I have been banging my head against the wall with this one for about a week now, mostly because it is the very last step I need to complete my flow.
To explain a bit about the process, I am attempting to use a feature in Defender 365 called Live Response, which allows you to run scripts and grab files off of a machine. In my case, I am hoping to grab files that would be flagged as possible malware, and I have it to the point where I can kick it off and it grabs the file, then gives me a URL to download the file from. I am using an HTTP GET to download the file:
I then want to take this file and send it off to my malware sandbox that I have sitting in another environment. The problem is, Defender names the file filename.txt.gz, like so:
Not only is it a .txt.gz, but the content-type is "application/ocet-stream".
I am not sure that the.txt is messing things but when it pops an error for Unsupported media type, it mentions text/plain "in request":
The 'Body' is from the Download_file action, and the fileName is just a variable from where I parse out the original filename. Not being sure if the filename (which does have .txt in it) is causing issues, I actually hardcoded it to be named test.gz, and it still threw the same 'Unsupported Media type' error that mentions text/plain, so I am not sure where it is getting that.
The Input to the HTTP POST action. ends up looking like this:
Being that the contents of this file are just a .txt file that I am testing with the text "asdfasdf", I already can tell that this is the archive content that it is seeing, which makes sense as to why the characters look all funky.
Coming from the cybersecurity side of things, I have yet to throw together a Logic App that is doing this much stuff and jumping between systems, so it is probably just the way that I am trying to do this. I've seen a handful of different ways to do similar things but have tried so many of them with no luck and am getting a b bit discouraged at this.
