Skip to main content
Question

Automatically Retrieve Files from Remote Machines for Further Analysis

  • October 12, 2026
  • 1 reply
  • 18 views

stutib
Forum|alt.badge.img

I am working on a use case in Google SecOps SOAR where I want to automate file processing using file paths available in alert details.
In some scenarios, an integration adds a file path to an alert's details. This path points to a file stored on a specific remote machine, such as an endpoint or server. However, the action that needs to process the file may be running on a different machine, so the file is not directly accessible using the provided path.
For example, an alert might contain a file path such as C:\Users\user\Downloads\suspicious.exe. This file exists on the endpoint that generated the alert, but the action running in Google SecOps SOAR may not have direct access to that endpoint or its local file system.
My goal is to automate the process of retrieving the file from the machine where it resides and then submitting it to an external analysis platform or processing it through another action.
I understand that accessing a file using its path requires access to the machine or a mechanism that can retrieve the file remotely. I would like to understand how this can be achieved using the capabilities available in Google SecOps SOAR.

1 reply

cmorris
Staff
Forum|alt.badge.img+17
  • Staff
  • October 12, 2026

I will typically do this via the EDR integrations. The Crowdstrike SOAR integration, for example, has a Download File action that can be used to retrieve the file. From there, I will submit the file to GTI via the GTI integration.