id: Get File Sample By Hash - Generic v3
version: -1
name: Get File Sample By Hash - Generic v3
description: |-
  This playbook returns a file sample correlating to a hash in the War Room using the following sub-playbooks:
  - Get binary file by MD5 hash from Carbon Black telemetry data - VMware Carbon Black EDR v2.
  - Get the threat (file) associated with a specific SHA256 hash - Cylance Protect v2.
  - Get the file associated with a specific MD5 or SHA256 hash - Code42.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: e1c3bf5a-d7ba-4062-8877-ad2799d1db03
    type: start
    task:
      id: e1c3bf5a-d7ba-4062-8877-ad2799d1db03
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "5"
      - "6"
      - "7"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: b5e5705d-8e32-41bb-8c3b-63c78bd2d14f
    type: title
    task:
      id: b5e5705d-8e32-41bb-8c3b-63c78bd2d14f
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: e912d085-264f-42f7-8a0f-b5aa82b96072
    type: playbook
    task:
      id: e912d085-264f-42f7-8a0f-b5aa82b96072
      version: -1
      name: Get File Sample By Hash - Cylance Protect v2
      description: This playbook returns a file sample to the War Room given the file's SHA256 hash, using Cylance Protect v2 integration.
      playbookName: Get File Sample By Hash - Cylance Protect v2
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      SHA256:
        complex:
          root: inputs.SHA256
          transformers:
          - operator: uniq
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 265,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: 1ac553d1-5315-4391-8875-63c8ca4e9fa2
    type: playbook
    task:
      id: 1ac553d1-5315-4391-8875-63c8ca4e9fa2
      version: -1
      name: Get the binary file from Carbon Black by its MD5 hash
      description: This playbook retrieves a binary file by its MD5 hash from the Carbon Black telemetry data.
      playbookName: Get the binary file from Carbon Black by its MD5 hash
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      MD5:
        complex:
          root: inputs.MD5
          transformers:
          - operator: uniq
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": -185,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: 9c2c0ffb-724a-40eb-8069-a8beb5de0775
    type: playbook
    task:
      id: 9c2c0ffb-724a-40eb-8069-a8beb5de0775
      version: -1
      name: Code42 File Download
      description: This playbook downloads a file via Code42 by either MD5 or SHA256 hash.
      playbookName: Code42 File Download
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      Filename:
        complex:
          root: inputs.NewFilename
      MD5:
        complex:
          root: inputs.MD5
          transformers:
          - operator: uniq
      SHA256:
        complex:
          root: inputs.SHA256
          transformers:
          - operator: uniq
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 705,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 385,
        "width": 1270,
        "x": -185,
        "y": 50
      }
    }
  }
inputs:
- key: MD5
  value: {}
  required: false
  description: The MD5 hash value for the file to retrieve.
  playbookInputQuery:
- key: SHA256
  value: {}
  required: false
  description: The SHA256 hash value for the file to retrieve.
  playbookInputQuery:
- key: NewFilename
  value: {}
  required: false
  description: A new name for the retrieved file. If left empty, the filename will not change.
  playbookInputQuery:
outputs:
- contextPath: File.Size
  description: The size of the file.
  type: number
- contextPath: File.Type
  description: The type of the file.
  type: string
- contextPath: File.Info
  description: General information of the file.
  type: string
- contextPath: File.MD5
  description: The MD5 hash of the file.
  type: string
- contextPath: File.SHA1
  description: The SHA1 hash of the file.
  type: string
- contextPath: File.SHA256
  description: The SHA256 hash of the file.
  type: string
- contextPath: File.SHA512
  description: The SHA512 hash of the file.
  type: string
- contextPath: File.SSDeep
  description: The SSDeep of the file.
  type: string
- contextPath: File.Extension
  description: The file extension.
  type: string
- contextPath: File.EntryID
  description: The file entry ID.
  type: string
- contextPath: File.Name
  description: The file name.
  type: string
tests:
- No tests (auto formatted)
fromversion: 5.0.0
contentitemexportablefields:
  contentitemfields: {}