RemoveFileWrapper
This script allows removing specified files using Cortex XDR, CrowdStrike and Microsoft Defender (Advanced Threat Protection).
python · Malware Core
Details
| ID | RemoveFileWrapper |
|---|---|
| Language | python |
| From Version | 6.0.0 |
| Docker Image | demisto/python3:3.12.13.10404775 |
| Tags | basescript |
README
This script is a wrapper for Cortex XDR and CrowdStrike to remove files in given path.
Script Data
| Name | Description |
|---|---|
| Script Type | python3 |
| Tags | basescript |
| Cortex XSOAR Version | 6.0.0 |
Inputs
| Argument Name | Description |
|---|---|
| device_ids | List of device IDs. |
| file_path | The file path of the file. |
Outputs
| Path | Description | Type |
|---|---|---|
| PaloAltoNetworksXDR.ScriptRun.action_id | The ID of the initiated action. | Number |
| PaloAltoNetworksXDR.ScriptRun.endpoints_count | The number of endpoints the action was initiated on. | Number |
| CrowdStrike.Command.rm.HostID | The host ID. | String |
| CrowdStrike.Command.rm.Error | The error message raised if the command failed. | String |
Script Examples
Example command
!RemoveFileWrapper device_ids=0bde2c4645294245aca522971ccc44c4 file_path=/tmp/a.txt
Context Example
{
"CrowdStrike": {
"Command": {
"rm": {
"HostID": "0bde2c4645294245aca522971ccc44c4",
"Error": "Success"
}
}
}
}
Human Readable Output
Results Summary
| Instance | Command | Result | Comment |
|---|---|---|---|
| CrowdstrikeFalcon: CrowdstrikeFalcon_instance_1 | command: cs-falcon-rtr-remove-file args: host_ids: 0bde2c4645294245aca522971ccc44c4 file_path: /tmp/a.txt os: Linux |
Success | |
| Cortex XDR - IR: Cortex XDR - IR_instance_1 | command: xdr-run-script-delete-file args: endpoint_ids: 0bde2c4645294245aca522971ccc44c4 file_path: /tmp/a.txt |
Error | Error in API call [00] - Internal Server Error {"reply": {"err_code": 00, "err_msg": "An error occurred while processing XDR public API - No endpoint was found for creating the requested action", "err_extra": "can't create group action id for SCRIPT_EXECUTION"}} |
| Cortex XDR - IR: Cortex XDR - IR_instance_1_copy | command: xdr-run-script-delete-file args: endpoint_ids: 0bde2c4645294245aca522971ccc44c4 file_path: /tmp/a.txt |
Error | Error in API call [00] - Internal Server Error {"reply": {"err_code": 00, "err_msg": "An error occurred while processing XDR public API - No endpoint was found for creating the requested action", "err_extra": "can't create group action id for SCRIPT_EXECUTION"}} |
CrowdStrike Falcon rm over the file: /tmp/a.txt
| HostID | Error |
|---|---|
| 0bde2c4645294245aca522971ccc44c4 | Success |
args: - description: List of device IDs. isArray: true name: device_ids required: true - description: Path(s) of the file(s) to remove. isArray: true name: file_path - description: Hash(es) of the file(s) to remove. isArray: true name: file_hash - description: Whether to run the command. This is used to prevent unwanted calls to the command. name: approve_action defaultValue: No predefined: - Yes - No comment: This script allows removing specified files using Cortex XDR, CrowdStrike and Microsoft Defender (Advanced Threat Protection). commonfields: id: RemoveFileWrapper version: -1 name: RemoveFileWrapper outputs: # XDR outputs - contextPath: PaloAltoNetworksXDR.ScriptRun.action_id description: The ID of the initiated action. type: Number - contextPath: PaloAltoNetworksXDR.ScriptRun.endpoints_count description: The number of endpoints the action was initiated on. type: Number # CrowdStrike outputs - contextPath: CrowdStrike.Command.rm.HostID description: The host ID. type: String - contextPath: CrowdStrike.Command.rm.Error description: The error message raised if the command failed. type: String # MSDE outputs - contextPath: MicrosoftATP.MachineAction.ID description: The machine action ID. type: String - contextPath: MicrosoftATP.MachineAction.Type description: The type of the action. type: String - contextPath: MicrosoftATP.MachineAction.Scope description: The scope of the action. type: String - contextPath: MicrosoftATP.MachineAction.Requestor description: The ID of the user that executed the action. type: String - contextPath: MicrosoftATP.MachineAction.RequestorComment description: The comment that was written when issuing the action. type: String - contextPath: MicrosoftATP.MachineAction.Status description: The current status of the command. type: String - contextPath: MicrosoftATP.MachineAction.MachineID description: The machine ID on which the action was executed. type: String - contextPath: MicrosoftATP.MachineAction.ComputerDNSName description: The machine DNS name on which the action was executed. type: String - contextPath: MicrosoftATP.MachineAction.CreationDateTimeUtc description: The date and time the action was created. type: Date - contextPath: MicrosoftATP.MachineAction.LastUpdateTimeUtc description: The last date and time the action status was updated. type: Date - contextPath: MicrosoftATP.MachineAction.RelatedFileInfo.FileIdentifier description: The file identifier. type: String - contextPath: MicrosoftATP.MachineAction.RelatedFileInfo.FileIdentifierType description: 'The file identifier type. Possible values: "SHA1" ,"SHA256", and "MD5".' type: String script: '-' tags: - basescript timeout: '0' type: python subtype: python3 dockerimage: demisto/python3:3.12.13.10404775 fromversion: 6.0.0 tests: - No tests (auto formatted)