Share
Report
46I feel like this one is likely to be a very elementary setup, and likely is just me unable to wrap my head around conditions and loops. So, sorry for the newbie question, but I currently work in cybersecurity and am trying to set up a logic app that is able to start a Live Response session on a computer. This is generally used for malware investigation on a computer, and I am attempting to have it grab a file based on the alert that comes in. I have it to the point that it parses the original file location and starts a Live Response session.
However, this is where the fun comes in. When you run these sessions, they change to a 'Pending' status, and until finished, it looks like this in Postman:
This status will, more often than not, Fail.
This is actually to be expected in this case, as I am scanning the computer for the file, if the file is still in the original location. I actually expect 'Failed' to be the case 99% of the time. But while it is Pending, I can run the above action to keep checking on the action to see if it is 'Failed' or 'Succeeded'.
My question is, what is the best way to have it keep attempting to check this status until 'Failed' or 'Succeeded' comes in as the result? I tried a For Each loop to have it keep checking, along with a Delay of 5 secs, just so that it just keeps pinging back for the status without going full blast against the API. I then tried a Condition afterwards so that I can take action based on 'Failed' or 'Succeeded'. Does this sound about right? I tried to throw it together and could not get it to successfully run, but am not totally familiar with the best way to put this together.
Basically, if it succeeds, it should give me a URL of the file that it grabbed. If it failed, is is due to Defender automatically quarantining the file. I will have to make it jump to another Live Response session and attempt to grab the newest file out of the quarantine, which I already wrote the script for and have it loaded into Live Response, so it is easy to run out of the API.
Here is what I have for this section. First HTTP GET starts the live response and tells it to Get File based on the original location. I then have it parse out the response for the "Machine Action ID", which you need to check the the action status, which is done in the last HTTP GET.
All responses (
Answers (
