Overview

File Utilities is a set of file actions used to power up playbook capabilities.

Actions

Add Attachment

Description

Adds an attachment to the case wall.

Parameters

Example

In this scenario, a Base64 blob is derived from a previous action and then is attached to the case wall. Once added to the wall, it can then be used for further analysis. This action is used alongside the “Get File as Base64” action, which generates the Base64 string of a file.

Action Results

• Script Result

  Script Result Name	Value options	Example
  is_success	True/False	is_success:True

• JSON Result

  {
  "evidenceName" : "Malicious_EML", 
  "description " : "Malicious EML file from end user.", 
  "evidenceThumbnailBase64" : "", 
  "evidenceId" : 322, 
  "fileType" : ".eml", 
  "creatorUserId" : "Siemplify automation", 
  "id " : 322, 
  "type"  : 4, 
  "caseId" : 51187, 
  "isFavorite" : true, 
  "modificationTimeUnixTimeInMs" : 1664206699128, 
  "creationTimeUnixTimeInMs" : 1664206699128, 
  "alertIdentifier" : null
  }

Add Entity to File

Description

Adds an identifier of a target entity to a local file. It will only add one occurrence of the entity to the file and will return False if the entity already exists.

Parameters

Example

In this scenario, suspicious hostname entity identifiers are added to a file called iocs_list.txt in /mnt/fileshare/ directory.

Action Results

• Script Result

  Script Result Name	Value options	Example
  AddedAllEntities	True/False	True

Count Files

Description

Counts number of files in a given folder path according to a specific file extension.

Parameters

Example

In this scenario, all files with .txt in /mnt/fileshare directory are counted.

Action Results

• Script Result

  Script Result Name	Value options	Example
  ScriptResult	Count Value	10

Create Archive

Description

Creates an archive file from a list of provided files or directory. Returns the location of the archive file.

Parameters

Example

In this scenario, an archive zip file called archived_ioc_files is created containing multiple files in the /mnt/fileshares directory.

Action Results

• Script Result

  Script Result Name	Value options	Example
  ScriptResult	True/False	true

• JSON Result

  {
  "archive" : 
  "/opt/siemplify/siemplify_server/Scripting/FileUtilities/Archives/archived_ioc_files.zip",
  "success" : true
  }

Decode Base64

Description

Decodes Base64 input string and returns a json object with the content.

Parameters

Example

In this scenario, a Base64 blob of a file is converted using UTF-8 to its original content.

Action Results

• Script Result

  Script Result Name	Value options	Example
  ScriptResult	True/False	true

• JSON Result

  {
  "decoded_content" : "<file content>"
  }

Extract Archive

Description

Extracts an archive file to a directory.

Parameters

Example

In this scenario, files in ioc_lists.zip are extracted and saved in the /opt/siemplify/siemplify_server/Scripting/FileUtilities/Extract directory.

Action Results

• Script Result

  Script Result Name	Value options	Example
  ScriptResult	True/False	true

• JSON Result

  {"archives" :
      {0 :
          "success" : true,
          "archive" : "ioc_lists.tar",
          "folder" : "/opt/siemplify/siemplify_server/Scripting/FileUtilities/Extract/ioc_lists",
          "files_with_path" :{
                  0 : "/opt/siemplify/siemplify_server/Scripting/FileUtilities/Extract/testarchive/Archives/ioc_lists.tar",
                  1 : "/opt/siemplify/siemplify_server/Scripting/FileUtilities/Extract/ioc_lists/Archives/file1"
                             },
          
          "files_list" : {
                  0 : "ioc_lists.tar",
                  1 : "file1",
                  2 : "file2"
                          },
          "files" :{
              "name" : "ioc_lists",
              "type" : "directory",
              "children" : {
                  0 :{
                      "name" : "ioc_lists.tar",
                      "type" : "file"
                     },
                  1 : {
                      "name" : "file1",
                      "type" : "file"
                      },
                  2 : {
                      "name" : "file2",
                      "type" : "file"
                      }
                           }
  
      }
  }

Extract Zip Files

Description

Extract files from a ZIP archive. It has the ability to extract password protected files by either a supplied password or brute force. It uses the attachment_id attribute of a file entity to pull the file from the case wall and extract it.

Parameters

Example

In this scenario, a password protected zip file entity is extracted and the resulting files are added to the case wall along with file entity creation.

Action Results

• Script Result

  Script Result Name	Value options	Example
  zip_files_extracted	True/False	true

Get Attachment

Description

Retrieves an attachment from the case wall and returns its Base64 value.

Parameters

Example

In this scenario, an attachment is pulled from the case wall and is converted to a Base64 blob.

Action Results

• Script Result

  Script Result Name	Value options	Example
  ScriptResult	Number of Attachments	1

• JSON Result

  {
  "evidenceName": "myfile.txt", 
  "description": "sample descriptions", 
  "evidenceThumbnailBase64": "", 
  "evidenceId": 475, 
  "fileType": ".txt", 
  "creatorUserId": "Siemplify automation", 
  "id": 475, 
  "type": 4, 
  "caseId": 51209, 
  "isFavorite": false, 
  "modificationTimeUnixTimeInMs": 1664222678523, 
  "creationTimeUnixTimeInMs": 1664222678523, 
  "alertIdentifier": "COFENSE TRIAGE: INBOX REPORTCBEdfghB-B9E2-4A04fghAB-136A6fdghF0C6", 
  "base64_blob": "dGhpcyBpcyB0ZXN0aW5nIHNhhdfhfpbmRlIHdpbmRvd3Mgc2hhcmdfghdfgUgddfghXNpbmcgc2llbXBsdfghaWZ5IGFndfghdfghdfghZW50"
  }

Get Files as Base64

Description

Converts files in a directory to Base64 values.

Parameters

Example

In this scenario, a file called iocs_list.txt in /mnt/sharefiles directory is converted to a Base64 blob. This action is often used along with “Add Attachment” action, which takes the Base64 blob as an input and adds the file to the case wall.

Action Results

• Script Result

  Script Result Name	Value options	Example
  ScriptResult	Number of Attachments	1

• JSON Result

  {
  "Filenames" : {
       0 :  "/opt/siemplify/siemplify_server/Scripting/Phishing_.eml",
       1 :  "/opt/siemplify/siemplify_server/Scripting/Logo.png"
       },
  "data" : {
       0 : {
            "path" : "/opt/siemplify/siemplify_server/Scripting",
            "filename" : "Phishing_.eml",
            "extension" : ".eml",
            "base64" : "asdfagdfgergert34523523452345dfg"  
       }
     }
  }  

Remove Entity from File

Description

Removes the identifier of a target entity from a local file. It will return False if it fails to remove all entities or if an entity doesn't exist.

Parameters

Example

In this scenario, internal hostname entity identifiers are removed from ioc_list.txt that is located in /tmp directory.

Action Results

• Script Result

  Script Result Name	Value options	Example
  RemovedAllEntities	True/False	True

Save Base64 to File

Description

Converts a Base64 string to a file. It supports comma separated lists for Filename and Base64 Input.

Parameters

Example

In this scenario, a Base64 input string is saved to a text file called ioc_list that is saved in the /opt/SiemplifyAgent/downloads directory.

Action Results

• Script Result

  Script Result Name	Value options	Example
  ScriptResult	True/False	true

• JSON Result

  {
  "files": [
  {"file_name": "ioc_list", 
  "file_path": "/opt/SiemplifyAgent/downloads/ioc_list.txt", 
  "extension": ".txt"}]
  }