PcapHTTPExtractor
Allows to parse and extract http flows (requests & responses) from a pcap/pcapng file.
python · Common Scripts
Details
| ID | PcapHTTPExtractor |
|---|---|
| Language | python |
| From Version | 5.0.0 |
| Docker Image | demisto/pcap-http-extractor:1.0.0.11195141 |
| Tags | pcap http |
README
Allows to parse and extract http flows (requests & responses) from a pcap/pcapng file.
Script Data
| Name | Description |
|---|---|
| Script Type | python3 |
| Tags | pcap, http |
| Cortex XSOAR Version | 5.0.0 |
Inputs
| Argument Name | Description |
|---|---|
| pcapFileName | get file entry from file name |
| entryID | File entry from the WarRoom |
| limit | Limit the output of the capture file output’s flows (starts from 0). |
| start | Index of where to output flows (starts from 0). |
| limitData | Limit the HttpFileData field (in bytes) |
| allowedContentTypes | The allowed content types to display, separated with comma, uses startswith to find a match (ie text,image will display text\html, and image\png). |
Outputs
| Path | Description | Type |
|---|---|---|
| PcapHTTPFlows | Flows extracted from the pcap file. | String |
| PcapHttpFlows.ResultIndex | The index of the http packet in the pcap file. | String |
| PcapHttpFlows.HttpContentType | Http content type of the response. | String |
| PcapHttpFlows.HttpResponseVersion | Http version used in the response. | String |
| PcapHttpFlows.HttpResponseCode | Http response code from the server | String |
| PcapHttpFlows.HttpDate | Http date returned from the sever | String |
| PcapHttpFlows.HttpRequestMethod | Http request method used. | String |
| PcapHttpFlows.HttpRequestUri | Http request URI (path) | String |
| PcapHttpFlows.HttpFileData | Http content of the response | String |
| PcapHttpFlows.HttpServer | The server signature in the response | String |
| PcapHttpFlows.HttpUserAgent | Http user agent sent in the request | String |
| PcapHttpFlows.HttpAccept | Http request accept type | String |
| PcapHttpFlows.MetaSniffTimeStamp | Time the packet was sniffed (unixtime). | String |
args: - description: get file entry from file name. name: pcapFileName - default: true description: File entry from the WarRoom. name: entryID - defaultValue: '50' description: Limit the output of the capture file output's flows (starts from 0). name: limit - defaultValue: '0' description: Index of where to output flows (starts from 0). name: start - defaultValue: '512' description: "Limit the HttpFileData field (in bytes)." name: limitData - description: The allowed content types to display, separated with comma, uses startswith to find a match (ie text,image will display text\html, and image\png). name: allowedContentTypes comment: Allows to parse and extract http flows (requests & responses) from a pcap/pcapng file. commonfields: id: PcapHTTPExtractor version: -1 enabled: true name: PcapHTTPExtractor outputs: - contextPath: PcapHTTPFlows description: Flows extracted from the pcap file. type: String - contextPath: PcapHttpFlows.ResultIndex description: The index of the http packet in the pcap file. type: String - contextPath: PcapHttpFlows.HttpContentType description: Http content type of the response. type: String - contextPath: PcapHttpFlows.HttpResponseVersion description: Http version used in the response. type: String - contextPath: PcapHttpFlows.HttpResponseCode description: Http response code from the server. type: String - contextPath: PcapHttpFlows.HttpDate description: Http date returned from the sever. type: String - contextPath: PcapHttpFlows.HttpRequestMethod description: Http request method used. type: String - contextPath: PcapHttpFlows.HttpRequestUri description: Http request URI (path). type: String - contextPath: PcapHttpFlows.HttpFileData description: Http content of the response. type: String - contextPath: PcapHttpFlows.HttpServer description: The server signature in the response. type: String - contextPath: PcapHttpFlows.HttpUserAgent description: Http user agent sent in the request. type: String - contextPath: PcapHttpFlows.HttpAccept description: Http request accept type. type: String - contextPath: PcapHttpFlows.MetaSniffTimeStamp description: Time the packet was sniffed (unixtime). type: String script: '' tags: - pcap - http timeout: '0' type: python dockerimage: demisto/pcap-http-extractor:1.0.0.11195141 tests: - PcapHTTPExtractor-Test subtype: python3 fromversion: 5.0.0