automation-CheckFiles.yml

args:
- default: true
  description: If provided, checks only files whose names are in the list. The names
    should be comma-separated.
  name: fileNames
comment: Iterate on all file artifacts in the investigation and return details of
  positives
commonfields:
  id: CheckFiles
  version: -1
dependson:
  must:
  - file
deprecated: true
name: CheckFiles
runonce: false
script: |-
  var fileNames = [];
  if (args.fileNames) {
    fileNames = args.fileNames.split(',');
  }
  var entries = executeCommand('getEntries', {});
  var res = [];
  for (var i=0; i<entries.length; i++) {
    if (entries[i].File && (fileNames.length === 0 || fileNames.indexOf(entries[i].File) >= 0)) {
      var rep = executeCommand('file', {file: entries[i].FileMetadata.MD5});
      if (rep && Array.isArray(rep)) {
        for (var r = 0; r < rep.length; r++) {
          if (positiveFile(rep[r])) {
            res.push(shortFile(rep[r]));
          }
        }
      }
    }
  }
  if (res.length > 0) {
    res.push('yes');
    return res;
  }
  return ['No suspicious files found', 'no'];
scripttarget: 0
system: true
tags:
- server
- threat-intel
type: javascript