Skip to main content

Cortex XDR - Retrieve File Playbook

This Playbook is part of the Palo Alto Networks Cortex XDR - Investigation and Response Pack.#

Retrieves files from selected endpoints. You can retrieve up to 20 files, from no more than 10 endpoints. Inputs for this playbook are:

  • A comma-separated list of endpoint IDs.
  • A comma-separated list of file paths for your operating system, either Windows, Linux, or Mac. At least one file path is required.

Dependencies#

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks#

GenericPolling

Integrations#

CortexXDRIR

Scripts#

PrintErrorEntry

Commands#

  • xdr-retrieve-files
  • xdr-retrieve-file-details

Playbook Inputs#


NameDescriptionDefault ValueRequired
endpoint_idsA comma-separated list of endpoint IDs.Required
file_pathA comma-separated list of file paths in any platform. It can be used instead of the macOS/Windows/Linux file paths.
The order of the files path list must be parallel to the endpoints list order. Therefore, the first file path in the list is related to the first endpoint ID and so on.
Optional
windows_file_pathsA comma-separated list of Windows paths.
Enter at least one path for either Windows, Linux, or Mac.
Optional
linux_file_pathsA comma-separated list Linux paths.
Enter at least one path for either Windows, Linux, or Mac.
Optional
mac_file_pathsA comma-separated list of Mac paths.
Enter at least one path for either Windows, Linux, or Mac.
Optional

Playbook Outputs#


PathDescriptionType
FileRetrieve the file details command results.unknown
File.NameThe full file name (including the file extension).String
File.EntryIDThe ID for locating the file in the War Room.String
File.SizeThe size of the file in bytes.Number
File.MD5The MD5 hash of the file.String
File.SHA1The SHA1 hash of the file.String
File.SHA256The SHA256 hash of the file.String
File.SHA512The SHA512 hash of the file.String
File.ExtensionThe file extension. For example, 'xls'.String
File.TypeThe file type, as determined by libmagic (same as displayed in the file entries).String

Playbook Image#


Cortex XDR - Retrieve File Playbook