content/automation-CBPCatalogFindHash.yml at master · mmomin-crest/content · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
args:
- default: true
  description: md5 hash to find
  name: md5
  required: true
comment: Search the CBP/Bit9 file catalog for an md5 hash.
commonfields:
  id: CBPCatalogFindHash
  version: -1
dependson:
  must:
  - cbp-fileCatalog-search
name: CBPCatalogFindHash
runonce: false
script: |
  md5s = argToList(demisto.args()['md5'])
  found = []
  res = []
  t = []
  for md5 in md5s:
      resp = demisto.executeCommand('cbp-fileCatalog-search', {'query': 'md5:'+ md5})
      if isError(resp[0]):
          demisto.results(resp)
      else:
          data = demisto.get(resp[0], 'Contents')
          if data:
              found.append(md5)
              t += data
  appendContext('found_hashes', ','.join(found), dedup=True)
  if t:
      res.append({ "Type" : entryTypes["note"], "ContentsFormat" : formats["table"], "Contents" : t })
  else:
      res.append({ "Type" : entryTypes["note"], "ContentsFormat" : formats["text"], "Contents" : 'No results.' })
  demisto.results(res)
scripttarget: 0
system: true
tags:
- carbon-black-protection
- bit9
- enhancement
type: python