id: Retrieve File from Endpoint - Generic V3
version: -1
contentitemexportablefields:
  contentitemfields: {}
name: Retrieve File from Endpoint - Generic V3
description: |-
  'This playbook retrieves a file sample from an endpoint using the following playbooks:'
  - Get File Sample From Path - Generic v2.
  - Get File Sample By Hash - Generic v3.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: aafd2bad-97ae-4462-85cb-8ef1cad54fc5
    type: start
    task:
      id: aafd2bad-97ae-4462-85cb-8ef1cad54fc5
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "4"
      - "5"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "3":
    id: "3"
    taskid: 21df4e3f-565e-48ca-8937-7106ed312e6e
    type: title
    task:
      id: 21df4e3f-565e-48ca-8937-7106ed312e6e
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "4":
    id: "4"
    taskid: 912761f3-e299-4ff5-86f2-33e81bb75178
    type: playbook
    task:
      id: 912761f3-e299-4ff5-86f2-33e81bb75178
      version: -1
      name: Get File Sample By Hash - Generic v3
      description: |-
        'This playbook returns a file sample from a specified path and host that you input in the following playbooks:'
        - Get binary file by MD5 hash from Carbon Black telemetry data - VMware Carbon Black EDR v2.
        - Get the threat (file) attached to a specific SHA256 hash - Cylance Protect v2.
      playbookName: Get File Sample By Hash - Generic v3
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      MD5:
        complex:
          root: inputs.MD5
      SHA256:
        complex:
          root: inputs.SHA256
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 515,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "5":
    id: "5"
    taskid: c5571a25-f1e3-4bd1-84eb-b72477be826b
    type: playbook
    task:
      id: c5571a25-f1e3-4bd1-84eb-b72477be826b
      version: -1
      name: Get File Sample From Path - Generic V3
      description: |
        This playbook returns a file sample from a specified path and host that you input in the following playbooks:
        1) PS Remote Get File Sample From Path.
        2) Get File Sample From Path - VMware Carbon Black EDR (Live Response API).
      playbookName: Get File Sample From Path - Generic V3
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      Agent_ID:
        complex:
          root: inputs.Agent_ID
      Host:
        complex:
          root: inputs.Host
      Path:
        complex:
          root: inputs.Path
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 30,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 385,
        "width": 865,
        "x": 30,
        "y": 50
      }
    }
  }
inputs:
- key: MD5
  value: {}
  required: false
  description: The MD5 hash value for the file to retrieve.
  playbookInputQuery:
- key: SHA256
  value: {}
  required: false
  description: The SHA256 hash value for the file to retrieve.
  playbookInputQuery:
- key: Host
  value: {}
  required: false
  description: Hostname of the machine on which the file is located for PS remote it can also be an IP address.
  playbookInputQuery:
- key: Path
  value: {}
  required: false
  description: |-
    The path of the file to retrieve.
    For example:
    C:\users\folder\file.txt
  playbookInputQuery:
- key: Agent_ID
  value: {}
  required: false
  description: The ID of the agent in the relevant integration (such as EDR).
  playbookInputQuery:
outputs:
- contextPath: File.Size
  description: The size of the file.
  type: number
- contextPath: File.Type
  description: The type of the file.
  type: string
- contextPath: File.Info
  description: General information of the file.
  type: string
- contextPath: File.MD5
  description: The MD5 hash of the file.
  type: string
- contextPath: File.SHA1
  description: The SHA1 hash of the file.
  type: string
- contextPath: File.SHA256
  description: The SHA256 hash of the file.
  type: string
- contextPath: File.SHA512
  description: The SHA512 hash of the file.
  type: string
- contextPath: File.EntryID
  description: File entry ID.
  type: string
- contextPath: File.Extension
  description: The file extension.
  type: string
- contextPath: File.Name
  description: The file name.
  type: string
- contextPath: File.SSDeep
  description: The file SSDeep.
  type: string
tests:
- Retrieve File from Endpoint - Generic V3 Test
fromversion: 6.0.0