Parses PCAP files and returns, the extracted files that are found, HTTP flows, and other information. PCAPMiner uses a Docker instance located on the Docker hub trorabaugh/dempcap:1.0. To use this script, upload a PCAP file and then run PCAPMiner entryId="<your_entry_id>". To get the entry ID, click on the link on the top right hand corner of a file attachment.

Script Data

Script Typepython
TagsUtility, file, pcap


Argument NameDescription
entryIdThe entryID of the file.
demistoLibLocationThe Demisto lib location. The default is "/var/lib/demisto/".


There are no outputs for this script.