Lastline v2

Use the Lastline v2 integration to provide threat analysts and incident response teams with the advanced malware isolation and inspection environment needed to safely execute advanced malware samples, and understand their behavior.

Data Enrichment & Threat Intelligence · Lastline

Details

IDLastline v2
ProviderBroadcom
CategoryData Enrichment & Threat Intelligence
From Version5.0.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM EDR Cortex Cloud Cloud Runtime Security

README

Use the Lastline v2 integration to provide threat analysts and incident response teams with the advanced malware isolation and inspection environment needed to safely execute advanced malware samples, and understand their behavior.

Configure Lastline v2 on Cortex XSOAR

  1. Navigate to Settings > Integrations > Servers & Services.
  2. Search for Lastline v2.
  3. Click Add instance to create and configure a new integration instance.
    Note that you can configure your instance using an API Key and API Token OR using an Email Address and Password.
    • Name: a textual name for the integration instance.
    • Server URL (e.g. https://analysis.lastline.com)
    • API Key for accessing Lastline APIs
    • API Token for accessing Lastline APIs
    • Email Address for accessing Lastline APIs using account based authentication
    • Password for accessing Lastline APIs using account based authentication
    • Use system proxy settings
    • Trust any certificate (not secure)
    • Threshold
  4. Click Test to validate the URLs, token, and connection.

Check the reputation of a file

Checks the file reputation of the specified file hashes. Supports MD5, SHA1, and SHA256 hashes.

Base Command

file

Input
Argument Name Description Required
file A comma-separated list of file hashes to check. Supports MD5, SHA1, and SHA256 hashes. Required
threshold The score threshold that determines if the file is malicious. The default value is “70”. Optional
Context Output
Path Type Description
File.MD5 string The MD5 hash of the file.
File.SHA1 string The SHA1 hash of the file.
File.SHA256 string The SHA256 hash of the file.
File.Type string The file type.
File.Malicious.Vendor string The vendor who determined that the file is malicious.
File.Malicious.Description string The reason that the vendor determined that the file is malicious.
File.Malicious.Score number The score that the vendor gave the malicious file.
DBotScore.Indicator string The indicator that was tested.
DBotScore.Type string The type of indicator.
DBotScore.Vendor string The vendor used to calculate the score.
DBotScore.Score number The actual score.
Lastline.Submission.Status string The status of the submission.
Lastline.Submission.UUID string The task UUID.
Lastline.Submission.SubmissionTime string The timestamp in Lastline.
Lastline.Submission.YaraSignatures.name string Yara signature’s name.
Lastline.Submission.YaraSignatures.score number The score according to the Yara signatures (0 to 100).
Lastline.Submission.YaraSignatures.internal boolean Whether the signature is for internal use only.
Lastline.Submission.DNSqueries string A list of DNS queries executed by the analysis subject.
Lastline.Submission.NetworkConnections string A list of network connections executed by the analysis subject.
Lastline.Submission.DownloadedFiles string A list of files that were downloaded using the Microsoft Windows file-download API functions. Each element is a tuple of file-origin URL and a File element.
Lastline.Submission.Process Unknown Information on the Windows process.
Lastline.Submission.Process.arguments string The argument of the process.
Lastline.Submission.Process.executable Unknown The executable of the process.
Lastline.Submission.Process.executable.abs_path string The absolute path of the executable of the process.
Lastline.Submission.Process.executable.filename string The filename of the executable.
Lastline.Submission.Process.executable.yara_signature_hits string The Yara signature of the executable of the process.
Lastline.Submission.Process.executable.ext_info unknown The executable information of the process.
Lastline.Submission.Process.process_id string The process ID.
Command Example

!file file=03bc132ee4a10f6d656fc21315fc7a65797be69a

Context Example
{
    "DBotScore": [
        {
            "Vendor": "Lastline", 
            "Indicator": "441666007e579b040967e72c13e5133b", 
            "Score": 1, 
            "Type": "File"
        }
    ], 
    "File": [
        {
            "Type": "application/zip", 
            "SHA1": "03bc132ee4a10f6d656fc21315fc7a65797be69a", 
            "SHA256": "fd977f34a9514ece503fa3ff3976ed3f305a101b3c5ff31a1293a9d0b607dfc1", 
            "MD5": "441666007e579b040967e72c13e5133b"
        }
    ], 
    "Lastline": [
        {
            "Submission": {
                "Status": "Completed", 
                "SubmissionTime": "2020-02-25 06:58:19", 
                "UUID": "2b9d578d02540010179339d362664f9b"
            }
        }
    ]
}
Human Readable Output
Lastline analysis for file: 441666007e579b040967e72c13e5133b

Score: 0

Task UUID: 2b9d578d02540010179339d362664f9b
Submission Time: 2020-02-25 06:58:19

MD5 SHA1 SHA256 Type
441666007e579b040967e72c13e5133b 03bc132ee4a10f6d656fc21315fc7a65797be69a fd977f34a9514ece503fa3ff3976ed3f305a101b3c5ff31a1293a9d0b607dfc1 application/zip

Submit a URL for analysis

Submits a URL for analysis.

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.

Base Command

lastline-upload-url

Input
Argument Name Description Required
url The URL to analyze. For example: https://www.demisto.com. Required
threshold The score threshold that determines if the file is malicious. The default value is “70”. Optional
Context Output
Path Type Description
URL.Data string A list of malicious URLs identified by the Lastline analysis.
URL.Malicious.Vendor string The vendor who determined that a URL is malicious.
URL.Malicious.Description string The reason that the vendor made the decision.
URL.Malicious.Score number The score that the malicious URL received from the vendor.
DBotScore.Indicator string The indicator that was tested.
DBotScore.Type string The indicator type.
DBotScore.Vendor string The vendor used to calculate the score.
DBotScore.Score number The actual score.
Lastline.Submission.Status string The status of the submission.
Lastline.Submission.UUID string The task UUID.
Lastline.Submission.SubmissionTime string The submission timestamp in Lastline.
Lastline.Submission.YaraSignatures.name string Yara signatures name.
Lastline.Submission.YaraSignatures.score number The score according to the Yara signatures (0 to 100).
Lastline.Submission.YaraSignatures.internal boolean Whether the signature is for internal usage only.
Lastline.Submission.DNSqueries string A list of DNS queries executed by the analysis subject.
Lastline.Submission.NetworkConnections string A list of network connections executed by the analysis subject.
Lastline.Submission.DownloadedFiles string A list of files that were downloaded using the Microsoft Windows file-download API functions. Each element is a tuple of file-origin URL and a File element.
Lastline.Submission.Process Unknown Information on the Windows process.
Lastline.Submission.Process.arguments string The argument of the process.
Lastline.Submission.Process.executable Unknown The executable of the process.
Lastline.Submission.Process.executable.abs_path string The absolute path of the executable of the process.
Lastline.Submission.Process.executable.yara_signature_hits string The Yara signature of the executable of the process.
Lastline.Submission.Process.executable.ext_info unknown The executable information of the process.
Lastline.Submission.Process.process_id string The process ID.
Command Example

!lastline-upload-url url="https://www.demisto.com" threshold=80

Context Example
{
    "URL": {
        "Data": "https://www.demisto.com"
    }, 
    "DBotScore": {
        "Vendor": "Lastline", 
        "Indicator": "https://www.demisto.com", 
        "Score": 1, 
        "Type": "URL"
    }, 
    "Lastline": {
        "Submission": {
            "Status": "Completed", 
            "SubmissionTime": "2020-02-24 07:05:33", 
            "UUID": "c62b15a9e3dc00101e9557a0b6a17d3f"
        }
    }
}
Human Readable Output
Lastline analysis for url: https://www.demisto.com

Score: 0

Task UUID: c62b15a9e3dc00101e9557a0b6a17d3f
Submission Time: 2020-02-24 07:05:33

Data
https://www.demisto.com

Upload a file for analysis

Submits a file for analysis.\
Note: Due to a limitation in Lastline’s API, EML files are not supported.

Base Command

lastline-upload-file

Input
Argument Name Description Required
EntryID The entry ID of the file to upload. Required
threshold The score threshold that determines if the file is malicious. The default value is “70”. Optional
Context Output
Path Type Description
File.MD5 string The MD5 hash of the file.
File.SHA1 string The SHA1 hash of the file.
File.SHA256 string The SHA256 hash of the file.
File.Type string The file type.
File.Malicious.Vendor string The vendor who determined that the file is malicious.
File.Malicious.Description string The reason that the vendor determined that the file is malicious.
File.Malicious.Score number The score the malicious file received from the vendor.
DBotScore.Indicator string The indicator that was tested.
DBotScore.Type string The indicator type.
DBotScore.Vendor string The vendor used to calculate the score.
DBotScore.Score number The actual score.
Lastline.Submission.Status string The status of the submission.
Lastline.Submission.UUID string The task UUID.
Lastline.Submission.SubmissionTime string The submission timestamp in Lastline.
Lastline.Submission.YaraSignatures.name string Yara signatures name.
Lastline.Submission.YaraSignatures.score number The score according to the Yara signatures (0 to 100).
Lastline.Submission.YaraSignatures.internal boolean Whether the signature is for internal use only.
Lastline.Submission.DNSqueries string A list of DNS queries executed by the analysis subject.
Lastline.Submission.NetworkConnections string A list of network connections executed by the analysis subject.
Lastline.Submission.DownloadedFiles string A list of files that were downloaded using the Microsoft Windows file-download API functions. Each element is a tuple of file-origin URL and a File element.
Lastline.Submission.Process Unknown Information on the Windows process.
Lastline.Submission.Process.arguments string The argument of the process.
Lastline.Submission.Process.executable Unknown The executable of the process.
Lastline.Submission.Process.executable.abs_path string The absolute path of the executable of the process.
Lastline.Submission.Process.executable.filename string The filename of the executable.
Lastline.Submission.Process.executable.yara_signature_hits string The Yara signature of the executable of the process.
Lastline.Submission.Process.executable.ext_info unknown The executable information of the process.
Lastline.Submission.Process.process_id string The process ID.
Command Example

!lastline-upload-file EntryID=152@374 threshold=40

Context Example
{
    "DBotScore": {
        "Vendor": "Lastline", 
        "Indicator": "441666007e579b040967e72c13e5133b", 
        "Score": 1, 
        "Type": "File"
    }, 
    "File": {
        "Type": "application/zip", 
        "SHA1": "03bc132ee4a10f6d656fc21315fc7a65797be69a", 
        "SHA256": "fd977f34a9514ece503fa3ff3976ed3f305a101b3c5ff31a1293a9d0b607dfc1", 
        "MD5": "441666007e579b040967e72c13e5133b"
    }, 
    "Lastline": {
        "Submission": {
            "Status": "Completed", 
            "SubmissionTime": "2020-02-25 06:58:19", 
            "UUID": "2b9d578d02540010179339d362664f9b"
        }
    }
}
Human Readable Output
Lastline analysis for file: 441666007e579b040967e72c13e5133b

Score: 0

Task UUID: 2b9d578d02540010179339d362664f9b
Submission Time: 2020-02-25 06:58:19

MD5 SHA1 SHA256 Type
441666007e579b040967e72c13e5133b 03bc132ee4a10f6d656fc21315fc7a65797be69a fd977f34a9514ece503fa3ff3976ed3f305a101b3c5ff31a1293a9d0b607dfc1 application/zip

Get an analysis report

Returns an analysis report.

Base Command

lastline-get-report

Input
Argument Name Description Required
uuid The task UUID of the submitted Lastline analysis. Required
threshold The score threshold that determines if the file is malicious. The default value is “70”. Optional
Context Output
Path Type Description
URL.Data string A list of malicious URLs identified by the Lastline analysis.
URL.Malicious.Vendor string The vendor that determined a URL is malicious.
URL.Malicious.Description string The reason that the vendor determined that the URL is malicious.
URL.Malicious.Score number The score that the malicious URL received from the vendor.
File.MD5 string The MD5 hash of the file.
File.SHA1 string The SHA1 hash of the file.
File.SHA256 string The SHA256 hash of the file.
File.Type string The file type.
File.Malicious.Vendor string The vendor that determined a file is malicious.
File.Malicious.Description string The reason that the vendor determined that the file is malicious.
File.Malicious.Score number The score that the malicious file received from the vendor.
DBotScore.Indicator string The indicator that was tested.
DBotScore.Type string The type of indicator.
DBotScore.Vendor string The vendor used to calculate the score.
DBotScore.Score number The actual score.
Lastline.Submission.Status string Status of the submission.
Lastline.Submission.UUID string The task UUID.
Lastline.Submission.SubmissionTime string The timestamp in Lastline.
Lastline.Submission.YaraSignatures.name string Yara signatures name.
Lastline.Submission.YaraSignatures.score number The score according to the Yara signatures (0 to 100).
Lastline.Submission.YaraSignatures.internal boolean Whether the signature is for internal use only.
Lastline.Submission.DNSqueries string A list of DNS queries executed by the analysis subject.
Lastline.Submission.NetworkConnections string A list of network connections executed by the analysis subject.
Lastline.Submission.DownloadedFiles string A list of files that were downloaded using the Microsoft Windows file-download API functions. Each element is a tuple of file-origin URL and a File element.
Lastline.Submission.Process Unknown Information on the Windows process.
Lastline.Submission.Process.arguments string The argument of the process.
Lastline.Submission.Process.executable Unknown The executable of the process.
Lastline.Submission.Process.executable.abs_path string The absolute path of the executable of the process.
Lastline.Submission.Process.executable.filename string The filename of the executable.
Lastline.Submission.Process.executable.yara_signature_hits string The Yara signature of the executable of the process.
Lastline.Submission.Process.executable.ext_info unknown The executable information of the process.
Lastline.Submission.Process.process_id string The process ID.
Command Example

!lastline-get-report uuid=b32ed21999be00100eca07d07cb7bf38 threshold=70

Context Example
{
    "URL": {
        "Data": "https://google.com"
    }, 
    "DBotScore": {
        "Vendor": "Lastline", 
        "Indicator": "https://google.com", 
        "Score": 1, 
        "Type": "URL"
    }, 
    "Lastline": {
        "Submission": {
            "Status": "Completed", 
            "SubmissionTime": "2019-12-31 02:40:44", 
            "UUID": "b32ed21999be00100eca07d07cb7bf38"
        }
    }
}
Human Readable Output
Lastline analysis for url: https://google.com

Score: 0

Task UUID: b32ed21999be00100eca07d07cb7bf38
Submission Time: 2019-12-31 02:40:44

Data
https://google.com

Get a list of tasks

Returns a list of tasks.

Base Command

lastline-get-task-list

Input
Argument Name Description Required
before Return tasks before this date (in UTC format %Y-%m-%dT%H:%M:%S). For example, 2018-07-08T12:00:00. Optional
after Return tasks after this date (in UTC format %Y-%m-%dT%H:%M:%S). For example, 2018-07-10T12:00:00. Required
Context Output

There is no context output for this command.

Command Example

!lastline-get-task-list after=2020-01-01T00:00:00 before=2020-01-02T00:00:00

Human Readable Output
tasks
UUID Time Status
b32ed21999be00100eca07d07cb7bf38 2019-12-31T02:40:44 Completed
6493c3fa395000101e8ee41181d70b02 2020-01-01T15:26:35 Completed

Get the status of a submission

Checks the status of a submission.

Base Command

lastline-check-status

Input
Argument Name Description Required
uuid The task UUID of the submitted Lastline analysis. Required
Context Output
Path Type Description
URL.Data string A list of malicious URLs identified by the lastline analysis.
URL.Malicious.Vendor string The vendor that determined that a URL is malicious.
URL.Malicious.Description string The reason that the vendor determined that the URL is malicious.
URL.Malicious.Score number The score that the malicious URL received from the vendor.
File.MD5 string The MD5 hash of the file.
File.SHA1 string The SHA1 hash of the file.
File.SHA256 string The SHA256 hash of the file.
File.Type string The file type.
File.Malicious.Vendor string The vendor that determined that the file is malicious.
File.Malicious.Description string The reason that the vendor determined that the file is malicious.
File.Malicious.Score number The score that the malicious file received from the vendor.
DBotScore.Indicator string The indicator that was tested.
DBotScore.Type string The type of indicator.
DBotScore.Vendor string The vendor used to calculate the score.
DBotScore.Score number The actual score.
Lastline.Submission.Status string The status of the submission.
Lastline.Submission.UUID string The task UUID.
Lastline.Submission.SubmissionTime string The timestamp in Lastline.
Lastline.Submission.YaraSignatures.name string Yara signatures name.
Lastline.Submission.YaraSignatures.score number The score according to the Yara signatures (0 to 100).
Lastline.Submission.YaraSignatures.internal boolean Whether the signature is for internal use only.
Lastline.Submission.DNSqueries string List of DNS queries executed by the analysis subject.
Lastline.Submission.NetworkConnections string A list of network connections executed by the analysis subject.
Lastline.Submission.DownloadedFiles string A list of files that were downloaded using the Microsoft Windows file-download API functions. Each element is a tuple of file-origin URL and a File element.
Lastline.Submission.Process Unknown Information on athe Windows process.
Lastline.Submission.Process.arguments string The argument of the process.
Lastline.Submission.Process.executable Unknown The executable of the process.
Lastline.Submission.Process.executable.abs_path string The absolute path of the executable of the process.
Lastline.Submission.Process.executable.filename string The filename of the executable.
Lastline.Submission.Process.executable.yara_signature_hits string The Yara signature of the executable of the process.
Lastline.Submission.Process.executable.ext_info unknown The executable information of the process.
Lastline.Submission.Process.process_id string The process ID.
Command Example

!lastline-check-status uuid=b32ed21999be00100eca07d07cb7bf38

Context Example
{
    "URL": {
        "Data": "https://google.com"
    }, 
    "DBotScore": {
        "Vendor": "Lastline", 
        "Indicator": "https://google.com", 
        "Score": 1, 
        "Type": "URL"
    }, 
    "Lastline": {
        "Submission": {
            "Status": "Completed", 
            "SubmissionTime": "2019-12-31 02:40:44", 
            "UUID": "b32ed21999be00100eca07d07cb7bf38"
        }
    }
}
Human Readable Output
Lastline analysis for url: https://google.com

Score: 0

Task UUID: b32ed21999be00100eca07d07cb7bf38
Submission Time: 2019-12-31 02:40:44

Data
https://google.com

Configuration parameters

  • url — Server URL (e.g. https://analysis.lastline.com) (required)
  • creds_key_and_token — API Key for accessing Lastline APIs
  • credentials — Email address
  • proxy — Use system proxy settings
  • insecure — Trust any certificate (not secure)
  • threshold — Threshold
  • api_key — API Key for accessing Lastline APIs
  • api_token — API Token for accessing Lastline APIs
  • integrationReliability — Source Reliability
  • feedExpirationPolicy —
  • feedExpirationInterval —

Commands (6)

  • file

    Checks the file reputation of the specified file hashes. Supports MD5, SHA1, and SHA256 hashes.

  • lastline-check-status

    Checks the status of a submission.

  • lastline-get-report

    Returns an analysis report.

  • lastline-get-task-list

    Returns a list of tasks.

  • lastline-upload-file

    Submits a file for analysis.

  • lastline-upload-url

    Submits a URL for analysis.

Source

Lastline_v2.py Lastline_v2_test.py Lastline_v2.yml Lastline_v2_description.md
Download History Raw 
category: Data Enrichment & Threat Intelligence
provider: Broadcom
sectionorder:
- Connect
- Collect
commonfields:
  id: Lastline v2
  version: -1
configuration:
- defaultvalue: https://analysis.lastline.com
  display: Server URL (e.g. https://analysis.lastline.com)
  name: url
  required: true
  type: 0
  section: Connect
- display: API Key for accessing Lastline APIs
  name: creds_key_and_token
  type: 9
  section: Connect
  displaypassword: API Token for accessing Lastline APIs
  required: false
- display: Email address
  name: credentials
  type: 9
  section: Connect
  additionalinfo: Note that when credentials are set, the integration uses account-based authentication.
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  required: false
- defaultvalue: 'false'
  display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  required: false
- defaultvalue: '70'
  display: Threshold
  name: threshold
  type: 0
  section: Connect
  required: false
- display: API Key for accessing Lastline APIs
  name: api_key
  type: 0
  section: Connect
  hidden: true
  required: false
- display: API Token for accessing Lastline APIs
  name: api_token
  type: 4
  section: Connect
  hidden: true
  required: false
- additionalinfo: Reliability of the source providing the intelligence data.
  defaultvalue: B - Usually reliable
  display: Source Reliability
  name: integrationReliability
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  type: 15
  section: Collect
  required: false
- defaultvalue: indicatorType
  name: feedExpirationPolicy
  display: ''
  options:
  - never
  - interval
  - indicatorType
  - suddenDeath
  type: 17
  section: Collect
  required: false
- defaultvalue: '20160'
  name: feedExpirationInterval
  display: ''
  type: 1
  section: Collect
  required: false
description: Use the Lastline v2 integration to provide threat analysts and incident response teams with the advanced malware isolation and inspection environment needed to safely execute advanced malware samples, and understand their behavior.
display: Lastline v2
name: Lastline v2
script:
  commands:
  - arguments:
    - default: true
      description: A comma-separated list of file hashes to check. Supports MD5, SHA1, and SHA256 hashes.
      isArray: true
      name: file
      required: true
    - defaultValue: '70'
      description: The score threshold that determines if the file is malicious. The default value is "70".
      name: threshold
    description: Checks the file reputation of the specified file hashes. Supports MD5, SHA1, and SHA256 hashes.
    name: file
    outputs:
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: string
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: string
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: string
    - contextPath: File.Type
      description: The file type.
      type: string
    - contextPath: File.Malicious.Vendor
      description: The vendor who determined that the file is malicious.
      type: string
    - contextPath: File.Malicious.Description
      description: The reason that the vendor determined that the file is malicious.
      type: string
    - contextPath: File.Malicious.Score
      description: The score that the vendor gave the malicious file.
      type: number
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: string
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: string
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: string
    - contextPath: DBotScore.Score
      description: The actual score.
      type: number
    - contextPath: Lastline.Submission.Status
      description: The status of the submission.
      type: string
    - contextPath: Lastline.Submission.UUID
      description: The task UUID.
      type: string
    - contextPath: Lastline.Submission.SubmissionTime
      description: The timestamp in Lastline.
      type: string
    - contextPath: Lastline.Submission.YaraSignatures.name
      description: Yara signature's name.
      type: string
    - contextPath: Lastline.Submission.YaraSignatures.score
      description: The score according to the Yara signatures (0 to 100).
      type: number
    - contextPath: Lastline.Submission.YaraSignatures.internal
      description: Whether the signature is for internal use only.
      type: boolean
    - contextPath: Lastline.Submission.DNSqueries
      description: A list of DNS queries executed by the analysis subject.
      type: string
    - contextPath: Lastline.Submission.NetworkConnections
      description: A list of network connections executed by the analysis subject.
      type: string
    - contextPath: Lastline.Submission.DownloadedFiles
      description: A list of files that were downloaded using the Microsoft Windows file-download API functions. Each element is a tuple of file-origin URL and a File element.
      type: string
    - contextPath: Lastline.Submission.Process
      description: Information on the Windows process.
      type: Unknown
    - contextPath: Lastline.Submission.Process.arguments
      description: The argument of the process.
      type: string
    - contextPath: Lastline.Submission.Process.executable
      description: The executable of the process.
      type: Unknown
    - contextPath: Lastline.Submission.Process.executable.abs_path
      description: The absolute path of the executable of the process.
      type: string
    - contextPath: Lastline.Submission.Process.executable.filename
      description: The filename of the executable.
      type: string
    - contextPath: Lastline.Submission.Process.executable.yara_signature_hits
      description: The Yara signature of the executable of the process.
      type: string
    - contextPath: Lastline.Submission.Process.executable.ext_info
      description: The executable information of the process.
      type: unknown
    - contextPath: Lastline.Submission.Process.process_id
      description: The process ID.
      type: string
  - arguments:
    - description: ' The URL to analyze. For example: https://www.demisto.com. '
      name: url
      required: true
    - defaultValue: '70'
      description: The score threshold that determines if the file is malicious. The default value is "70".
      name: threshold
    description: Submits a URL for analysis.
    name: lastline-upload-url
    outputs:
    - contextPath: URL.Data
      description: A list of malicious URLs identified by the Lastline analysis.
      type: string
    - contextPath: URL.Malicious.Vendor
      description: The vendor who determined that a URL is malicious.
      type: string
    - contextPath: URL.Malicious.Description
      description: The reason that the vendor made the decision.
      type: string
    - contextPath: URL.Malicious.Score
      description: The score that the malicious URL received from the vendor.
      type: number
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: string
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: string
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: string
    - contextPath: DBotScore.Score
      description: The actual score.
      type: number
    - contextPath: Lastline.Submission.Status
      description: The status of the submission.
      type: string
    - contextPath: Lastline.Submission.UUID
      description: The task UUID.
      type: string
    - contextPath: Lastline.Submission.SubmissionTime
      description: The submission timestamp in Lastline.
      type: string
    - contextPath: Lastline.Submission.YaraSignatures.name
      description: Yara signatures name.
      type: string
    - contextPath: Lastline.Submission.YaraSignatures.score
      description: The score according to the Yara signatures (0 to 100).
      type: number
    - contextPath: Lastline.Submission.YaraSignatures.internal
      description: Whether the signature is for internal usage only.
      type: boolean
    - contextPath: Lastline.Submission.DNSqueries
      description: A list of DNS queries executed by the analysis subject.
      type: string
    - contextPath: Lastline.Submission.NetworkConnections
      description: A list of network connections executed by the analysis subject.
      type: string
    - contextPath: Lastline.Submission.DownloadedFiles
      description: A list of files that were downloaded using the Microsoft Windows file-download API functions. Each element is a tuple of file-origin URL and a File element.
      type: string
    - contextPath: Lastline.Submission.Process
      description: Information on the Windows process.
      type: Unknown
    - contextPath: Lastline.Submission.Process.arguments
      description: The argument of the process.
      type: string
    - contextPath: Lastline.Submission.Process.executable
      description: The executable of the process.
      type: Unknown
    - contextPath: Lastline.Submission.Process.executable.abs_path
      description: The absolute path of the executable of the process.
      type: string
    - contextPath: Lastline.Submission.Process.executable.yara_signature_hits
      description: The Yara signature of the executable of the process.
      type: string
    - contextPath: Lastline.Submission.Process.executable.ext_info
      description: The executable information of the process.
      type: unknown
    - contextPath: Lastline.Submission.Process.process_id
      description: The process ID.
      type: string
  - arguments:
    - description: The entry ID of the file to upload.
      name: EntryID
      required: true
    - defaultValue: '70'
      description: The score threshold that determines if the file is malicious. The default value is "70".
      name: threshold
    description: Submits a file for analysis.
    name: lastline-upload-file
    outputs:
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: string
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: string
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: string
    - contextPath: File.Type
      description: The file type.
      type: string
    - contextPath: File.Malicious.Vendor
      description: The vendor who determined that the file is malicious.
      type: string
    - contextPath: File.Malicious.Description
      description: The reason that the vendor determined that the file is malicious.
      type: string
    - contextPath: File.Malicious.Score
      description: The score the malicious file received from the vendor.
      type: number
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: string
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: string
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: string
    - contextPath: DBotScore.Score
      description: The actual score.
      type: number
    - contextPath: Lastline.Submission.Status
      description: The status of the submission.
      type: string
    - contextPath: Lastline.Submission.UUID
      description: The task UUID.
      type: string
    - contextPath: Lastline.Submission.SubmissionTime
      description: The submission timestamp in Lastline.
      type: string
    - contextPath: Lastline.Submission.YaraSignatures.name
      description: Yara signatures name.
      type: string
    - contextPath: Lastline.Submission.YaraSignatures.score
      description: The score according to the Yara signatures (0 to 100).
      type: number
    - contextPath: Lastline.Submission.YaraSignatures.internal
      description: Whether the signature is for internal use only.
      type: boolean
    - contextPath: Lastline.Submission.DNSqueries
      description: A list of DNS queries executed by the analysis subject.
      type: string
    - contextPath: Lastline.Submission.NetworkConnections
      description: A list of network connections executed by the analysis subject.
      type: string
    - contextPath: Lastline.Submission.DownloadedFiles
      description: A list of files that were downloaded using the Microsoft Windows file-download API functions. Each element is a tuple of file-origin URL and a File element.
      type: string
    - contextPath: Lastline.Submission.Process
      description: Information on the Windows process.
      type: Unknown
    - contextPath: Lastline.Submission.Process.arguments
      description: The argument of the process.
      type: string
    - contextPath: Lastline.Submission.Process.executable
      description: The executable of the process.
      type: Unknown
    - contextPath: Lastline.Submission.Process.executable.abs_path
      description: The absolute path of the executable of the process.
      type: string
    - contextPath: Lastline.Submission.Process.executable.filename
      description: The filename of the executable.
      type: string
    - contextPath: Lastline.Submission.Process.executable.yara_signature_hits
      description: The Yara signature of the executable of the process.
      type: string
    - contextPath: Lastline.Submission.Process.executable.ext_info
      description: The executable information of the process.
      type: unknown
    - contextPath: Lastline.Submission.Process.process_id
      description: The process ID.
      type: string
  - arguments:
    - description: The task UUID of the submitted Lastline analysis.
      name: uuid
      required: true
    - description: The score threshold that determines if the file is malicious. The default value is "70".
      name: threshold
    description: Returns an analysis report.
    name: lastline-get-report
    outputs:
    - contextPath: URL.Data
      description: A list of malicious URLs identified by the Lastline analysis.
      type: string
    - contextPath: URL.Malicious.Vendor
      description: The vendor that determined a URL is malicious.
      type: string
    - contextPath: URL.Malicious.Description
      description: The reason that the vendor determined that the URL is malicious.
      type: string
    - contextPath: URL.Malicious.Score
      description: The score that the malicious URL received from the vendor.
      type: number
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: string
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: string
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: string
    - contextPath: File.Type
      description: The file type.
      type: string
    - contextPath: File.Malicious.Vendor
      description: The vendor that determined a file is malicious.
      type: string
    - contextPath: File.Malicious.Description
      description: The reason that the vendor determined that the file is malicious.
      type: string
    - contextPath: File.Malicious.Score
      description: The score that the malicious file received from the vendor.
      type: number
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: string
    - contextPath: DBotScore.Type
      description: The type of indicator.
      type: string
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: string
    - contextPath: DBotScore.Score
      description: The actual score.
      type: number
    - contextPath: Lastline.Submission.Status
      description: Status of the submission.
      type: string
    - contextPath: Lastline.Submission.UUID
      description: The task UUID.
      type: string
    - contextPath: Lastline.Submission.SubmissionTime
      description: The timestamp in Lastline.
      type: string
    - contextPath: Lastline.Submission.YaraSignatures.name
      description: Yara signatures name.
      type: string
    - contextPath: Lastline.Submission.YaraSignatures.score
      description: The score according to the Yara signatures (0 to 100).
      type: number
    - contextPath: Lastline.Submission.YaraSignatures.internal
      description: Whether the signature is for internal use only.
      type: boolean
    - contextPath: Lastline.Submission.DNSqueries
      description: A list of DNS queries executed by the analysis subject.
      type: string
    - contextPath: Lastline.Submission.NetworkConnections
      description: A list of network connections executed by the analysis subject.
      type: string
    - contextPath: Lastline.Submission.DownloadedFiles
      description: A list of files that were downloaded using the Microsoft Windows file-download API functions. Each element is a tuple of file-origin URL and a File element.
      type: string
    - contextPath: Lastline.Submission.Process
      description: Information on the Windows process.
      type: Unknown
    - contextPath: Lastline.Submission.Process.arguments
      description: The argument of the process.
      type: string
    - contextPath: Lastline.Submission.Process.executable
      description: The executable of the process.
      type: Unknown
    - contextPath: Lastline.Submission.Process.executable.abs_path
      description: The absolute path of the executable of the process.
      type: string
    - contextPath: Lastline.Submission.Process.executable.filename
      description: The filename of the executable.
      type: string
    - contextPath: Lastline.Submission.Process.executable.yara_signature_hits
      description: The Yara signature of the executable of the process.
      type: string
    - contextPath: Lastline.Submission.Process.executable.ext_info
      description: The executable information of the process.
      type: unknown
    - contextPath: Lastline.Submission.Process.process_id
      description: The process ID.
      type: string
  - arguments:
    - description: Return tasks before this date (in UTC format %Y-%m-%dT%H:%M:%S). For example, 2018-07-08T12:00:00.
      name: before
    - description: Return tasks after this date (in UTC format %Y-%m-%dT%H:%M:%S). For example, 2018-07-10T12:00:00.
      name: after
      required: true
    description: Returns a list of tasks.
    name: lastline-get-task-list
  - arguments:
    - description: The task UUID of the submitted Lastline analysis.
      isArray: true
      name: uuid
      required: true
    description: Checks the status of a submission.
    name: lastline-check-status
    outputs:
    - contextPath: URL.Data
      description: A list of malicious URLs identified by the lastline analysis.
      type: string
    - contextPath: URL.Malicious.Vendor
      description: The vendor that determined that a URL is malicious.
      type: string
    - contextPath: URL.Malicious.Description
      description: The reason that the vendor determined that the URL is malicious.
      type: string
    - contextPath: URL.Malicious.Score
      description: The score that the malicious URL received from the vendor.
      type: number
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: string
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: string
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: string
    - contextPath: File.Type
      description: The file type.
      type: string
    - contextPath: File.Malicious.Vendor
      description: The vendor that determined that the file is malicious.
      type: string
    - contextPath: File.Malicious.Description
      description: The reason that the vendor determined that the file is malicious.
      type: string
    - contextPath: File.Malicious.Score
      description: The score that the malicious file received from the vendor.
      type: number
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: string
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: string
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: string
    - contextPath: DBotScore.Score
      description: The actual score.
      type: number
    - contextPath: Lastline.Submission.Status
      description: The status of the submission.
      type: string
    - contextPath: Lastline.Submission.UUID
      description: The task UUID.
      type: string
    - contextPath: Lastline.Submission.SubmissionTime
      description: The timestamp in Lastline.
      type: string
    - contextPath: Lastline.Submission.YaraSignatures.name
      description: Yara signatures name.
      type: string
    - contextPath: Lastline.Submission.YaraSignatures.score
      description: The score according to the Yara signatures (0 to 100).
      type: number
    - contextPath: Lastline.Submission.YaraSignatures.internal
      description: Whether the signature is for internal use only.
      type: boolean
    - contextPath: Lastline.Submission.DNSqueries
      description: List of DNS queries executed by the analysis subject.
      type: string
    - contextPath: Lastline.Submission.NetworkConnections
      description: A list of network connections executed by the analysis subject.
      type: string
    - contextPath: Lastline.Submission.DownloadedFiles
      description: A list of files that were downloaded using the Microsoft Windows file-download API functions. Each element is a tuple of file-origin URL and a File element.
      type: string
    - contextPath: Lastline.Submission.Process
      description: Information on athe Windows process.
      type: Unknown
    - contextPath: Lastline.Submission.Process.arguments
      description: The argument of the process.
      type: string
    - contextPath: Lastline.Submission.Process.executable
      description: The executable of the process.
      type: Unknown
    - contextPath: Lastline.Submission.Process.executable.abs_path
      description: The absolute path of the executable of the process.
      type: string
    - contextPath: Lastline.Submission.Process.executable.filename
      description: The filename of the executable.
      type: string
    - contextPath: Lastline.Submission.Process.executable.yara_signature_hits
      description: The Yara signature of the executable of the process.
      type: string
    - contextPath: Lastline.Submission.Process.executable.ext_info
      description: The executable information of the process.
      type: unknown
    - contextPath: Lastline.Submission.Process.process_id
      description: The process ID.
      type: string
  dockerimage: demisto/python3:3.12.13.10116658
  runonce: false
  script: '-'
  type: python
  subtype: python3
tests:
- No tests
fromversion: 5.0.0