Retrieve_File_from_Endpoint_-_Generic.yml

id: Retrieve File from Endpoint - Generic
version: 1
contentitemexportablefields:
  contentitemfields:
    packID: CommonPlaybooks
    packName: Common Playbooks
    itemVersion: 2.2.1
    fromServerVersion: 5.0.0
    toServerVersion: ""
    definitionid: ""
vcShouldKeepItemLegacyProdMachine: false
name: Retrieve File from Endpoint - Generic
description: |-
  This playbook retrieves a file sample from an endpoint using the following playbooks:
  - Get File Sample From Path - Generic
  - Get File Sample By Hash - Generic v2
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: aafd2bad-97ae-4462-85cb-8ef1cad54fc5
    type: start
    task:
      id: aafd2bad-97ae-4462-85cb-8ef1cad54fc5
      version: -1
      name: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
      - "4"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 265,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 91b91a1f-227c-433f-8fa0-80fd671e1a1d
    type: playbook
    task:
      id: 91b91a1f-227c-433f-8fa0-80fd671e1a1d
      version: -1
      name: Get File Sample From Path - Generic
      description: |-
        Returns a file sample to the war-room from a path on an endpoint using one or more integrations

        inputs:
        * UseD2 - if "True", use Demisto Dissolvable Agent (D2) to return the file (default: False)
      playbookName: Get File Sample From Path - Generic
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      Hostname:
        complex:
          root: inputs.Hostname
      Path:
        complex:
          root: inputs.Path
      UseD2:
        complex:
          root: inputs.UseD2
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 21df4e3f-565e-48ca-8937-7106ed312e6e
    type: title
    task:
      id: 21df4e3f-565e-48ca-8937-7106ed312e6e
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 265,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: e6fa1361-9097-4532-8d10-e0c53b74aee7
    type: playbook
    task:
      id: e6fa1361-9097-4532-8d10-e0c53b74aee7
      version: -1
      name: Get File Sample By Hash - Generic v2
      description: |-
        This playbook returns a file sample correlating to a hash from the war-room using the following sub-playbooks:
        - Get File Sample By Hash - Carbon Black Enterprise Response
        - Get File Sample By Hash - Cylance Protect v2
      playbookName: Get File Sample By Hash - Generic v2
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      MD5:
        complex:
          root: inputs.MD5
      SHA256:
        complex:
          root: inputs.SHA256
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 480,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
system: true
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 385,
        "width": 810,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: MD5
  value:
    complex:
      root: File
      accessor: MD5
      transformers:
      - operator: uniq
  required: false
  description: Get file sample from MD5 input.
  playbookInputQuery: null
- key: SHA256
  value:
    complex:
      root: File
      accessor: SHA256
      transformers:
      - operator: uniq
  required: false
  description: Get file sample from SHA256 input.
  playbookInputQuery: null
- key: Hostname
  value:
    complex:
      root: Endpoint
      accessor: Hostname
      transformers:
      - operator: uniq
  required: false
  description: Hostname of the machine on which the file is located.
  playbookInputQuery: null
- key: Path
  value:
    complex:
      root: File
      accessor: Path
  required: false
  description: File path.
  playbookInputQuery: null
- key: UseD2
  value:
    simple: "no"
  required: false
  description: |-
    Determines whether a D2 agent will be used to retrieve the file.
    Default is no.
  playbookInputQuery: null
outputs: []