id: Code42 File Download
version: -1
name: Code42 File Download
description: This playbook downloads a file via Code42 by either MD5 or SHA256 hash.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: f45944a7-0362-48e3-8adb-7022ef46ef0e
    type: start
    task:
      id: f45944a7-0362-48e3-8adb-7022ef46ef0e
      version: -1
      name: ""
      description: Begins the playbook.
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 265,
          "y": 40
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 22138dd2-186a-4001-83b5-006026235ffc
    type: condition
    task:
      id: 22138dd2-186a-4001-83b5-006026235ffc
      version: -1
      name: Is Code42 Integration Active?
      description: Checks to see if a Code42 Integration is active.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "3"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: brand
                      iscontext: true
                    right:
                      value:
                        simple: Code42
                - - operator: isEqualString
                    left:
                      value:
                        simple: state
                      iscontext: true
                    right:
                      value:
                        simple: active
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 265,
          "y": 175
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 698d902d-578c-4567-858d-807573f8e997
    type: condition
    task:
      id: 698d902d-578c-4567-858d-807573f8e997
      version: -1
      name: What type of hash was supplied?
      description: Check whether the values provided in arguments are equal. If either
        of the arguments are missing, no is returned.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "7"
      MD5:
      - "6"
      SHA256:
      - "5"
      XFCID:
      - "8"
    separatecontext: false
    conditions:
    - label: MD5
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.MD5
            iscontext: true
          right:
            value: {}
    - label: SHA256
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.SHA256
            iscontext: true
    - label: XFCID
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.XFC ID
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 265,
          "y": 350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: 3b2c3188-d267-4e9d-8f27-54993aa266ee
    type: regular
    task:
      id: 3b2c3188-d267-4e9d-8f27-54993aa266ee
      version: -1
      name: Code42 Download by SHA256
      description: Downloads a file from Code42 servers.
      script: Code42|||code42-download-file
      type: regular
      iscommand: true
      brand: Code42
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      filename:
        simple: ${inputs.Filename}
      hash:
        simple: ${inputs.SHA256}
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -150,
          "y": 545
        }
      }
    note: false
    evidencedata:
      description:
        simple: A file that triggered the alert.
      customfields: {}
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: 6b09d948-56b3-4236-87d5-06469c6a67b2
    type: regular
    task:
      id: 6b09d948-56b3-4236-87d5-06469c6a67b2
      version: -1
      name: Code42 Download by MD5
      description: Downloads a file from Code42 servers.
      script: Code42|||code42-download-file
      type: regular
      iscommand: true
      brand: Code42
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      filename:
        simple: ${inputs.Filename}
      hash:
        simple: ${inputs.MD5}
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 265,
          "y": 545
        }
      }
    note: false
    evidencedata:
      description:
        simple: A file that triggered the alert.
      customfields: {}
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: a31058a7-f7d7-4c3b-8d52-633b15b8b385
    type: title
    task:
      id: a31058a7-f7d7-4c3b-8d52-633b15b8b385
      version: -1
      name: Complete
      type: title
      description: The playbook is complete.
      iscommand: false
      brand: ""
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 265,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: e47b7f60-ecf8-4834-8aac-6bbc935dc87b
    type: regular
    task:
      id: e47b7f60-ecf8-4834-8aac-6bbc935dc87b
      version: -1
      name: code42-download-file-by-xfc-id
      description: Downloads a file from Incydr using the XFC Event ID.
      script: Code42|||code42-download-file-by-xfc-id
      type: regular
      iscommand: true
      brand: Code42
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      filename:
        simple: ${inputs.Filename}
      xfc_id:
        simple: ${inputs.XFC ID}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 675,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 745,
        "width": 1205,
        "x": -150,
        "y": 40
      }
    }
  }
inputs:
- key: MD5
  value:
    complex:
      root: File
      accessor: MD5
      transformers:
      - operator: uniq
  required: false
  description: MD5 hash to search for
  playbookInputQuery: null
- key: SHA256
  value:
    complex:
      root: File
      accessor: SHA256
      transformers:
      - operator: uniq
  required: false
  description: SHA256 hash to search for
  playbookInputQuery: null
- key: Filename
  value: {}
  required: false
  description: The name of the file to save as.
  playbookInputQuery: null
- key: XFC ID
  value: {}
  required: false
  description: The XFC ID of the file to download.
  playbookInputQuery: null
outputs:
- contextPath: File.Size
  description: The size of the file.
- contextPath: File.SHA1
  description: The SHA1 hash of the file.
- contextPath: File.SHA256
  description: The SHA256 hash of the file.
- contextPath: File.Name
  description: The name of the file.
- contextPath: File.SSDeep
  description: The SSDeep hash of the file.
- contextPath: File.EntryID
  description: The entry ID of the file.
- contextPath: File.Info
  description: File information.
- contextPath: File.Type
  description: The file type.
- contextPath: File.MD5
  description: The MD5 hash of the file.
- contextPath: File.Extension
  description: The file extension.
tests:
- No Test
fromversion: 5.0.0