args:
- description: The EntryID of the PCAP file to extract the files from.
  name: entry_id
  required: true
- description: The entry ID of the RSA private key.
  name: rsa_decrypt_key_entry_id
- description: The WPA password. By providing the password you will be able to decrypt. Can be password or ssid:password.
  name: wpa_password
- defaultValue: '5'
  description: Maximum number of files to extract. Default is 5.
  name: limit
- description: 'A comma-separated list of file extensions to include/exclude for example, image/gif.'
  name: types
- auto: PREDEFINED
  defaultValue: inclusive
  description: Is the type/extensions list inclusive or exclusive. Can be "inclusive" or "exclusive". Default is "inclusive".
  name: inclusive_or_exclusive
  predefined:
  - inclusive
  - exclusive
- description: 'A comma-separated list of MIME file types to include/exclude, for example, image/png. Can not combine with the extensions argument.'
  name: types
- description: 'A comma-separated list of file extensions to include/exclude, for example, image/png. Can not combine with the types argument.'
  name: extensions
comment: This automation extracts all possible files from a PCAP file.
commonfields:
  id: PcapFileExtractor
  version: -1
name: PcapFileExtractor
outputs:
- contextPath: PcapExtractedFiles.FileName
  description: File name.
  type: String
- contextPath: PcapExtractedFiles.FileSize
  description: File size.
  type: Number
- contextPath: PcapExtractedFiles.FileMD5
  description: The MD5 hash of the file.
  type: String
- contextPath: PcapExtractedFiles.FileSHA1
  description: The SHA1 hash of the file.
  type: String
- contextPath: PcapExtractedFiles.FileSHA256
  description: The SHA256 hash of the file.
  type: String
- contextPath: PcapExtractedFiles.FileExtension
  description: The extension of the file.
  type: String
- contextPath: File.Size
  description: The size of the file in bytes.
  type: Number
- contextPath: File.SHA1
  description: The SHA1 hash of the file.
  type: String
- contextPath: File.SHA256
  description: The SHA256 hash of the file.
  type: String
- contextPath: File.SHA512
  description: The SHA512 hash of the file.
  type: String
- contextPath: File.Name
  description: The full file name.
  type: String
- contextPath: File.SSDeep
  description: The ssdeep hash of the file.
  type: String
- contextPath: File.EntryID
  description: The ID for locating the file in the War Room.
  type: String
- contextPath: File.Info
  description: The file information.
  type: String
- contextPath: File.Type
  description: The file type.
  type: String
- contextPath: File.MD5
  description: The MD5 hash of the file.
  type: String
- contextPath: File.Extension
  description: 'The file extension, for example: ''txt''.'
  type: String
script: '-'
subtype: python3
tags:
- pcap
- file
- Utility
timeout: '0'
type: python
dockerimage: demisto/pcap-miner:1.0.0.10133006
tests:
- No tests (auto formatted)
fromversion: 5.0.0