Creating a get file task

You can retrieve a file from selected hosts with the Endpoint Agent component. To do so, you must create a get file task.

The file to be downloaded must not exceed 100 MB. If the file exceeds 100 MB, the task finishes with an error.

To create a get file task:

1. Select the Tasks section in the application web interface window.

   This opens the task table.

2. Click the Add button and select File in the Get data drop-down list.

   This opens the task creation window.

3. Configure the following settings:
   1. File path—Path to the file that you want to receive.

      If the requested file is linked to other NTFS data streams, running the task yields all files of NTFS data streams that the requested file is linked to.

      You can also specify the path to an alternate data stream of this file. In this case, you receive only the files of the specified stream.

      Data streams of the NTFS file system (alternate data streams) are intended for additional attributes or information on a file.

      Each file in the NTFS file system consists of a set of streams. One of them contains the file contents that we will be able to see by opening the file. The other (alternate) ones are intended for metadata and to ensure, for example, compatibility between the NTFS system and other systems, such as the old Macintosh file system known as Hierarchical File System (HFS). Streams can be created, deleted, individually saved, renamed, and can even be run as a process.

      Alternate streams can be used by hackers for concealed transmission or receipt of data from a computer.

      When creating a task, the application does not check if the specified path to the file that you want to receive is valid.

   2. MD5/SHA256—MD5- or SHA256 hash of the file that you want to receive. This field is optional.
   3. If you do not want to scan the file, clear the Send for scanning check box.

      The check box is selected by default.

   4. Description is the task description. This field is optional.
   5. Host is the name or IP address of the host.

      You can specify only one host.

4. Click Add.

The get file task will be created. The task runs automatically after it is created.

A file received through this task will be placed in Storage. If the get file task completed successfully, you can download the received file to your local computer.

If you are using the distributed solution and multitenancy mode, the archive is placed in Storage of the Central Node server to which the host specified in the Host field is connected.

You can also download the file from the task report window.

To download the file from the task report window:

1. Select the Tasks section in the application web interface window.

   This opens the task table.

2. Open the get file task that you want to download.
3. In the Report section, click the name or IP address of the host.

   This opens a window containing information about the file.

4. Click Download.

The file will be saved to your local computer in the browser's downloads folder.

Users with the Security auditor role cannot create get file tasks.

Users with the Security officer role do not have access to tasks.

See also Managing tasks Viewing the task table Viewing information about a task Creating a forensic collection task Creating a registry key retrieval task Creating an NTFS metafile retrieval task Creating a process memory dump retrieval task Creating a disk image retrieval task Creating a RAM dump retrieval task Creating a process termination task Creating a task to scan hosts using YARA rules Creating a service management task Creating an application execution task Creating a file deletion task Creating a file quarantine task Creating a quarantined file recovery task Creating a copy of a task Deleting tasks Filtering tasks by creation time Filtering tasks by type Filtering tasks by name Filtering tasks by file name and path Filtering tasks by description Filtering tasks by server name Filtering tasks based on the name of the user that created the task Filtering tasks by processing status Clearing a task filter

Page top