Adding File Transfer Actions

You can create Actions quickly from malicious and non-malicious files in the File Library. These can be setup to use different layers, types of compression (gzip, zip, tar, rar, etc.), ports, directions (upload/download), and methods (HTTP, DNS tunneling, etc.).

To create a file transfer Action

1. Go to Library > Files.

2. Locate the file you want to use to create the Action.

   NOTE: If the file you want is not in the File Library, you can add it. See Adding Files to the File Library for more details.

3. Click Create Action.

   The Create Action form displays.

   

   Creating an Action from a File in the File Library

4. Select an application layer and click Next.

   NOTE:  Selecting Email as the application layer redirects you to Add Email Action page. See Adding Email Actions for more information.

5. Select a transport layer and click Next.

6. Complete the Create Action Details.

   NOTE: DNS tunnel Actions have additional Create Action Details that let you specify the request domain and DNS server.

   1. Enter a Name.
   2. Enter a Description.

   3. (Optional) Select the File Encoding.

      NOTE:  The File Encoding field supports archive formats including zip, gzip, bzip2, tar, rar, and 7zip. Enter a single archive type for one level of encoding (e.g., zip) or a comma-delimited list for multiple levels of encoding (e.g., zip, zip, zip).

   4. Select the Direction of exfiltration/transfer.
   5. Enter the Target Port. The default port is 80.

7. Click Save.

   The Action Library displays. A confirmation message that your Action was created successfully is shown and the Action is selected and displayed in the Action preview.