McAfee Advanced Threat Defense

Integrated advanced threat detection: Enhancing protection from network edge to endpoint.

Forensics & Malware Analysis · McAfee Advanced Threat Defense

Details

ID	`McAfee Advanced Threat Defense`
Provider	Trellix
Category	Forensics & Malware Analysis
From Version	5.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM EDR Cortex Cloud Cloud Runtime Security

README

Overview

Use the McAfee Advanced Threat Defense integration to enhance protection from network edge to endpoint and enable investigation.

This integration was integrated and tested with MATD Version 4.2.2.16.

McAfee Advanced Threat Defense Playbooks

This integration is used in the following Cortex XSOAR playbooks.

McAfee ATD - Detonate URL
McAfee ATD - Detonate File

Use cases

Add a file to the integrations war room.
Sample a file.
Get information on an old sample.
Send a URL sample to McAfee ATD.

Configure McAfee Advanced Threat Defense on Cortex XSOAR

Navigate to Settings > Integrations > Servers & Services.
Search for McAfee Advanced Threat Defense.
Click Add instance to create and configure a new integration instance.
- Name: a textual name for the integration instance.
- Server URL (e.g. https://192.168.0.1)
- Username
- Password
- Trust any certificate (not secure)
- Use system proxy settings
Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

Upload a file: atd-file-upload
Retrieve taskIDs: atd-get-task-ids
Download an analysis report: atd-get-report
Get a list of analyzer profiles: atd-list-analyzer-profiles
Get a list of all users: atd-list-user
Retrieve session details: atd-login
Detonate a file: detonate-file (deprecated)
Detonate a URL: detonate-url (deprecated)
Check a task's status: atd-check-status

1. Upload a file

Upload a file or Web URL for dynamic analysis using the specified Analyzer Profile. You can only submit a single file or Web URL in each command.

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.

Base Command

atd-file-upload

Input

Argument Name	Description	Required
vmProfileList	Analyzer profile ID. The profile ID number can be found in the UI Policy/Analyzer Profile page, OR using command atd-list-analyzer-profiles, under vmProfileid key result	Optional
submitType	This parameter accepts four values — '0', '1', '2' and '3'. • 0 — Regular file upload • 1 — URL submission — URL link is processed inside analyzer VM • 2 — Submit file with URL • 3 — URL Download — File from URL is firstly downloaded and then analyzed	Required
url	A valid URL	Optional
messageId	Maximum 128-character string.	Optional
srcIp	IPv4 address of the source system or gateway from where the file is downloaded.	Optional
dstIp	IPv4 address of the target endpoint.	Optional
skipTaskId	Value '0' indicates corresponding taskid in API response. Value '1' indicates -1 as taskid in API response.	Optional
analyzeAgain	Value '0' indicates skip sample analysis if it is analyzed previously . Value '1' indicates do not skip sample analysis if it is not analyzed previously.	Optional
xMode	Value '0' indicates no user interaction is needed during sample analysis. Value '1' indicates user interaction is needed during sample analysis.	Optional
filePriorityQ	This parameter indicates priority of sample analysis. run_now assigns highest priority (i.e., sample is analyzed right away), add_to_q puts sample in waiting state if there is a waiting queue of samples, default is run_now	Optional
entryID	entry ID f the file to upload	Optional
fileName	The name of the file	Optional

Context Output

Path	Type	Description
ATD.Task.taskId	number	Task ID of the uploaded sample
ATD.Task.jobId	number	Job ID of the uploaded sample
ATD.Task.messageId	string	The message ID relevant to the uploaded sample
ATD.Task.url	string	The URL that was detonated
ATD.Task.srcIp	string	Source IPv4 address
ATD.Task.destIp	string	Destination IPv4 address
ATD.Task.MD5	string	MD5 of the uploaded sample
ATD.Task.SHA1	string	SHA-1 of the uploaded sample
ATD.Task.SHA256	string	SHA-256 of the uploaded sample
ATD.taskId	number	The task ID of the uploaded sample

Command Example

!atd-file-upload submitType=1 analyzeAgain=1 filePriorityQ=run_now messageId="test the url of demisto" url="https://demisto.com"!atd-check-status jobId=[220,34]

Context Example

{  
   root:{  

   }   7   items estimatedTime:0   fileId:   just testing filesWait:0   mimeType:   application/url results:[  

   ]   1   item 0:{  

   }   12   items cache:0   destIp:null   file:   https:   //demisto.com md5:   xxx messageId:   sha1:   sha256:   size:19   srcIp:   submitType:1   taskId:388   url:   https:   //demisto.com subId:385   success:true
}

Human Readable Output

2. Retrieve taskIds

fetches the list of task id's associated with a job id

Base Command

atd-get-task-ids

Input

Argument Name	Description	Required
jobId	Unique identifier for the previously submitted file	Required

Context Output

Path	Type	Description
ATD.Task.jobId	number	taskId that corresponds to the jobId that was sent
ATD.Task.jobId	number	The jobId that was sent

Command Example

!atd-get-taskids jobId=${ATD.Task.jobId}M
!atd-get-taskids jobId=[220,34]

Context Example

{  
   root:[  

   ]   2   items 0:{  

   }   2   items result:{  

   }   1   item taskIdList:220   success:true   1:{  

   }   2   items result:{  

   }   1   item taskIdList:221   success:true
}

Human Readable Output

3. Download an analysis report

Downloads the analysis report for a specific task.

Base Command

atd-get-report

Input

Argument Name	Description	Required
taskId	The returned taskId value in the submission step, previously returned value in the File/URL submission step	Optional
jobId	Job ID	Optional
type	html — HTML report txt — Text report xml — XML report zip — All files packaged in a single zip file json — Same as XML but in JSON format ioc - Indicators of Compromise format stix - Structured Threat Information expression. By default, Stix generation is disabled. Use set stixreportstatus enable to enable it. pdf - Portable Document Format sample - Download sample from McAfee Advanced Threat Defense	Required
threshold	ATD severity (if exceeded, the file is considered malicious)	Optional

Context Output

Path	Type	Description
File.Name	string	Filename (only if the report type is JSON)
File.Type	string	File type, for example "PE" (only if the report type is JSON)
File.Size	number	File size (only if the report type is JSON)
File.MD5	string	MD5 hash of the file (only if the report type is JSON)
File.SHA1	string	SHA-1 hash of the file (only if the report type is JSON)
File.SHA256	string	SHA-256 hash of the file (only if the report type is JSON)
File.Malicious.Vendor	string	For malicious files, the vendor that made the decision
File.Malicious.Description	string	For malicious files, the reason for the vendor to make the decision
DBotScore.Indicator	string	The indicator we tested (only if the report type is JSON)
DBotScore.Type	string	The type of the indicator (only if the report type is JSON)
DBotScore.Vendor	string	Vendor used to calculate the score (only if the report type is JSON)
DBotScore.Score	number	The actual score (only if the report type is JSON)
File.EntryID	string	Entry ID of the sample
IP.Address	string	IPs relevant to the sample
InfoFile.EntryID	string	EntryID of the report file
InfoFile.Extension	string	Extension of the report file
InfoFile.Name	string	The name of the report file, which you can use later, for example, to send the report in an email as part of a playbook task. The report name is the the taskId, for example, 7173.pdf.
InfoFile.Info	string	Information for the report file
InfoFile.Size	number	Size of the report file
InfoFile.Type	string	Type of the report file

Command Example

!atd-get-report taskId=391 type=json

Context Example

{  
   root:{  

   }   1   item Summary:{  

   }   20   items Bait:   Baitexe activated but not infected Behavior:[  

   ]   15   items 0:   Identified as --- by Gateway Anti-Malware 1:   Identified as --- by GTI File Reputation 2:   Identified as --- by GTI URL Reputation 3:   Identified as --- by Anti-Malware 4:   Altered Web Proxy Auto-Discovery Protocol (WPAD) for rerouting of the network traffic 5:   Modified time attribute of the specified file after its creation 6:   Modified file's time creation attributes 7:   Hid content by modifying its attributes 8:   Downloaded data from a webserver 9:   Modified INTERNET_OPTION_CONNECT_RETRIES:   number of times that WinInet attempts to resolve and connect to a host 10:   Connected to a specific service provider 11:   Manipulated an existing Windows service by its handle 12:   Created named mutex object 13:   Obtained user's logon name 14:   Set a filter function to supersede the top-level exception handler ( http:   //msdn.microsoft.com/en-us/library/vstudio/x85tt0dd.aspx ) DETversion:4.2   .0.171220 Data:{  

   }   3   items analysis_seconds:66   compiled_with:   Not Available sandbox_analysis:5   Environment:[  

   ]   6   items 0:Microsoft Windows 7 Professional Service Pack 1 (build 7601,
   version 6.1.7601),
   64-   bit 1:   Internet Explorer version:8.0   .7601.17514 2:   Microsoft Office version:2010   3:   PDF Reader version:9.0   4:   Flash player version:14.0   .0.145 5:   Flash player plugin version:14.0   .0.145 Files:[  

   ]   1   item 0:{  

   }   6   items FileType:0   Md5:   Name:   iexplore.exe Processes:[  

   ]   1   item Sha1:   Sha256:   Ips:[  

   ]   1   item JSONversion:1.002   MISversion:4.2   .0.22 OSversion:   win7sp1x64 Process:[  

   ]   1   item 0:{  

   }   3   items Name:   https:   //demisto.com Reason:   loaded by MATD Analyzer Severity:2   Processes:[  

   ]   1   item SUMversion:4.2   .0.22 Selectors:[  

   ]   5   items 0:{  

   }   3   items Engine:   Gateway Anti-Malware MalwareName:   --- Severity:0   1:{  

   }   3   items Engine:   GTI File Reputation MalwareName:   --- Severity:0   2:{  

   }   3   items Engine:   GTI URL Reputation MalwareName:   --- Severity:-1   3:{  

   }   3   items Engine:   Anti-Malware MalwareName:   --- Severity:0   4:{  

   }   3   items Engine:   Sandbox MalwareName:   --- Severity:2   Stats:[  

   ]   7   items 0:{  

   }   3   items Category:Persistence,
   Installation Boot Survival ID:0   Severity:2   1:{  

   }   3   items Category:Hiding,
   Camouflage,
   Stealthiness,
   Detection and Removal Protection ID:1   Severity:2   2:{  

   }   3   items Category:Security Solution / Mechanism bypass,
   termination and removal,
   Anti Debugging,
   VM Detection ID:2   Severity:2   3:{  

   }   3   items Category:   Spreading ID:3   Severity:2   4:{  

   }   3   items Category:Exploiting,
   Shellcode ID:4   Severity:0   5:{  

   }   3   items Category:   Networking ID:5   Severity:2   6:{  

   }   3   items Category:Data spying,
   Sniffing,
   Keylogging,
   Ebanking Fraud ID:6   Severity:0   Subject:{  

   }   9   items FileType:4096   Name:   https:   //demisto.com Timestamp:2018-05   -28   03:24:19   Type:   application/url md5:   xxxx parent_archive:   Not Available sha-1:   xxxxx sha-256:   xxxxxx size:19   URL_Reputation:[  

   ]   4   items 0:{  

   }   7   items category:   --- functional:   --- port:443   reputation:   Clean risk:   --- severity:-1   url:31.152   .142.194 1:{  

   }   7   items category:   Business functional:   Business/Services port:80   reputation:   Clean risk:   Information severity:-1   url:   DEMISTO.COM 2:{  

   }   7   items category:   Business functional:   Business/Services port:80   reputation:   Clean risk:   Information severity:-1   url:   HTTPS:   //DEMISTO.COM 3:{  

   }   7   items category:   --- functional:   --- port:80   reputation:   Failed risk:   --- severity:-2   url:   WIN-K0RA93TITV8 Urls:[  

   ]   3   items 0:{  

   }   8   items Category:   Business Functional:   Business/Services Port:80   Processes:[  

   ]   1   item 0:{  

   }   3   items Name:   iexplore.exe RelType:8   Sha256:   Reputation:0   Risk:   Information Severity:-1   Url:   DEMISTO.COM 1:{  

   }   8   items Category:   Business Functional:   Business/Services Port:80   Processes:[  

   ]   1   item 0:{  

   }   3   items Name:   iexplore.log RelType:8   Sha256:   Reputation:0   Risk:   Information Severity:-1   Url:   HTTPS:   //DEMISTO.COM 2:{  

   }   8   items Category:   --- Functional:   --- Port:80   Processes:[  

   ]   1   item 0:{  

   }   3   items Name:   iexplore.exe RelType:8   Sha256:   Reputation:15   Risk:   --- Severity:-2   Url:   WIN-K0RA93TITV8 Verdict:{  

   }   2   items Description:   Sample is somewhat suspicious:   final severity level 2 Severity:2   hasDynamicAnalysis:true
}

Human Readable Output

4. Get a list of analyzer profiles

Displays a list of analyzer profiles. Only the analyzer profiles that the user has access to are displayed.

Base Command

atd-list-analyzer-profiles

Input

There are no arguments for this command.

Context Output

Path	Type	Description
ATD.ListAnalyzerProfiles.Name	string	Analyzer's profile name
ATD.ListAnalyzerProfiles.AnalyzerProfileId	number	Analyzer's profile ID
ATD.ListAnalyzerProfiles.Description	string	Analyzer's profile description
ATD.ListAnalyzerProfiles.Sandbox	boolean	Whether the Analyzer's profile has access to the sandbox
ATD.ListAnalyzerProfiles.Internet	boolean	Whether the Analyzer's profile has access to the internet
ATD.ListAnalyzerProfiles.LocalBlackList	boolean	Whether the Analyzer's profile has access to the local block list

Command Example

!atd-list-analyzer-profiles

Context Example

{  
   results:[  

   ]   4   items 0:{  

   }   55   items artimas:0   asm:0   aviraAV:0   consoleLog:0   createTime:2012-12   -01   02:16:01   customrules:0   default32OSName:   default64OSName:   defaultVM:0   dnnEnable:0   dropZip:0   dumpZip:0   family:0   filePassword:   filePassword1:   flp:0   gam:1   gml:0   gtiTS:1   gtiURLRep:0   heuristic:0   imageid:0   internet:0   lastChange:null   locBlackList:1   locWhiteList:0   logZip:0   maxExecTime:180   mfeAV:1   minExecTime:5   name:   xxxxxxxxxxxx netLog:0   netdriveZip:0   noPDF:0   ntvLog:0   openarchive:1   overrideOS:0   pe32:0   reAnalysis:1   recusiveAnalysis:0   runtimeArgument:   sandbox:0   selectedOSName:   sophosAV:0   ssAPIid:1   ssKeyid:1   ssLevelid:1   summary:1   userLog:0   userid:   xx vmDesc:   Only Down Selectors vmProfileid:   xx xMode:0   yaraScan:0   yararules:0   1:{  

   }   55   items artimas:0   asm:0   aviraAV:0   consoleLog:0   createTime:2018-01   -02   05:28:39   customrules:0   default32OSName:   default64OSName:   defaultVM:0   dnnEnable:0   dropZip:0   dumpZip:0   family:0   filePassword:   filePassword1:   flp:0   gam:1   gml:0   gtiTS:1   gtiURLRep:0   heuristic:0   imageid:0   internet:0   lastChange:2018-01   -02   05:28:39   locBlackList:0   locWhiteList:1   logZip:0   maxExecTime:0   mfeAV:1   minExecTime:0   name:   xxxxxxxxxx netLog:0   netdriveZip:0   noPDF:0   ntvLog:0   openarchive:1   overrideOS:0   pe32:0   reAnalysis:1   recusiveAnalysis:0   runtimeArgument:   sandbox:0   selectedOSName:   sophosAV:0   ssAPIid:0   ssKeyid:0   ssLevelid:0   summary:1   userLog:0   userid:   xx vmDesc:   vmProfileid:   xx xMode:0   yaraScan:0   yararules:0
}

Human Readable Output

5. Get a list of all users

Displays profile information for all McAfee Advanced Threat Defense users.

Base Command

atd-list-user

Input

Argument Name	Description	Required
userType	User type associated with a user profile. For example NSP, MWG, STAND_ALONE (default), and so on.	Optional

Context Output

Path	Type	Description
ATD.Users.FullName	string	User's full name
ATD.Users.UserId	number	User's ID
ATD.Users.LoginId	string	User's login ID
ATD.Users.UserType	string	User type

Command Example

!atd-list-user
!atd-list-user userType="NSP"

Context Example

{  
   root:{  

   }   2   items results:[  

   ]   3   items 0:{  

   }   4   items fullName:   xxxxxxx idx:   xxxx loginId:   xxxxxx userType:   STAND_ALONE 1:{  

   }   4   items fullName:   xxxxxx idx:   xxx loginId:   xxxxxxxx userType:   STAND_ALONE 2:{  

   }   4   items fullName:   xxxxx idx:   xxx loginId:   xxxxx userType:   STAND_ALONE success:true
}

Human Readable Output

6. Retrieve session details.

Returns details for the current session.

Base Command

atd-login

Input

There are no arguments for this command.

Context Output

Path	Type	Description
ATD.Session.APIVersion	string	The API version used in the session
ATD.Session.IsAdmin	boolean	Whether the current user is an admin
ATD.Session.SessionId	string	Session ID
ATD.Session.UserId	number	The UserId of the user logged in to the session

Command Example

!atd-login

Context Example

{  
   apiVersion:1.5   .0 isAdmin:1   matdVersion:4.2   .0.22 serverTZ:   PDT session:   xxxxxxxxxxxxxxxx userId:xxx
}

Human Readable Output

7. Detonate a file (deprecated)

Deprecated, use the McAfee ATD Detonate File playbook.

Base Command

detonate-file

Input

Argument Name	Description	Required
upload	ID of the entry that contains the file to detonate	Required
timeout	Total wait time (in seconds)	Optional
format	Report format type	Optional
threshold	ATD severity (if exceeded, the file is considered malicious)	Optional
fileName	File name	Optional

Context Output

Path	Type	Description
InfoFile.Name	string	File name (only if the report type is JSON)
InfoFile.Type	string	File type, for example "PE" (only if the report type is JSON)
InfoFile.Size	number	File size (only in case of report type=json)
InfoFile.MD5	string	MD5 hash of the file (only if the report type is JSON)
InfoFile.SHA1	string	SHA-1 hash of the file (only if the report type is JSON)
InfoFile.SHA256	string	SHA-256 hash of the file (only if the report type is JSON)
InfoFile.Malicious.Vendor	string	For malicious files, the vendor that made the decision
InfoFile.Malicious.Description	string	For malicious files, the reason that the vendor made the decision
DBotScore.Indicator	string	The indicator that was tested (only if the report type is JSON)
DBotScore.Type	string	The type of the indicator (only if the report type is JSON)
DBotScore.Vendor	string	Vendor used to calculate the score (only if the report type is JSON)
DBotScore.Score	number	The actual score (only if the report type is JSON)
ATD.Task.taskId	number	The returned TaskId value in the submission step, previously returned value in the File/URL submission step
ATD.Task.jobId	number	The returned JobId value in the submission step, previously returned value in the File/URL submission step
ATD.Task.status	string	The task ID status (Completed or Analyzing)
ATD.Task.messageId	string	The message ID relevant to the uploaded sample
ATD.Task.url	string	The detonated URL
ATD.Task.srcIp	string	Source IPv4 address
ATD.Task.destIp	string	Destination IPv4 address
ATD.Task.MD5	string	MD5 of the uploaded sample
ATD.Task.SHA256	string	SHA-256 of the uploaded sample
ATD.Task.SHA1	string	SHA-1 of the uploaded sample
IP.Address	string	IPs relevant to the sample

Command Example

!detonate-file upload=${File.EntryID} format=json timeout=240 threshold = 4

Context Example

{  
   root:{  

   }   1   item Summary:{  

   }   12   items Behavior:[  

   ]   3   items 0:   Identified as --- by Gateway Anti-Malware 1:   Identified as --- by GTI File Reputation 2:   Identified as --- by Anti-Malware DETversion:4.2   .0.171220 Data:{  

   }   3   items analysis_seconds:1   compiled_with:   Not Available sandbox_analysis:0   JSONversion:1.002   MISversion:4.2   .0.22 OSversion:   StaticAnalysis Process:[  

   ]   1   item 0:{  

   }   3   items Name:   cd.exe Reason:   processed by down selectors Severity:-1   SUMversion:4.2   .0.22 Selectors:[  

   ]   4   items 0:{  

   }   3   items Engine:   Gateway Anti-Malware MalwareName:   --- Severity:0   1:{  

   }   3   items Engine:   GTI File Reputation MalwareName:   --- Severity:-1   2:{  

   }   3   items Engine:   Anti-Malware MalwareName:   --- Severity:0   3:{  

   }   3   items Engine:   Sandbox MalwareName:   --- Severity:0   Subject:{  

   }   9   items FileType:0   Name:   cd.exe Timestamp:2018-05   -28   04:40:22   Type:   PE32 executable (GUI) Intel 80386 md5:291   C213253332BB1B4B40080C9E9DE69 parent_archive:   Not Available sha-1:9   B8D214A558A60DAA461E388B7CAF8758C364A52 sha-256:60769   CE0928C5CED45DB71DDED5A6FD4DB6596BC52C3AC549EEBC7A385FC3D77 size:10240   Verdict:{  

   }   2   items Description:   Sample is clean according to the GTI's File Reputation Severity:-1   hasDynamicAnalysis:false
}

Human Readable Output

8. Detonate a URL (deprecated)

Deprecated, use the McAfee ATD Detonate URL playbook.

Base Command

detonate-url

Input

Argument Name	Description	Required
url	URL to detonate	Required
timeout	Total wait time (in seconds)	Optional
format	Report format type	Optional
threshold	ATD severity (if exceeded, the file is considered malicious)	Optional

Context Output

Path	Type	Description
InfoFile.Name	string	File name (only if the report type is JSON)
InfoFile.Type	string	File type, for example "PE" (only if the report type is JSON)
InfoFile.Size	number	File size (only if the report type is JSON)
InfoFile.MD5	string	MD5 hash of the file (only if the report type is JSON)
InfoFile.SHA1	string	SHA-1 hash of the file (only if the report type is JSON)
InfoFile.SHA256	string	SHA-256 hash of the file (only if the report type is JSON)
InfoFile.Malicious.Vendor	string	For malicious files, the vendor that made the decision
InfoFile.Malicious.Description	string	For malicious files, the reason that the vendor made the decision
DBotScore.Indicator	string	The indicator that was tested (only if the report type is JSON)
DBotScore.Type	string	The type of the indicator (only if the report type is JSON)
DBotScore.Vendor	string	Vendor used to calculate the score (only if the report type is JSON)
DBotScore.Score	number	The actual score (only if the report type is JSON)
ATD.Task.taskId	number	The returned TaskId value in the submission step, previously returned value in the File/URL submission step
ATD.Task.jobId	number	The returned JobId value in the submission step, previously returned value in the File/URL submission step
ATD.Task.status	string	The task ID status (Completed or Analyzing)
ATD.Task.messageId	string	The message ID relevant to the uploaded sample
ATD.Task.url	string	The detonated URL
ATD.Task.srcIp	string	Source IPv4 address
ATD.Task.destIp	string	Destination IPv4 address
ATD.Task.MD5	string	MD5 of the uploaded sample
ATD.Task.SHA256	string	SHA-256 of the uploaded sample
ATD.Task.SHA1	string	SHA-1 of the uploaded sample
IP.Address	string	IPs relevant to the sample

Command Example

!atd!detonate-url url="https://mcafee.com" format=jsonlist-user

Context Example

{  
   Summary:{  

   }   20   items Bait:   Baitexe activated but not infected Behavior:[  

   ]   15   items 0:   Identified as --- by Gateway Anti-Malware 1:   Identified as --- by GTI File Reputation 2:   Identified as --- by GTI URL Reputation 3:   Identified as --- by Anti-Malware 4:   Altered Web Proxy Auto-Discovery Protocol (WPAD) for rerouting of the network traffic 5:   Modified time attribute of the specified file after its creation 6:   Modified file's time creation attributes 7:   Hid content by modifying its attributes 8:   Downloaded data from a webserver 9:   Modified INTERNET_OPTION_CONNECT_RETRIES:   number of times that WinInet attempts to resolve and connect to a host 10:   Connected to a specific service provider 11:   Manipulated an existing Windows service by its handle 12:   Created named mutex object 13:   Obtained user's logon name 14:   Set a filter function to supersede the top-level exception handler ( http:   //msdn.microsoft.com/en-us/library/vstudio/x85tt0dd.aspx ) DETversion:4.2   .0.171220 Data:{  

   }   3   items analysis_seconds:66   compiled_with:   Not Available sandbox_analysis:5   Environment:[  

   ]   6   items 0:Microsoft Windows 7 Professional Service Pack 1 (build 7601,
   version 6.1.7601),
   64-   bit 1:   Internet Explorer version:8.0   .7601.17514 2:   Microsoft Office version:2010   3:   PDF Reader version:9.0   4:   Flash player version:14.0   .0.145 5:   Flash player plugin version:14.0   .0.145 Files:[  

   ]   1   item 0:{  

   }   6   items FileType:0   Md5:   Name:   iexplore.exe Processes:[  

   ]   1   item Sha1:   Sha256:   Ips:[  

   ]   1   item JSONversion:1.002   MISversion:4.2   .0.22 OSversion:   win7sp1x64 Process:[  

   ]   1   item 0:{  

   }   3   items Name:   https:   //demisto.com Reason:   loaded by MATD Analyzer Severity:2   Processes:[  

   ]   1   item SUMversion:4.2   .0.22 Selectors:[  

   ]   5   items 0:{  

   }   3   items Engine:   Gateway Anti-Malware MalwareName:   --- Severity:0   1:{  

   }   3   items Engine:   GTI File Reputation MalwareName:   --- Severity:0   2:{  

   }   3   items Engine:   GTI URL Reputation MalwareName:   --- Severity:-1   3:{  

   }   3   items Engine:   Anti-Malware MalwareName:   --- Severity:0   4:{  

   }   3   items Engine:   Sandbox MalwareName:   --- Severity:2   Stats:[  

   ]   7   items 0:{  

   }   3   items Category:Persistence,
   Installation Boot Survival ID:0   Severity:2   1:{  

   }   3   items Category:Hiding,
   Camouflage,
   Stealthiness,
   Detection and Removal Protection ID:1   Severity:2   2:{  

   }   3   items Category:Security Solution / Mechanism bypass,
   termination and removal,
   Anti Debugging,
   VM Detection ID:2   Severity:2   3:{  

   }   3   items Category:   Spreading ID:3   Severity:2   4:{  

   }   3   items Category:Exploiting,
   Shellcode ID:4   Severity:0   5:{  

   }   3   items Category:   Networking ID:5   Severity:2   6:{  

   }   3   items Category:Data spying,
   Sniffing,
   Keylogging,
   Ebanking Fraud ID:6   Severity:0   Subject:{  

   }   9   items FileType:4096   Name:   https:   //demisto.com Timestamp:2018-05   -28   03:24:19   Type:   application/url md5:   xxxx parent_archive:   Not Available sha-1:   xxxxx sha-256:   xxxxxx size:19   URL_Reputation:[  

   ]   4   items 0:{  

   }   7   items category:   --- functional:   --- port:443   reputation:   Clean risk:   --- severity:-1   url:31.152   .142.194 1:{  

   }   7   items category:   Business functional:   Business/Services port:80   reputation:   Clean risk:   Information severity:-1   url:   DEMISTO.COM 2:{  

   }   7   items category:   Business functional:   Business/Services port:80   reputation:   Clean risk:   Information severity:-1   url:   HTTPS:   //DEMISTO.COM 3:{  

   }   7   items category:   --- functional:   --- port:80   reputation:   Failed risk:   --- severity:-2   url:   WIN-K0RA93TITV8 Urls:[  

   ]   3   items 0:{  

   }   8   items Category:   Business Functional:   Business/Services Port:80   Processes:[  

   ]   1   item 0:{  

   }   3   items Name:   iexplore.exe RelType:8   Sha256:   Reputation:0   Risk:   Information Severity:-1   Url:   DEMISTO.COM 1:{  

   }   8   items Category:   Business Functional:   Business/Services Port:80   Processes:[  

   ]   1   item 0:{  

   }   3   items Name:   iexplore.log RelType:8   Sha256:   Reputation:0   Risk:   Information Severity:-1   Url:   HTTPS:   //DEMISTO.COM 2:{  

   }   8   items Category:   --- Functional:   --- Port:80   Processes:[  

   ]   1   item 0:{  

   }   3   items Name:   iexplore.exe RelType:8   Sha256:   Reputation:15   Risk:   --- Severity:-2   Url:   WIN-K0RA93TITV8 Verdict:{  

   }   2   items Description:   Sample is somewhat suspicious:   final severity level 2 Severity:2   hasDynamicAnalysis:true
}

Human Readable Output

9. Check a task's status

Checks the analysis status of up to 100 jobIDs/taskIDs

Base Command

atd-check-status

Input

Argument Name	Description	Required
taskId	The returned TaskId value in the submission step, previously returned value in the File/URL submission step	Optional
jobId	Job ID	Optional

Context Output

Path	Type	Description
ATD.status	string	The task ID status (Completed or Analyzing)
ATD.Task.taskId	number	This is the returned TaskId value in the submission step, previously returned value in the File/URL submission step
ATD.Task.jobId	number	The returned JobId value in the submission step, previously returned value in the File/URL submission step
ATD.Task.status	string	The task ID status (Completed or Analyzing)
ATD.Task.filename	string	The name of the uploaded sample
ATD.Task.MD5	string	MD5 of the sample
ATD.Task.submitTime	string	Time the sample was submitted

Command Examples

!atd-check-status taskId=${ATD.Task.taskId}
!atd-check-status jobId=[220,34]

Context Example

{  
   root:[  

   ]   2   items 0:{  

   }   16   items PEInfo:0   asmListing:0   family:0   filename:   xxxxxxx istate:1   jobid:218   md5:   xxxxxxxxxxxxxxxxxxx status:   Completed submitTime:2018-05   -08   03:56:34   summaryFiles:1   taskid:220   useLogs:0   userid:1   vmDesc:   vmName:   xxxxxxxxxxxxx vmProfile:   xx 1:{  

   }   16   items PEInfo:0   asmListing:0   family:0   filename:   xxxxx istate:1   jobid:219   md5:   xxxxxxxxxxxxxxxxx status:   Completed submitTime:2018-05   -12   19:23:33   summaryFiles:1   taskid:221   useLogs:0   userid:1   vmDesc:   vmName:   xxxxxxxx vmProfile:xx
}

Human Readable Output

Configuration parameters

baseUrl — Server URL (e.g. https://192.168.0.1) (required)
credentials — Username
unsecure — Trust any certificate (not secure)
proxy — Use system proxy settings
username — Username (Deprecated)
password — Password (Deprecated)

Commands (9)

atd-check-status
Checks the analysis status of up to 100 jobIDs/taskIDs.
atd-file-upload
upload a file/web URL for dynamic analysis by using the provided Analyzer Profile. Only single file/web URL can be submitted at a time.
atd-get-report
Download the analysis report files. The `Sample Download Access` permission is required.
atd-get-task-ids
fetches the list of task id's associated with a job id.
atd-list-analyzer-profiles
display the analyzer profiles. Only the analyzer profiles to which the user has access are displayed.
atd-list-user
displays the user profile information present on the McAfee Advanced Threat Defense.
atd-login
Returns the current session details.
detonate-file
Deprecated, use detonate playbook instead.
detonate-url
Deprecated, use detonate playbook instead.

Source

McAfee_Advanced_Threat_Defense.py McAfee_Advanced_Threat_Defense_test.py McAfee_Advanced_Threat_Defense.yml McAfee_Advanced_Threat_Defense_description.md

Download History Raw

import tempfile

import demistomock as demisto
import pytest

integration_params = {"baseUrl": " http://demi.demi.com", "username": "bark", "password": "my_password"}

FILE_UPLOAD_ERROR_ONLY_ONE_ARG = "You must submit one and only one of the following: url, entryID"
FILE_UPLOAD_ERROR_MUST_GIVE_BOTH_ARGS = "When submitType is 2 You must submit both url and entryID"
FILE_UPLOAD_ERROR_WRONG_ARGS = (
    "In order to detonate a file submitType must be 0 "
    "and an entryID of a file must be given.\n"
    "In order to detonate a url submitType must be 1 or 3"
    " and a url must be given."
    "In order to submit file with a url submitType must be 2"
    " and both entryID and a url must be given."
)
FILE_UPLOAD_ERROR_INVALID_ARG = "This is not a valid submitType. Should be one of : 0, 1, 2, 3"


@pytest.fixture(autouse=True)
def set_params(mocker):
    mocker.patch.object(demisto, "params", return_value=integration_params)


@pytest.mark.parametrize(
    "args, expected_error",
    [
        ({"submitType": "2", "entryID": "entry_id"}, FILE_UPLOAD_ERROR_MUST_GIVE_BOTH_ARGS),
        ({"submitType": "2", "url": "url"}, FILE_UPLOAD_ERROR_MUST_GIVE_BOTH_ARGS),
        ({"submitType": "0", "entryID": "entry_id", "url": "url"}, FILE_UPLOAD_ERROR_ONLY_ONE_ARG),
        ({"submitType": "1", "entryID": "entry_id", "url": "url"}, FILE_UPLOAD_ERROR_ONLY_ONE_ARG),
        ({"submitType": "3", "entryID": "entry_id", "url": "url"}, FILE_UPLOAD_ERROR_ONLY_ONE_ARG),
        ({"submitType": "1", "entryID": "entry_id"}, FILE_UPLOAD_ERROR_WRONG_ARGS),
        ({"submitType": "3", "entryID": "entry_id"}, FILE_UPLOAD_ERROR_WRONG_ARGS),
        ({"submitType": "0", "url": "url"}, FILE_UPLOAD_ERROR_WRONG_ARGS),
        ({"submitType": "4"}, FILE_UPLOAD_ERROR_INVALID_ARG),
    ],
)
def test_handling_errors_with_file_upload_command(mocker, args, expected_error):
    """
    Given:
        submitType , submitType , url arguments

    When:
        Execute command atd-file-upload

    Then:
        Arguments' validation - returns error if one of the given
        arguments does not fit the command's structure
    """
    from McAfee_Advanced_Threat_Defense import handling_errors_with_file_upload_command

    mocker.patch.object(demisto, "results")
    with pytest.raises(SystemExit):
        handling_errors_with_file_upload_command(args)
    contents = demisto.results.call_args[0][0]
    assert contents["Contents"] == expected_error


@pytest.mark.parametrize(
    "given_url, expected_output",
    [
        ("google.com", "http://www.google.com"),
        ("http://www.google.com", "http://www.google.com"),
        ("www.google.com", "http://www.google.com"),
        ("", "http://www."),
    ],
)
def test_add_prefix_to_given_url(given_url, expected_output):
    """
    Given:
        url argument

    When:
        Execute command atd-file-upload with submitType that is one of : 1,2,3

    Then:
        Returns the given url argument with a prefix of http://
    """
    from McAfee_Advanced_Threat_Defense import add_prefix_to_given_url

    assert add_prefix_to_given_url(given_url) == expected_output


def test_prettify_current_user_res():
    from McAfee_Advanced_Threat_Defense import prettify_current_user_res

    expected_user_dict = {"APIVersion": "1.0", "IsAdmin": "True", "SessionId": "42", "UserId": 101}
    prettify_user_res = prettify_current_user_res({"apiVersion": "1.0", "isAdmin": "1", "session": "42", "userId": 101})
    assert expected_user_dict == prettify_user_res


def test_prettify_task_status_by_taskId_res():
    from McAfee_Advanced_Threat_Defense import prettify_task_status_by_task_id

    expected_rtask_status = {
        "taskId": "41",
        "jobId": "42",
        "status": "finished",
        "filename": "my_name",
        "MD5": "my_md5",
        "submitTime": "010101",
    }
    prettify_task_status_res = prettify_task_status_by_task_id(
        {"taskid": "41", "jobid": "42", "status": "finished", "filename": "my_name", "md5": "my_md5", "submitTime": "010101"}
    )
    assert expected_rtask_status == prettify_task_status_res


def test_get_report_command(mocker, requests_mock):
    """
    Given:
        - The script args.
    When:
        - Running get report command.
    Then:
        - Validating the outputs as expected.
    """
    from McAfee_Advanced_Threat_Defense import get_report_command

    mocker.patch.object(demisto, "args", return_value={"taskId": 1, "threshold": 1, "type": "json"})
    requests_mock.get(
        "http://demi.demi.com/php/samplestatus.php?iTaskId=1",
        json={
            "results": {
                "taskid": "1",
                "jobid": "1",
                "status": "Completed",
                "filename": "filename",
                "md5": "some_hash",
                "submitTime": "01.09.2022",
            }
        },
    )
    requests_mock.get(
        "http://demi.demi.com/php/showreport.php?iTaskId=1&iType=json",
        json={
            "Summary": {
                "Verdict": {"Description": "desc", "Severity": 5},
                "Subject": {
                    "Type": "application/url",
                    "md5": "some_hash",
                    "sha-1": "some_hash",
                    "sha-256": "some_hash",
                    "size": 50,
                    "Name": "name",
                    "FileType": "type",
                },
                "Ips": [{"Ipv4": "1.1.1.1"}],
            }
        },
    )
    results_mock = mocker.patch.object(demisto, "results")
    get_report_command()
    assert "McAfee ATD Sandbox Report" in results_mock.call_args[0][0]["HumanReadable"]


def test_detonate_file_command(mocker, requests_mock):
    """
    Given:
        - The script args.
    When:
        - Running detonate-file command.
    Then:
        - Validating the outputs as expected.
    """
    from McAfee_Advanced_Threat_Defense import detonate

    requests_mock.post(
        "http://demi.demi.com/php/fileupload.php?",
        json={
            "success": "True",
            "results": [
                {
                    "taskId": "1",
                    "messageId": "1",
                    "url": "url.com",
                    "status": "Completed",
                    "filename": "filename",
                    "md5": "some_hash",
                    "sha1": "some_hash",
                    "sha256": "some_hash",
                    "srcIp": "1.1.1.1",
                    "destIp": "1.1.1.1",
                    "submitTime": "01.09.2022",
                }
            ],
        },
    )
    requests_mock.get(
        "http://demi.demi.com/php/samplestatus.php?iTaskId=1",
        json={
            "results": {
                "taskid": "1",
                "jobid": "1",
                "status": "Completed",
                "filename": "filename",
                "md5": "some_hash",
                "submitTime": "01.09.2022",
            }
        },
    )
    requests_mock.get(
        "http://demi.demi.com/php/showreport.php?iTaskId=1&iType=json",
        json={
            "Summary": {
                "Verdict": {"Description": "desc", "Severity": 5},
                "Subject": {
                    "Type": "application/url",
                    "md5": "some_hash",
                    "sha-1": "some_hash",
                    "sha-256": "some_hash",
                    "size": 50,
                    "Name": "name",
                    "FileType": "type",
                },
                "Ips": [{"Ipv4": "1.1.1.1"}],
            }
        },
    )
    requests_mock.get(
        "http://demi.demi.com/php/showreport.php?iTaskId=1&iType=sample",
        json={"Summary": {"Verdict": {"Description": "desc", "Severity": 5}}},
    )
    results_mock = mocker.patch.object(demisto, "results")
    f = tempfile.TemporaryFile(mode="w")
    mocker.patch.object(demisto, "getFilePath", return_value={"path": f.name})
    detonate(0, "sample", "100", "sample", 1, "fileName")
    assert "1.zip" in results_mock.call_args[0][0]["File"]


def test_list_users_command(mocker, requests_mock):
    """
    Given:
        - The script args.
    When:
        - Running list_users command.
    Then:
        - Validating the outputs as expected.
    """
    from McAfee_Advanced_Threat_Defense import list_users_command

    mocker.patch.object(demisto, "args", return_value={"userType": "userType"})
    requests_mock.get(
        "http://demi.demi.com/php/briefUserList.php?userType=userType",
        json={"results": [{"fullName": "fullName", "idx": "idx", "loginId": "loginId", "userType": "userType"}]},
    )
    results_mock = mocker.patch.object(demisto, "results")
    list_users_command()
    assert "ATD User List" in results_mock.call_args[0][0]["HumanReadable"]


def test_detonate_url_command(mocker, requests_mock):
    """
    Given:
        - The script args.
    When:
        - Running detonate url command.
    Then:
        - Validating the outputs as expected.
    """
    from McAfee_Advanced_Threat_Defense import detonate

    requests_mock.post(
        "http://demi.demi.com/php/fileupload.php?",
        json={
            "success": "True",
            "results": [
                {
                    "taskId": "1",
                    "messageId": "1",
                    "url": "url.com",
                    "status": "Completed",
                    "filename": "filename",
                    "md5": "some_hash",
                    "sha1": "some_hash",
                    "sha256": "some_hash",
                    "srcIp": "1.1.1.1",
                    "destIp": "1.1.1.1",
                    "submitTime": "01.09.2022",
                }
            ],
        },
    )
    requests_mock.get(
        "http://demi.demi.com/php/samplestatus.php?iTaskId=1",
        json={
            "results": {
                "taskid": "1",
                "jobid": "1",
                "status": "Completed",
                "filename": "filename",
                "md5": "some_hash",
                "submitTime": "01.09.2022",
            }
        },
    )
    requests_mock.get(
        "http://demi.demi.com/php/showreport.php?iTaskId=1&iType=json",
        json={
            "Summary": {
                "Verdict": {"Description": "desc", "Severity": 5},
                "Subject": {
                    "Type": "application/url",
                    "md5": "some_hash",
                    "sha-1": "some_hash",
                    "sha-256": "some_hash",
                    "size": 50,
                    "Name": "name",
                    "FileType": "type",
                },
                "Ips": [{"Ipv4": "1.1.1.1"}],
            }
        },
    )
    requests_mock.get(
        "http://demi.demi.com/php/showreport.php?iTaskId=1&iType=pdf",
        json={"Summary": {"Verdict": {"Description": "desc", "Severity": 5}}},
    )
    results_mock = mocker.patch.object(demisto, "results")
    f = tempfile.TemporaryFile(mode="w")
    mocker.patch.object(demisto, "getFilePath", return_value={"path": f.name})
    detonate(1, "url.com", "100", "pdf", 1, "fileName")
    assert "1.pdf" in results_mock.call_args[0][0]["File"]


def test_list_profiles_command(mocker, requests_mock):
    """
    Given:
        - The script args.
    When:
        - Running list_profiles command.
    Then:
        - Validating the outputs as expected.
    """
    from McAfee_Advanced_Threat_Defense import list_profiles_command

    requests_mock.get(
        "http://demi.demi.com/php/vmprofiles.php",
        json={
            "results": [
                {"name": "name", "vmProfileid": "vmProfileid", "vmDesc": "vmDesc", "sandbox": 0, "internet": 0, "locBlackList": 0}
            ]
        },
    )
    results_mock = mocker.patch.object(demisto, "results")
    list_profiles_command()
    assert "ATD Analyzers Profile List" in results_mock.call_args[0][0]["HumanReadable"]


def test_get_headers(requests_mock):
    """
    Given:
        - The script args.
    When:
        - Running get_headers function.
    Then:
        - Validating the outputs as expected.
    """
    from McAfee_Advanced_Threat_Defense import get_headers

    requests_mock.get("http://demi.demi.com/php/session.php", json={"results": {"session": "session", "userId": "userId"}})
    res = get_headers()
    assert res.get("VE-SDK-API") == b"c2Vzc2lvbjp1c2VySWQ="