> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blinkops.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Get RTR Extracted File Contents

Get RTR extracted file contents for the specified session and sha256.

The following role is required to run this action:

* `Real Time Responder - Active Responder`.

<Note>
  CrowdStrike returns the file in `7z` format.
  In order to get the file's true content, configure in the step config to save the output into a file - For more information, see [Configuring your Step Settings](https://docs.blinkops.com/docs/workflows/building-workflows/steps#configuring-your-step-settings).
  If not, the action will keep running/will return nothing and will not download the wanted file.
</Note>

## Parameters

<div className="integrations-table">
  | Parameter  | Description                                                                                                                                                                                                                                                                                                  |
  | ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
  | File Name  | File name to use for the archive name and the file within the archive.                                                                                                                                                                                                                                       |
  | SHA256     | Extracted SHA256 (e.g. `efa256a96af3b556cd3fc9d8b1cf587d72807d7805ced441e8149fc279db422b`). <br />You can find the file hash in the response of the [List RTR Session Files](https://docs.blinkops.com/docs/integrations/crowdstrike/actions/list-rtr-session-files) action for the wanted file and session. |
  | Session ID | RTR Session ID. You can find the Session ID in the response of the [Create Batch Session](https://docs.blinkops.com/docs/integrations/crowdstrike/actions/create-batch-session) action for the wanted host.                                                                                                  |
</div>

## Example Output

```json theme={"dark"}
[
	0
]
```

## Workflow Library Example

[Get Rtr Extracted File Contents with Crowdstrike and Send Results Via Email](https://library.blinkops.com/workflows/get-rtr-extracted-file-contents-with-crowdstrike-and-send-results-via-email)

<div className="iframe-wrapper">
  <div className="iframe-media">
    <img src="https://mintcdn.com/blinkops-2/ojHYuDeYX5FWuN8a/img/Icons/play-box.svg?fit=max&auto=format&n=ojHYuDeYX5FWuN8a&q=85&s=b8af968e71438a9499c3223c9bd29fb2" alt="Workflow Library" width="16" height="16" data-path="img/Icons/play-box.svg" />

    Preview this Workflow on desktop
  </div>

  <iframe className="iframe" src="https://library.blinkops.com/workflows/get-rtr-extracted-file-contents-with-crowdstrike-and-send-results-via-email/canvas" />
</div>