FileCreateAndUploadV2

Details

ID	`FileCreateAndUploadV2`
Language	python
From Version	6.0.0
Docker Image	`demisto/python3:3.12.13.10404775`
Tags	Utility

README

Creates a file (using the given data input or entry ID) and uploads it to the current investigation War Room.

Script Data

Name	Description
Script Type	python3
Tags	Utility
Cortex XSOAR Version	6.0.0

Inputs

Argument Name	Description
filename	The name of the file to be created.
data	Input data to write to the file.
entryId	Entry ID contents to write in the file.
data_encoding	Encoding type of the input data or contents.

Outputs

Path	Description	Type
File.Size	The size of the file.	Number
File.SHA1	The SHA1 hash of the file.	String
File.SHA256	The SHA256 hash of the file.	String
File.SHA512	The SHA512 hash of the file.	String
File.Name	The name of the file.	String
File.SSDeep	The SSDeep hash of the file.	String
File.EntryID	The entry ID of the file.	String
File.Info	File information.	String
File.Type	The file type.	String
File.MD5	The MD5 hash of the file.	String
File.Extension	The file extension.	String

Script Examples

Example command

!FileCreateAndUploadV2 filename=test.txt data=test

Context Example

{
    "File": {
        "EntryID": "919@35961d68-3216-49b9-870a-2f09e5dac489",
        "Extension": "txt",
        "Info": "text/plain; charset=utf-8",
        "MD5": "098f6bcd4621d373cade4e832627b4f6",
        "Name": "test.txt",
        "SHA1": "a94a8fe5ccb19ba61c4c0873d391e987982fbbd3",
        "SHA256": "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08",
        "SHA512": "ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff",
        "SSDeep": "3:Hn:Hn",
        "Size": 4,
        "Type": "ASCII text, with no line terminators"
    }
}

Limitation

Using the entryID argument to copy the contents of an existing file from different incidents is only available from XSOAR version 6.12.0 onwards.

Source

FileCreateAndUploadV2.py FileCreateAndUploadV2_test.py FileCreateAndUploadV2.yml

Download History Raw

import base64
from pathlib import Path
from typing import Any

import demistomock as demisto
from CommonServerPython import *


def get_data_from_file(entry_id: str) -> bytes:
    """Reads the file associated with the entry_id and returns its data as bytes."""
    try:
        return Path(demisto.getFilePath(entry_id)["path"]).read_bytes()
    except Exception as e:
        raise DemistoException(f"There was a problem opening or reading the file.\nError is: {e}")


def get_entry_metadata(entry_id: str) -> dict:  # pragma: no cover
    res = demisto.executeCommand("getEntry", {"id": entry_id})
    if is_error(res):
        raise DemistoException(get_error(res))
    return res[0]


def get_data_entry(entry_metadata: dict) -> Any:
    """Retrieves the data associated with an entry based on its type."""
    entry_type: int = entry_metadata["Type"]
    match entry_type:
        case EntryType.FILE | EntryType.IMAGE | EntryType.ENTRY_INFO_FILE | EntryType.VIDEO_FILE:
            return get_data_from_file(entry_metadata["ID"])
        case _:
            return entry_metadata["Contents"]


def decode_data(data: Any, data_encoding: str) -> bytes | Any:
    """Given data and its encoding, this function decodes the data according to the provided encoding and returns it."""
    match data_encoding:
        case "base64":
            return base64.b64decode(data)
        case "raw":
            return data
        case _:
            raise ValueError(f"Invalid data encoding value: {data_encoding}, must be either `base64` or `raw`")


def main() -> None:
    args = demisto.args()
    filename = args["filename"]
    data = args.get("data")
    data_encoding = args.get("data_encoding", "raw")
    entry_id = args.get("entryId")

    try:
        if entry_id:
            entry_metadata = get_entry_metadata(entry_id)
            data = get_data_entry(entry_metadata)
        data = decode_data(data, data_encoding)

        return_results(fileResult(filename, data))
    except Exception as e:
        return_error(str(e) + "\n\nTrace:\n" + traceback.format_exc())


if __name__ in ("__builtin__", "builtins", "__main__"):
    main()