Skip to main content


This Script is part of the Common Scripts Pack.#


Use PCAPMinerV2 instead.

Parses PCAP files and returns, the extracted files that are found, HTTP flows, and other information. PCAPMiner uses a Docker instance located on the Docker hub trorabaugh/dempcap:1.0. To use this script, upload a PCAP file and then run PCAPMiner entryId="<your_entry_id>". To get the entry ID, click on the link on the top right hand corner of a file attachment.

Script Data#

Script Typepython
TagsUtility, file, pcap


Argument NameDescription
entryIdThe entryID of the file.
demistoLibLocationThe Demisto lib location. The default is "/var/lib/demisto/".


There are no outputs for this script.