content/Packs/CommonScripts/Scripts/PcapHTTPExtractor/PcapHTTPExtractor.yml at 12c46b3733b6ae8c301fe5e160e1de6a021ca129 · demisto/content · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
args:
- description: get file entry from file name.
  name: pcapFileName
- default: true
  description: File entry from the WarRoom.
  name: entryID
- defaultValue: '50'
  description: Limit the output of the capture file output's flows (starts from 0).
  name: limit
- defaultValue: '0'
  description: Index of where to output flows (starts from 0).
  name: start
- defaultValue: '512'
  description: "Limit the HttpFileData field (in bytes)."
  name: limitData
- description: The allowed content types to display, separated with comma, uses startswith to find a match (ie text,image will display text\html, and image\png).
  name: allowedContentTypes
comment: Allows to parse and extract http flows (requests & responses) from a pcap/pcapng file.
commonfields:
  id: PcapHTTPExtractor
  version: -1
enabled: true
name: PcapHTTPExtractor
outputs:
- contextPath: PcapHTTPFlows
  description: Flows extracted from the pcap file.
  type: String
- contextPath: PcapHttpFlows.ResultIndex
  description: The index of the http packet in the pcap file.
  type: String
- contextPath: PcapHttpFlows.HttpContentType
  description: Http content type of the response.
  type: String
- contextPath: PcapHttpFlows.HttpResponseVersion
  description: Http version used in the response.
  type: String
- contextPath: PcapHttpFlows.HttpResponseCode
  description: Http response code from the server.
  type: String
- contextPath: PcapHttpFlows.HttpDate
  description: Http date returned from the sever.
  type: String
- contextPath: PcapHttpFlows.HttpRequestMethod
  description: Http request method used.
  type: String
- contextPath: PcapHttpFlows.HttpRequestUri
  description: Http request URI (path).
  type: String
- contextPath: PcapHttpFlows.HttpFileData
  description: Http content of the response.
  type: String
- contextPath: PcapHttpFlows.HttpServer
  description: The server signature in the response.
  type: String
- contextPath: PcapHttpFlows.HttpUserAgent
  description: Http user agent sent in the request.
  type: String
- contextPath: PcapHttpFlows.HttpAccept
  description: Http request accept type.
  type: String
- contextPath: PcapHttpFlows.MetaSniffTimeStamp
  description: Time the packet was sniffed (unixtime).
  type: String
script: ''
tags:
- pcap
- http
timeout: '0'
type: python
dockerimage: devdemisto/pcap-http-extractor:1.0.0.8936208
tests:
- PcapHTTPExtractor-Test
subtype: python3
fromversion: 5.0.0