Details
| ID | PcapFileExtractStreams |
|---|---|
| Language | python |
| From Version | 6.2.0 |
| Docker Image | demisto/pcap-miner:1.0.0.10133006 |
| Tags | pcap file Utility |
README
Extract payloads of each stream from a pcap file.
Script Data
| Name | Description |
|---|---|
| Script Type | python3 |
| Tags | pcap, file, Utility |
Inputs
| Argument Name | Description |
|---|---|
| entry_id | The entry_id of the pcap file from which to extract streams. |
| bin2txt_mode | The mode of how to convert the binary to text. |
| pcap_filter | Filter to apply on pcap. Wireshark syntax as can be found here: https://www.wireshark.org/docs/man-pages/wireshark-filter.html |
| rsa_decrypt_key_entry_id | The entry ID for the RSA decryption key. |
| wpa_password | The WPA password. By providing the password you will be able to decrypt encrypted traffic data. |
| filter_keys | Keys of output items by which to filter them. |
| verbose | Set to true to generate stream entries, otherwise false. |
| server_ports | Default server port numbers by which to decide the direction. |
Outputs
| Path | Description | Type |
|---|---|---|
| PCAPStream.entry_id | The entry ID of the pcap file parsed. | string |
| PCAPStream.protocol | Protocol. | string |
| PCAPStream.client_ip | Client IP address. | string |
| PCAPStream.client_port | Client port number. | number |
| PCAPStream.server_ip | Server IP address. | string |
| PCAPStream.server_poprt | Server port nream data in bytes. | number |
| PCAPStream.stream_text | The data stream in text. | string |
| PCAPStream.stream_base64 | The data stream in base64. | string |
| PCAPStream.outgoing_size | Size of the outgoing data in bytes. | number |
| PCAPStream.outgoing_text | The outgoing data stream in text. | string |
| PCAPStream.outgoing_base64 | The outgoing data stream in base64. | string |
| PCAPStream.incoming_size | Size of the incoming data in bytes. | number |
| PCAPStream.incoming_text | The incoming data stream in text. | string |
| PCAPStream.incoming_base64 | The incoming data stream in base64. | string |
import json import demistomock as demisto def equals_object(obj1, obj2) -> bool: if type(obj1) is not type(obj2): return False elif isinstance(obj1, dict): for k1, v1 in obj1.items(): if k1 not in obj2: return False if not equals_object(v1, obj2[k1]): return False return not (set(obj1.keys()) ^ set(obj2.keys())) elif isinstance(obj1, list): # Compare lists (ignore order) list2 = list(obj2) for _i1, v1 in enumerate(obj1): for i2, v2 in enumerate(list2): if equals_object(v1, v2): list2.pop(i2) break else: return False return not list2 else: return obj1 == obj2 def side_effect_demisto_getFilePath(entry_id): return {"path": entry_id} def test_main(mocker): """ Given: - PCAP files are given with control parameters When: - Running PcapFileExtractStreams Then: - Validate results output that returned to CortexSOAR """ from PcapFileExtractStreams import main mocker.patch.object(demisto, "getFilePath", side_effect=side_effect_demisto_getFilePath) with open("./test_data/test-1.json") as f: test_list = json.load(f) for t in test_list: mocker.patch.object( demisto, "args", return_value={ "entry_id": t["entry_id"], "bin2txt_mode": t.get("bin2txt_mode"), "pcap_filter": t.get("pcap_filter"), "rsa_decrypt_key": t.get("rsa_decrypt_key"), "wpa_password": t.get("wpa_password"), "filter_keys": t.get("filter_keys"), "verbose": t.get("verbose"), "server_ports": t.get("server_ports"), }, ) mocker.patch.object(demisto, "results") main() assert demisto.results.call_count == 1 results = demisto.results.call_args[0][0] contents = results["Contents"] assert equals_object(contents, t["contents"])