiveResponse.File.SHA1 | File SHA1. | String |
| CbLiveResponse.File.SHA256 | File SHA256. | String |
| CbLiveResponse.File.Name | File name. | String |
| CbLiveResponse.File.SSDeep | File SSDeep. | String |
| CbLiveResponse.File.EntryID | File EntryID. | Number |
| CbLiveResponse.File.Info | File info. | String |
| CbLiveResponse.File.Type | File type. | String |
| CbLiveResponse.File.MD5 | File MD5. | String |
| CbLiveResponse.File.Extension | File extension. | String |
Command Example
!CBLiveGetFile_v2 endpoint=EC2AMAZ-L4C2OKC path="c:\\Users\\All Users\\Desktop\\mooncake.jpg" timeout=2000
Context Example
{
"CbLiveResponse": {
"Commands": {
"CbCommandID": 2,
"CbSensorID": 17,
"CbSessionID": 356,
"CommandCompletionTime": 1540229207.655335,
"CommandName": "get file",
"CreateTime": 1540229207.608662,
"FileID": 1,
"OperandObject": "c:\\Users\\All Users\\Desktop\\mooncake.jpg",
"Result": {
"Code": 0,
"Desc": "",
"Type": "WinHresult"
},
"Status": "complete"
}
},
"File": {
"EntryID": "168@583490",
"Extension": "jpg",
"Info": "image/jpeg",
"MD5": "1fe52b291d16c7f9a6eaf43074024011",
"Name": "mooncake.jpg",
"SHA1": "30bd2461d6cee80227bcf557a6fd47922b96263c",
"SHA256": "a87b0fa1006b301b7ef2259cfa9aed2ff12c15217796b5dd08b36e006a137cd2",
"SSDeep": "192:pAzQbZ/ujghzcZHcsWw6o6E7ODeADcBwjZ4P:pAzG/ujgh6xCo60ODe3wj8",
"Size": 11293,
"Type": "data\n"
}
}
Human Readable Output
Files downloaded from endpoint EC2AMAZ-L4C2OKC
File ID File Path 1 “c:\Users\All Users\Desktop\mooncake.jpg”
args: - description: Hostname or IP of a Carbon Black sensor. name: endpoint required: true - description: Comma-separated list of file paths to download from the endpoint. isArray: true name: path required: true - auto: PREDEFINED defaultValue: '2000' description: Session timeout (ms). Default is 2000. name: timeout predefined: - Session timeout (If a command is not issued after this time the session will be closed) comment: |- This automation translates an endpoints hostname/IP to the Carbon Black sensor ID. It then opens a session to the endpoint to download the given file paths and closes the session. commonfields: id: CBLiveGetFile_V2 version: -1 name: CBLiveGetFile_V2 outputs: - contextPath: CbLiveResponse.Commands.CbCommandID description: Unique command identifier. type: Number - contextPath: CbLiveResponse.Commands.CommandName description: The command name. type: String - contextPath: CbLiveResponse.Commands.Status description: The command status ('pending', 'in progress', 'complete', 'error', or 'canceled'). type: String - contextPath: CbLiveResponse.Commands.CommandCompletionTime description: The command completion time (0 if not complete). type: String - contextPath: CbLiveResponse.Commands.OperandObject description: The source path of the file. type: String - contextPath: CbLiveResponse.Commands.FileID description: Unique file ID. type: Number - contextPath: CbLiveResponse.File.Size description: File size. type: String - contextPath: CbLiveResponse.File.SHA1 description: File SHA1 hash. type: String - contextPath: CbLiveResponse.File.SHA256 description: File SHA256 hash. type: String - contextPath: CbLiveResponse.File.Name description: File name. type: String - contextPath: CbLiveResponse.File.SSDeep description: File SSDeep hash. type: String - contextPath: CbLiveResponse.File.EntryID description: File EntryID. type: Number - contextPath: CbLiveResponse.File.Info description: File info. type: String - contextPath: CbLiveResponse.File.Type description: File type. type: String - contextPath: CbLiveResponse.File.MD5 description: File MD5. type: String - contextPath: CbLiveResponse.File.Extension description: File extension. type: String - contextPath: File.Size description: The size of the file in bytes. type: Number - contextPath: File.MD5 description: The MD5 hash of the file. type: String - contextPath: File.SHA1 description: The SHA1 hash of the file. type: String - contextPath: File.SHA256 description: The SHA256 hash of the file. type: String - contextPath: File.Name description: The name of the file. type: String - contextPath: File.SSDeep description: The SSDeep hash of the file (same as displayed in file entries). type: String - contextPath: File.EntryID description: File entry ID. type: String - contextPath: File.Info description: Information about the file. type: String - contextPath: File.Type description: The file type. type: String - contextPath: File.Extension description: The extension of the file. type: String script: '-' subtype: python3 tags: - carbon-black - endpoint timeout: '0' type: python dockerimage: demisto/python3:3.12.13.10116658 tests: - No Test dependson: must: - cb-session-create-and-wait - cb-session-close - cb-get-file-from-endpoint - cb-list-sensors - cb-list-sessions fromversion: 5.0.0