PcapFileExtractor
This automation extracts all possible files from a PCAP file.
python · PCAP Analysis
Details
| ID | PcapFileExtractor |
|---|---|
| Language | python |
| From Version | 5.0.0 |
| Docker Image | demisto/pcap-miner:1.0.0.10133006 |
| Tags | pcap file Utility |
README
This automation extracts all possible files from a PCAP file.
Script Data
| Name | Description |
|---|---|
| Script Type | python3 |
| Tags | pcap, file, Utility |
| Cortex XSOAR Version | 5.0.0 |
Inputs
| Argument Name | Description |
|---|---|
| entry_id | The EntryID of the PCAP file to extract the files from. |
Outputs
| Path | Description | Type |
|---|---|---|
| PcapExtractedFiles.FileName | File name. | String |
| PcapExtractedFiles.FileSize | File size. | Number |
| PcapExtractedFiles.FileMD5 | The MD5 hash of the file. | String |
| PcapExtractedFiles.FileSHA1 | The SHA1 hash of the file. | String |
| PcapExtractedFiles.FileSHA256 | The SHA256 hash of the file. | String |
| PcapExtractedFiles.FileExtension | The extension of the file. | String |
| File.Size | The size of the file in bytes. | Number |
| File.SHA1 | The SHA1 hash of the file. | String |
| File.SHA256 | The SHA256 hash of the file. | String |
| File.SHA512 | The SHA512 hash of the file. | String |
| File.Name | The full file name. | String |
| File.SSDeep | The ssdeep hash of the file. | String |
| File.EntryID | The ID for locating the file in the War Room. | String |
| File.Info | The file information. | String |
| File.Type | The file type. | String |
| File.MD5 | The MD5 hash of the file. | String |
| File.Extension | The file extension, for example: ‘txt’. | String |
args: - description: The EntryID of the PCAP file to extract the files from. name: entry_id required: true - description: The entry ID of the RSA private key. name: rsa_decrypt_key_entry_id - description: The WPA password. By providing the password you will be able to decrypt. Can be password or ssid:password. name: wpa_password - defaultValue: '5' description: Maximum number of files to extract. Default is 5. name: limit - description: 'A comma-separated list of file extensions to include/exclude for example, image/gif.' name: types - auto: PREDEFINED defaultValue: inclusive description: Is the type/extensions list inclusive or exclusive. Can be "inclusive" or "exclusive". Default is "inclusive". name: inclusive_or_exclusive predefined: - inclusive - exclusive - description: 'A comma-separated list of MIME file types to include/exclude, for example, image/png. Can not combine with the extensions argument.' name: types - description: 'A comma-separated list of file extensions to include/exclude, for example, image/png. Can not combine with the types argument.' name: extensions comment: This automation extracts all possible files from a PCAP file. commonfields: id: PcapFileExtractor version: -1 name: PcapFileExtractor outputs: - contextPath: PcapExtractedFiles.FileName description: File name. type: String - contextPath: PcapExtractedFiles.FileSize description: File size. type: Number - contextPath: PcapExtractedFiles.FileMD5 description: The MD5 hash of the file. type: String - contextPath: PcapExtractedFiles.FileSHA1 description: The SHA1 hash of the file. type: String - contextPath: PcapExtractedFiles.FileSHA256 description: The SHA256 hash of the file. type: String - contextPath: PcapExtractedFiles.FileExtension description: The extension of the file. type: String - contextPath: File.Size description: The size of the file in bytes. type: Number - contextPath: File.SHA1 description: The SHA1 hash of the file. type: String - contextPath: File.SHA256 description: The SHA256 hash of the file. type: String - contextPath: File.SHA512 description: The SHA512 hash of the file. type: String - contextPath: File.Name description: The full file name. type: String - contextPath: File.SSDeep description: The ssdeep hash of the file. type: String - contextPath: File.EntryID description: The ID for locating the file in the War Room. type: String - contextPath: File.Info description: The file information. type: String - contextPath: File.Type description: The file type. type: String - contextPath: File.MD5 description: The MD5 hash of the file. type: String - contextPath: File.Extension description: 'The file extension, for example: ''txt''.' type: String script: '-' subtype: python3 tags: - pcap - file - Utility timeout: '0' type: python dockerimage: demisto/pcap-miner:1.0.0.10133006 tests: - No tests (auto formatted) fromversion: 5.0.0