automation-CBLiveGetFile.yml

args:
- default: true
  description: hostname of a Carbon Black sensor
  name: hostname
- description: path to file on system
  name: path
  required: true
- description: ip of a Carbon Black sensor
  name: ip
comment: Use Carbon black Response Live session to retrieve a file from an endpoint.
  Endpoint needs to have a CbResponse sensor deployed.
commonfields:
  id: CBLiveGetFile
  version: -1
dependson:
  must:
  - cb-sensor-info
  - cb-list-sessions
  - cb-session-create
  - cb-session-info
  - cb-command-create
  - cb-command-info
  - cb-file-get
name: CBLiveGetFile
runonce: false
script: |-
  import time
  secTimeout = 120

  # find sensor ID
  if not demisto.get(demisto.args(), 'ip') and not demisto.get(demisto.args(), 'hostname'):
      demisto.results({ 'Type' : entryTypes['error'], 'ContentsFormat' : formats['text'], 'Contents' : 'You must provide ip or hostname for Cb sensor.'})
      sys.exit()
  else:
      dArgs = {'ip': demisto.args()['ip']} if demisto.get(demisto.args(), 'ip') else {'hostname': demisto.args()['hostname']}
      resFind = demisto.executeCommand( 'cb-sensor-info', dArgs )
      if isError(resFind[0]):
          demisto.results(resFind)
          sys.exit()
      else:
          matches = resFind[0]['Contents']
          if matches:
              if len(matches) == 1:
                  sensorId = str(matches[0]['id'])
              else:
                  demisto.results({ 'Type' : entryTypes['error'], 'ContentsFormat' : formats['text'], 'Contents' : 'More than one sensor returned.\nResult:\n' + str(matches)})
                  sys.exit()
          else:
              demisto.results({ 'Type' : entryTypes['error'], 'ContentsFormat' : formats['text'], 'Contents' : 'Sensor not found.'})
              sys.exit()
  demisto.log('[*] Located sensor ID ' + sensorId)
  # Get a live session to the endpoint
  resSessions = demisto.executeCommand( 'cb-list-sessions', {} )
  if isError(resSessions[0]):
      demisto.results(resSessions)
      sys.exit()
  else:
      existingSessions = [s for s in resSessions[0]['Contents'] if str(s['sensor_id']) == sensorId and s['status'] in ['pending', 'active']]
      if not existingSessions:
          resSessionCreate = demisto.executeCommand( 'cb-session-create', {'sensor': sensorId} )
          if isError(resSessionCreate[0]):
              demisto.results(resSessionCreate + [{ 'Type' : entryTypes['error'], 'ContentsFormat' : formats['text'], 'Contents' : 'Error while trying to create session.'}])
              sys.exit()
          else:
              sessionId = str(resSessionCreate[0]['Contents']['id'])
              demisto.log('[*] Created session ' + sessionId + ' for sensor ' + sensorId + '. Waiting for session to become active.')
      else:
          es = existingSessions[0]
          demisto.log('[*] Found existing %s session %d..' %(es['status'],es['id']))
          sessionId = str(es['id'])

      session = {'status':'pending'}
      resSessionInfo = []
      while session['status'] == 'pending':
          resSessionInfo = demisto.executeCommand( 'cb-session-info', { 'session' : sessionId } )
          if isError(resSessionInfo[0]):
              demisto.results(resSessionInfo + [{ 'Type' : entryTypes['error'], 'ContentsFormat' : formats['text'], 'Contents' : 'Error while polling for session status.'}])
              sys.exit()
          else:
              session = resSessionInfo[0]['Contents']
          time.sleep(3)
      if not session['status'] == 'active':
          demisto.results(resSessionInfo + [{ 'Type' : entryTypes['error'], 'ContentsFormat' : formats['text'], 'Contents' : 'Finished polling but session is not in active state.'}])
          sys.exit()
      else:
          demisto.log('[*] Session ' + sessionId + ' active.')




  # Create async command
  resCreate = demisto.executeCommand( 'cb-command-create', { 'session' : sessionId, 'name' : 'get file', 'object' : demisto.args()['path'] } )

  if not isError( resCreate[0] ):
      if len( resCreate ) == 1:
          # Get command id from response
          cmdID = demisto.get( resCreate[0], 'Contents.id' )
      else:
          demisto.results( { 'Type' : entryTypes['error'], 'ContentsFormat' : formats['text'], 'Contents' : 'Unexpected output returned from command-create.' } )
          sys.exit(0)
  else:
      demisto.results(resCreate)
      sys.exit(0)

  # Poll for command completion
  secRemaining = secTimeout
  while secRemaining:
      resInfo = demisto.executeCommand( 'cb-command-info', { 'session' : sessionId, 'command' : str(cmdID) } )
      if not isError( resInfo[0] ):
          if len( resInfo ) == 1:
              status = demisto.get( resInfo[0], 'Contents.status' )
              # If still working
              if 'pending' == status:
                  secRemaining -= 1
                  time.sleep(1)
              elif 'error' == status:
                  demisto.results( { 'Type' : entryTypes['error'], 'ContentsFormat' : formats['text'], 'Contents' : 'Command "get file" returned error: [Type:' + str(demisto.get( resInfo[0], 'Contents.result_type' )) + ' , Code:' + str(int(demisto.get( resInfo[0], 'Contents.result_code' ))) + ' , Desc:' + str(demisto.get( resInfo[0], 'Contents.result_desc' )) + ' ]' } )
                  sys.exit(0)
              elif 'complete' == status:
                  # Get FileID from command info response
                  fileID = demisto.get( resInfo[0], 'Contents.file_id' )
                  resFileGet = demisto.executeCommand( 'cb-file-get', { 'session' : sessionId, 'file-id' : str(fileID) } )
                  if not isError( resFileGet[0] ):
                      if len( resFileGet ) == 1:
                          demisto.results(resFileGet)
                          sys.exit(0)
                      else:
                          demisto.results( { 'Type' : entryTypes['error'], 'ContentsFormat' : formats['text'], 'Contents' : 'Unexpected output returned from file-get command.' } )
                          sys.exit(0)
                  else:
                      demisto.results(resFileGet)
                      sys.exit(0)
              else:
                  demisto.results( { 'Type' : entryTypes['error'], 'ContentsFormat' : formats['text'], 'Contents' : 'Unexpected status "' + status + '" returned from command-info.' } )
                  sys.exit(0)
          else:
              demisto.results( { 'Type' : entryTypes['error'], 'ContentsFormat' : formats['text'], 'Contents' : 'Unexpected output returned from command-create command.' } )
              sys.exit(0)
      else:
          demisto.results(resInfo)
          sys.exit(0)

  else:
      demisto.results( { 'Type' : entryTypes['error'], 'ContentsFormat' : formats['text'], 'Contents' : 'Command timed out after %d seconds' % secTimeout } )
      sys.exit(0)
scripttarget: 0
system: true
tags:
- carbon-black
- endpoint
timeout: 300ns
type: python