RemoveFileWrapper
This script allows removing specified files using Cortex XDR, CrowdStrike and Microsoft Defender (Advanced Threat Protection).
python · Malware Core
Details
| ID | RemoveFileWrapper |
|---|---|
| Language | python |
| From Version | 6.0.0 |
| Docker Image | demisto/python3:3.12.13.10404775 |
| Tags | basescript |
README
This script is a wrapper for Cortex XDR and CrowdStrike to remove files in given path.
Script Data
| Name | Description |
|---|---|
| Script Type | python3 |
| Tags | basescript |
| Cortex XSOAR Version | 6.0.0 |
Inputs
| Argument Name | Description |
|---|---|
| device_ids | List of device IDs. |
| file_path | The file path of the file. |
Outputs
| Path | Description | Type |
|---|---|---|
| PaloAltoNetworksXDR.ScriptRun.action_id | The ID of the initiated action. | Number |
| PaloAltoNetworksXDR.ScriptRun.endpoints_count | The number of endpoints the action was initiated on. | Number |
| CrowdStrike.Command.rm.HostID | The host ID. | String |
| CrowdStrike.Command.rm.Error | The error message raised if the command failed. | String |
Script Examples
Example command
!RemoveFileWrapper device_ids=0bde2c4645294245aca522971ccc44c4 file_path=/tmp/a.txt
Context Example
{
"CrowdStrike": {
"Command": {
"rm": {
"HostID": "0bde2c4645294245aca522971ccc44c4",
"Error": "Success"
}
}
}
}
Human Readable Output
Results Summary
| Instance | Command | Result | Comment |
|---|---|---|---|
| CrowdstrikeFalcon: CrowdstrikeFalcon_instance_1 | command: cs-falcon-rtr-remove-file args: host_ids: 0bde2c4645294245aca522971ccc44c4 file_path: /tmp/a.txt os: Linux |
Success | |
| Cortex XDR - IR: Cortex XDR - IR_instance_1 | command: xdr-run-script-delete-file args: endpoint_ids: 0bde2c4645294245aca522971ccc44c4 file_path: /tmp/a.txt |
Error | Error in API call [00] - Internal Server Error {"reply": {"err_code": 00, "err_msg": "An error occurred while processing XDR public API - No endpoint was found for creating the requested action", "err_extra": "can't create group action id for SCRIPT_EXECUTION"}} |
| Cortex XDR - IR: Cortex XDR - IR_instance_1_copy | command: xdr-run-script-delete-file args: endpoint_ids: 0bde2c4645294245aca522971ccc44c4 file_path: /tmp/a.txt |
Error | Error in API call [00] - Internal Server Error {"reply": {"err_code": 00, "err_msg": "An error occurred while processing XDR public API - No endpoint was found for creating the requested action", "err_extra": "can't create group action id for SCRIPT_EXECUTION"}} |
CrowdStrike Falcon rm over the file: /tmp/a.txt
| HostID | Error |
|---|---|
| 0bde2c4645294245aca522971ccc44c4 | Success |