PcapMinerV2
PcapMIner V2 allows to parse PCAP files by displaying the all of the relevant data within including ip addresses, ports, flows, specific protocol breakdown, searching by regex, decrypting encrypted traffic and more. This automation takes about a minute to process 20,000 packets (which is approximately 10MB). If you want to mine large files you can either: a) Use the `pcap_filter` parameter to filter your PCAP file and thus make is smaller. b) Copy the automation and change the `default timeout` parameter to match your needs.
python · PCAP Analysis
Details
| ID | PcapMinerV2 |
|---|---|
| Language | python |
| From Version | 5.0.0 |
| Docker Image | demisto/pcap-miner:1.0.0.10133006 |
| Tags | pcap mine file Utility |
README
PcapMIner V2 allows to parse PCAP files by displaying the all of the relevant data within including ip addresses, ports, flows, specific protocol breakdown, searching by regex, decrypting encrypted traffic and more.
This automation takes about a minute to process 20,000 packets (which is approximately 10MB). If you want to mine large files you can either:
a) Use the pcap_filter parameter to filter your PCAP file and thus make is smaller.
b) Copy the automation and change the default timeout parameter to match your needs.
Script Data
| Name | Description |
|---|---|
| Script Type | python3 |
| Tags | pcap, mine, file, Utility |
| Cortex XSOAR Version | 5.0.0 |
Inputs
| Argument Name | Description |
|---|---|
| entry_id | The entry_id of the PCAP file to mine. |
| protocol_output | A comma-separated list of protocols to output as context. If empty, will not output any protocols to context. |
| extract_strings | Whether to extract IP, URL, and Email from PCAP file. Can be “True” or “False”. |
| pcap_filter | Filter to apply on PCAP. Wireshark syntax as can be found here: https://www.wireshark.org/docs/man-pages/wireshark-filter.html |
| custom_regex | Your own regular expression to extract from the PCAP. |
| filtered_file_name | The name of the PCAP file to save to the War Room after applying the `pcap_filter` (i.e. `filtered_file.pcap`). |
| rsa_decrypt_key_entry_id | The entry ID for the RSA decryption key. |
| convs_to_display | Number of conversations to display. The default is 15. |
| wpa_password | The WPA password. By providing the password you will be able to decrypt encrypted traffic data. |
| extract_ips | Output to context the source and destination IPs in the PCAP file. Can be “True” or “False”. The default is “False”. |
Outputs
| Path | Description | Type |
|---|---|---|
| PCAPResults.Bytes | The number of bytes transmitted in the PCAP file. | Number |
| PCAPResults.Packets | The number of packets transmitted in the PCAP file. | Number |
| PCAPResults.EntryID | The entryID of the PCAP file. | String |
| PCAPResults.StreamCount | The number of streams in the PCAP file. | String |
| PCAPResults.StartTime | The date and time of the first packet in the PCAP file. | Date |
| PCAPResults.EndTime | The date and time of the last packet in the PCAP file. | String |
| PCAPResults.UniqueSourceIP | The number of unique IPs from which packets were transmitted. | Number |
| PCAPResults.UniqueDestIP | The number of unique IPs from to packets were transmitted. | Number |
| PCAPResultsFlow.Bytes | The number of bytes transmitted in the flow. | String |
| PCAPResultsFlow.DestIP | The destination IP of the flow. | String |
| PCAPResultsFlow.SourceIP | The source IP of the flow. | String |
| PCAPResultsFlow.Transport | The transport protocol of the flow. | String |
| PCAPResultsFlow.SourcePort | The source port of the flow. | String |
| PCAPResultsFlow.DestPort | The destination port of the flow. | String |
| PCAPResultsFlow.Duration | The duration of the flow (in seconds). | String |
| PCAPResultsFlow.EndTime | The date/time the flow ended. | Date |
| PCAPResultsFlow.StartTime | The date/time the flow started. | Date |
| PCAPResults.URL | The URLs extracted from the file. | String |
| PCAPResults.IP | The IPs extracted from the file. | String |
| PCAPResults.Email | The emails extracted from the file. | String |
| PCAPResults.Regex | The regular expressions specified in `extract_regex` extracted from the file. | String |
| PCAPResultsHTTP.ResponseStatusCode | The response code. | String |
| PCAPResultsHTTP.RequestVersion | The request version. | String |
| PCAPResultsHTTP.RequestCacheControl | The cache control of the request. | String |
| PCAPResultsHTTP.ResponseDate | The date/time of the response. | Date |
| PCAPResultsHTTP.RequestMethod | The request method. | String |
| PCAPResultsHTTP.RequestSourceIP | The source IP of the request. | String |
| PCAPResultsHTTP.ResponseContentType | The response content type. | String |
| PCAPResultsHTTP.RequestAgent | The request agent. | String |
| PCAPResultsHTTP.RequestHost | The request host. | String |
| PCAPResultsHTTP.ResponseVersion | The response version. | String |
| PCAPResultsHTTP.ID | The ID of the HTTP interaction. | String |
| PCAPResultsHTTP.EntryID | The PCAP entry ID. | String |
| PCAPResultsHTTP.RequestURI | The request URI. | String |
| PCAPResultsHTTP.ResponseContentLength | The length of the response content. | String |
| PCAPResultsHTTP.ResponseCodeDesc | The code description of the response. | String |
| PCAPResultsDNS.ID | The ID of the DNS request. | String |
| PCAPResultsDNS.Request | The DNS request. | String |
| PCAPResultsDNS.Response | The DNS response. | String |
| PCAPResultsDNS.Type | The type of the DNS request. | String |
| PCAPResultsDNS.ID | The DNS packet ID. | String |
| PCAPResultsDNS.EntryID | The PCAP entry ID. | String |
| PCAPResults.Protocols | List of protocols found in the PCAP. | String |
| PCAPResultsSMTP.From | The mail sender. | String |
| PCAPResultsSMTP.To | The mail recipients. | String |
| PCAPResultsSMTP.Subject | The mail subject. | String |
| PCAPResultsSMTP.MimeVersion | The mime version. | String |
| PCAPResultsSMTP.ID | The SMTP packet’s ID. | String |
| PCAPResultsSMTP.EntryID | The PCAP entry ID. | String |
| PCAPResultsKERBEROS.EntryID | The PCAP entry ID. | String |
| PCAPResultsKERBEROS.Realm | The KERBEROS realm. | String |
| PCAPResultsKERBEROS.SName | The KERBEROS SName. | String |
| PCAPResultsKERBEROS.CName | The KERBEROS CName. | String |
| PCAPResultsTelnet.Data | The telnet data. | String |
| PCAPResultsTelnet.Commands | The telnet commands. | String |
| PCAPResultsTelnet.EntryID | The PCAP entry ID. | String |
| PCAPResultsLLMNR.EntryID | The PCAP entry ID. | String |
| PCAPResultsLLMNR.QueryClass | The LLMNR query class. | String |
| PCAPResultsLLMNR.QueryName | The LLMNR query name. | String |
| PCAPResultsLLMNR.Questions | The LLMNR questions. | String |
| PCAPResultsLLMNR.ID | The LLMNR packet ID. | String |
| PCAPResultsLLMNR.QueryType | The LLMNR query type. | String |
| PCAPResultsSYSLOG.EntryID | The PCAP entry ID. | String |
| PCAPResultsSYSLOG.ID | The SYSLOGS packet ID. | String |
| PCAPResultsSYSLOG.Message | The SYSLOGS message. | String |
| PCAPResultsSYSLOG.Hostname | The SYSLOGS host name. | String |
| PCAPResultsSYSLOG.Timestamp | The SYSLOGS time stamp. | String |
| PCAPResultsSMB2.EntryID | The PCAP entry ID. | String |
| PCAPResultsSMB2.ID | The SMB2 packet ID. | String |
| PCAPResultsSMB2.UserName | The SMB2 user name. | String |
| PCAPResultsSMB2.Domain | The SMB2 domain. | String |
| PCAPResultsSMB2.HostName | The SMB2 host name. | String |
| PCAPResultsSMB2.Command | The SMB2 command. | String |
| PCAPResultsSMB2.FileName | The SMB2 file name. | String |
| PCAPResultsSMB2.Tree | The SMB2 tree. | String |
| PCAPResultsNETBIOS.EntryID | The PCAP entry ID. | String |
| PCAPResultsNETBIOS.ID | The NETIOS packet ID. | String |
| PCAPResultsNETBIOS.Name | The NETIOS name. | String |
| PCAPResultsNETBIOS.Type | The NETIOS type. | String |
| PCAPResultsNETBIOS.Class | The NETIOS class. | String |
| PCAPResultsIRC.EntryID | The PCAP entry ID. | String |
| PCAPResultsIRC.ID | The IRC packet ID. | String |
| PCAPResultsIRC.RequestCommand | The IRC request command. | String |
| PCAPResultsIRC.RequestTrailer | The IRC request trailer. | String |
| PCAPResultsIRC.RequestPrefix | The IRC request prefix. | String |
| PCAPResultsIRC.RequestParameters | The IRC request parameters. | String |
| PCAPResultsIRC.ResponseCommand | The IRC response command. | String |
| PCAPResultsIRC.ResponseTrailer | The IRC response trailers. | String |
| PCAPResultsIRC.ResponsePrefix | The IRC response prefix. | String |
| PCAPResultsIRC.ResponseParameters | The IRC response parameters. | String |
| PCAPResultsFTP.EntryID | The PCAP entry ID. | String |
| PCAPResultsFTP.ID | The FTP packet ID. | String |
| PCAPResultsFTP.RequestCommand | The FTP request command. | String |
| PCAPResultsFTP.ResponseArgs | The FTP response arguments. | String |
| PCAPResultsFTP.ResponseCode | The FTP response code. | String |
| PCAPResultsICMP | ICMP data. | String |
| PCAPResultsSSH.EntryID | The PCAP’s entry ID. | String |
| PCAPResultsSSH.ClientProtocols | The SSH client protocols in the PCAP. | String |
| PCAPResultsSSH.ServerProtocols | The SSH server protocols in the PCAP. | String |
| PCAPResultsSSH.KeyExchangeMessageCode | The SSH key exchange message codes. | String |
args: - description: The entry_id of the PCAP file to mine. name: entry_id required: true - auto: PREDEFINED description: A comma-separated list of protocols to output as context. If empty, will not output any protocols to context. isArray: true name: protocol_output predefined: - HTTP - DNS - LLMNR - SYSLOG - SMTP - NETBIOS - ICMP - KERBEROS - TELNET - SSH - IRC - FTP - SMB2 - All - auto: PREDEFINED description: Whether to extract IP, URL, and Email from PCAP file. Can be "True" or "False". name: extract_strings predefined: - 'True' - 'False' - description: 'Filter to apply on PCAP. Wireshark syntax as can be found here: https://www.wireshark.org/docs/man-pages/wireshark-filter.html' name: pcap_filter - description: Your own regular expression to extract from the PCAP. name: custom_regex - description: The name of the PCAP file to save to the War Room after applying the `pcap_filter` (i.e. `filtered_file.pcap`). name: filtered_file_name - description: The entry ID for the RSA decryption key. name: rsa_decrypt_key_entry_id - defaultValue: '15' description: Number of conversations to display. The default is 15. name: convs_to_display - description: The WPA password. By providing the password you will be able to decrypt encrypted traffic data. name: wpa_password - auto: PREDEFINED defaultValue: 'False' description: Output to context the source and destination IPs in the PCAP file. Can be "True" or "False". The default is "False". name: extract_ips predefined: - 'True' - 'False' comment: |- PcapMIner V2 allows to parse PCAP files by displaying the all of the relevant data within including ip addresses, ports, flows, specific protocol breakdown, searching by regex, decrypting encrypted traffic and more. This automation takes about a minute to process 20,000 packets (which is approximately 10MB). If you want to mine large files you can either: a) Use the `pcap_filter` parameter to filter your PCAP file and thus make is smaller. b) Copy the automation and change the `default timeout` parameter to match your needs. commonfields: id: PcapMinerV2 version: -1 enabled: true name: PcapMinerV2 outputs: - contextPath: PCAPResults.Bytes description: The number of bytes transmitted in the PCAP file. type: Number - contextPath: PCAPResults.Packets description: The number of packets transmitted in the PCAP file. type: Number - contextPath: PCAPResults.EntryID description: The entryID of the PCAP file. type: String - contextPath: PCAPResults.StreamCount description: The number of streams in the PCAP file. type: String - contextPath: PCAPResults.StartTime description: The date and time of the first packet in the PCAP file. type: Date - contextPath: PCAPResults.EndTime description: The date and time of the last packet in the PCAP file. type: String - contextPath: PCAPResults.UniqueSourceIP description: The number of unique IPs from which packets were transmitted. type: Number - contextPath: PCAPResults.UniqueDestIP description: The number of unique IPs from to packets were transmitted. type: Number - contextPath: PCAPResultsFlow.Bytes description: The number of bytes transmitted in the flow. type: String - contextPath: PCAPResultsFlow.DestIP description: The destination IP of the flow. type: String - contextPath: PCAPResultsFlow.Transport description: The transport protocol of the flow. type: String - contextPath: PCAPResultsFlow.SourceIP description: The source IP of the flow. type: String - contextPath: PCAPResultsFlow.SourcePort description: The source port of the flow. type: String - contextPath: PCAPResultsFlow.DestPort description: The destination port of the flow. type: String - contextPath: PCAPResultsFlow.Duration description: The duration of the flow (in seconds). type: String - contextPath: PCAPResultsFlow.EndTime description: The date/time the flow ended. type: Date - contextPath: PCAPResultsFlow.StartTime description: The date/time the flow started. type: Date - contextPath: PCAPResults.URL description: The URLs extracted from the file. type: String - contextPath: PCAPResults.IP description: The IPs extracted from the file. type: String - contextPath: PCAPResults.Email description: The emails extracted from the file. type: String - contextPath: PCAPResults.Regex description: The regular expressions specified in `extract_regex` extracted from the file. type: String - contextPath: PCAPResultsHTTP.ResponseStatusCode description: The response code. type: String - contextPath: PCAPResultsHTTP.RequestVersion description: The request version. type: String - contextPath: PCAPResultsHTTP.RequestCacheControl description: The cache control of the request. type: String - contextPath: PCAPResultsHTTP.ResponseDate description: The date/time of the response. type: Date - contextPath: PCAPResultsHTTP.RequestMethod description: The request method. type: String - contextPath: PCAPResultsHTTP.RequestSourceIP description: The source IP of the request. type: String - contextPath: PCAPResultsHTTP.ResponseContentType description: The response content type. type: String - contextPath: PCAPResultsHTTP.RequestAgent description: The request agent. type: String - contextPath: PCAPResultsHTTP.RequestHost description: The request host. type: String - contextPath: PCAPResultsHTTP.ResponseVersion description: The response version. type: String - contextPath: PCAPResultsHTTP.ID description: The ID of the HTTP interaction. type: String - contextPath: PCAPResultsHTTP.EntryID description: The PCAP entry ID. type: String - contextPath: PCAPResultsHTTP.RequestURI description: The request URI. type: String - contextPath: PCAPResultsHTTP.ResponseContentLength description: The length of the response content. type: String - contextPath: PCAPResultsHTTP.ResponseCodeDesc description: The code description of the response. type: String - contextPath: PCAPResultsDNS.ID description: The ID of the DNS request. type: String - contextPath: PCAPResultsDNS.Request description: The DNS request. type: String - contextPath: PCAPResultsDNS.Response description: The DNS response. type: String - contextPath: PCAPResultsDNS.Type description: The type of the DNS request. type: String - contextPath: PCAPResultsDNS.ID description: The DNS packet ID. type: String - contextPath: PCAPResultsDNS.EntryID description: The PCAP entry ID. type: String - contextPath: PCAPResults.Protocols description: List of protocols found in the PCAP. type: String - contextPath: PCAPResultsSMTP.From description: The mail sender. type: String - contextPath: PCAPResultsSMTP.To description: The mail recipients. type: String - contextPath: PCAPResultsSMTP.Subject description: The mail subject. type: String - contextPath: PCAPResultsSMTP.MimeVersion description: The mime version. type: String - contextPath: PCAPResultsSMTP.ID description: The SMTP packet's ID. type: String - contextPath: PCAPResultsSMTP.EntryID description: The PCAP entry ID. type: String - contextPath: PCAPResultsKERBEROS.EntryID description: The PCAP entry ID. type: String - contextPath: PCAPResultsKERBEROS.Realm description: The KERBEROS realm. type: String - contextPath: PCAPResultsKERBEROS.SName description: The KERBEROS SName. type: String - contextPath: PCAPResultsKERBEROS.CName description: The KERBEROS CName. type: String - contextPath: PCAPResultsTelnet.Data description: The telnet data. type: String - contextPath: PCAPResultsTelnet.Commands description: The telnet commands. type: String - contextPath: PCAPResultsTelnet.EntryID description: The PCAP entry ID. type: String - contextPath: PCAPResultsLLMNR.EntryID description: The PCAP entry ID. type: String - contextPath: PCAPResultsLLMNR.QueryClass description: The LLMNR query class. type: String - contextPath: PCAPResultsLLMNR.QueryName description: The LLMNR query name. type: String - contextPath: PCAPResultsLLMNR.Questions description: The LLMNR questions. type: String - contextPath: PCAPResultsLLMNR.ID description: The LLMNR packet ID. type: String - contextPath: PCAPResultsLLMNR.QueryType description: The LLMNR query type. type: String - contextPath: PCAPResultsSYSLOG.EntryID description: The PCAP entry ID. type: String - contextPath: PCAPResultsSYSLOG.ID description: The SYSLOGS packet ID. type: String - contextPath: PCAPResultsSYSLOG.Message description: The SYSLOGS message. type: String - contextPath: PCAPResultsSYSLOG.Hostname description: The SYSLOGS host name. type: String - contextPath: PCAPResultsSYSLOG.Timestamp description: The SYSLOGS time stamp. type: String - contextPath: PCAPResultsSMB2.EntryID description: The PCAP entry ID. type: String - contextPath: PCAPResultsSMB2.ID description: The SMB2 packet ID. type: String - contextPath: PCAPResultsSMB2.UserName description: The SMB2 user name. type: String - contextPath: PCAPResultsSMB2.Domain description: The SMB2 domain. type: String - contextPath: PCAPResultsSMB2.HostName description: The SMB2 host name. type: String - contextPath: PCAPResultsSMB2.Command description: The SMB2 command. type: String - contextPath: PCAPResultsSMB2.FileName description: The SMB2 file name. type: String - contextPath: PCAPResultsSMB2.Tree description: The SMB2 tree. type: String - contextPath: PCAPResultsNETBIOS.EntryID description: The PCAP entry ID. type: String - contextPath: PCAPResultsNETBIOS.ID description: The NETIOS packet ID. type: String - contextPath: PCAPResultsNETBIOS.Name description: The NETIOS name. type: String - contextPath: PCAPResultsNETBIOS.Type description: The NETIOS type. type: String - contextPath: PCAPResultsNETBIOS.Class description: The NETIOS class. type: String - contextPath: PCAPResultsIRC.EntryID description: The PCAP entry ID. type: String - contextPath: PCAPResultsIRC.ID description: The IRC packet ID. type: String - contextPath: PCAPResultsIRC.RequestCommand description: The IRC request command. type: String - contextPath: PCAPResultsIRC.RequestTrailer description: The IRC request trailer. type: String - contextPath: PCAPResultsIRC.RequestPrefix description: The IRC request prefix. type: String - contextPath: PCAPResultsIRC.RequestParameters description: The IRC request parameters. type: String - contextPath: PCAPResultsIRC.ResponseCommand description: The IRC response command. type: String - contextPath: PCAPResultsIRC.ResponseTrailer description: The IRC response trailers. type: String - contextPath: PCAPResultsIRC.ResponsePrefix description: The IRC response prefix. type: String - contextPath: PCAPResultsIRC.ResponseParameters description: The IRC response parameters. type: String - contextPath: PCAPResultsFTP.EntryID description: The PCAP entry ID. type: String - contextPath: PCAPResultsFTP.ID description: The FTP packet ID. type: String - contextPath: PCAPResultsFTP.RequestCommand description: The FTP request command. type: String - contextPath: PCAPResultsFTP.ResponseArgs description: The FTP response arguments. type: String - contextPath: PCAPResultsFTP.ResponseCode description: The FTP response code. type: String - contextPath: PCAPResultsICMP description: ICMP data. type: String - contextPath: PCAPResultsSSH.EntryID description: The PCAP's entry ID. type: String - contextPath: PCAPResultsSSH.ClientProtocols description: The SSH client protocols in the PCAP. type: String - contextPath: PCAPResultsSSH.ServerProtocols description: The SSH server protocols in the PCAP. type: String - contextPath: PCAPResultsSSH.KeyExchangeMessageCode description: The SSH key exchange message codes. type: String script: '-' tags: - pcap - mine - file - Utility timeout: '0' type: python dockerimage: demisto/pcap-miner:1.0.0.10133006 runas: DBotWeakRole runonce: true tests: - No tests (auto formatted) subtype: python3 fromversion: 5.0.0