Get File Sample From Path - VMware Carbon Black EDR - Live Response API

This playbook retrieves a file from endpoints by path using VMware Carbon Black EDR (Live Response API). Make sure to provide the Carbon Black sensor ID of the endpoint from which you want to retrieve the file.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

GenericPolling

Integrations

  • carbonblackliveresponse
  • integration-Carbon_Black_Enterprise_Live_Response

Scripts

Exists

Commands

  • cb-get-file-from-endpoint
  • cb-session-create
  • cb-list-sessions
  • cb-session-close

Playbook Inputs


NameDescriptionDefault ValueRequired
Sensor_IDThe sensor ID. Provide the sensor ID to run the command with a new session. The session will be created and closed automatically.Optional
PathThe path of the file to retrieve.
For example:
C:\users\folder\file.txt
Optional

Playbook Outputs


PathDescriptionType
File.SizeThe size of the file.number
File.TypeThe type of the file.string
File.InfoGeneral information of the file.string
File.MD5The MD5 hash of the file.string
File.SHA1The SHA1 hash of the file.string
File.SHA256The SHA256 hash of the file.string
File.SHA512The SHA512 hash of the file.string
File.SSDeepThe file SSDeep.string
File.NameThe file name.string
File.EntryIDFile entry ID.string
File.ExtensionThe file extension.string

Playbook Image


Get File Sample From Path - VMware Carbon Black EDR - Live Response API