Group-IB TDS Polygon

THF Polygon is a Malware Detonation & Research platform designed for deep dynamic analysis and enhanced indicators extraction. THF Polygon analyzes submitted files and urls and extracts deep IOCs that appear when malicious code is triggered and executed. Polygon could be used either for application-level tasks (like smtp-based mail filtering) and analytical purposes (files/urls analysis for verdict, report and indicators).

Forensics & Malware Analysis · Polygon

Details

IDGroup-IB TDS Polygon
ProviderPolygon Labs
CategoryForensics & Malware Analysis
From Version5.0.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM EDR Cortex Cloud Cloud Runtime Security

README

THF Polygon is a Malware Detonation & Research platform designed for deep dynamic analysis and enhanced indicators extraction. THF Polygon analyzes submitted files and urls and extracts deep IOCs that appear when malicious code is triggered and executed. Polygon could be used either for application-level tasks (like smtp-based mail filtering) and analytical purposes (files/urls analysis for verdict, report and indicators).
This integration was integrated and tested with version 3.1 of Group-IB THF Polygon

Configure Group-IB THF Polygon in Cortex

Parameter Description Required f
server Server URL (e.g., https://huntbox.group-ib.com) True  
api_key API Key True  
report_language Default reports language True  
insecure Trust any certificate (insecure) False  
proxy Use system proxy settings False  

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

polygon-upload-file

Upload file for analysis

Base Command

polygon-upload-file

Input

Argument Name Description Required
file_id File ID in Demisto Required
password Password for analyzed archive Optional

Context Output

Path Type Description
Polygon.Analysis.ID string Analysis ID in THF
Polygon.Analysis.EntryID string File id in Demisto
Polygon.Analysis.FileName string Original file name
Polygon.Analysis.Status string The analysis status

Command Example

!polygon-upload-file file_id=4@br password=”123456”

Context Example

{
    "Polygon": {
        "Analysis": {
            "ID": "U2152031",
            "Status": "In Progress",
            "EntryID": "4@br",
            "FileName": "test.pdf"
        }
    }
}

Human Readable Output

File uploaded successfully. Analysis ID: F2136015

polygon-upload-url

Upload URL for analysis.

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.

Base Command

polygon-upload-url

Input

Argument Name Description Required
url URL for analysis Required

Context Output

Path Type Description
Polygon.Analysis.ID string Analysis ID in THF.
Polygon.Analysis.URL string URL analyzed.
Polygon.Analysis.Status string Polygon analysis status.

Command Example

!polygon-upload-url url=http://reqw.xyz/pik.zip

Context Example

{
    "Polygon": {
        "Analysis": {
            "ID": "U2152031",
            "Status": "In Progress",
            "URL": "http://reqw.xyz/pik.zip"
        }
    }
}

Human Readable Output

Url uploaded successfully. Analysis ID: U2152031

polygon-analysis-info

Get THF Polygon analysis info

Base Command

polygon-analysis-info

Input

Argument Name Description Required
tds_analysis_id Analysis ID in THF. Required

Context Output

Path Type Description
File.Name string The full file name (including file extension).
File.MD5 string The MD5 hash of the file.
File.SHA1 string The SHA1 hash of the file.
File.SHA256 string The SHA256 hash of the file.
File.Type string File type.
File.Malicious.Vendor string The vendor that reported the file as malicious.
File.Malicious.Description string A description explaining why the file was determined to be malicious.
DBotScore.Indicator string The indicator that was tested.
DBotScore.Type string The indicator type.
DBotScore.Vendor string The vendor used to calculate the score.
DBotScore.Score number The actual score.
IP.Address String IP address.
Domain.Name String The Domain name.
Domain.DNS String A list of IP objects resolved by DNS.
URL.Data String The URL.
URL.Malicious.Vendor string The vendor that reported the url as malicious.
URL.Malicious.Description string A description explaining why the url was determined to be malicious.
RegistryKey.Path String The path to the registry key.
RegistryKey.Value String The value at the given RegistryKey.
Process.Name String Process name.
Process.PID String Process PID.
Process.CommandLine String Process Command Line.
Process.Path String Process path.
Process.StartTime date Process start time.
Process.EndTime date Process end time.
Polygon.Analysis.ID string THF File ID.
Polygon.Analysis.Name string File Name.
Polygon.Analysis.Size number File Size.
Polygon.Analysis.Started date Analysis start timestamp.
Polygon.Analysis.Analyzed date Analysis finish timestamp.
Polygon.Analysis.MD5 string Analyzed file MD5 hash.
Polygon.Analysis.SHA1 string Analyzed file SHA1 hash.
Polygon.Analysis.SHA256 string Analyzed file SHA256.
Polygon.Analysis.Result boolean Analysis verdict.
Polygon.Analysis.Status string Analysis status.
Polygon.Analysis.Verdict string Analysis verdict.
Polygon.Analysis.Probability string Verdict probability.
Polygon.Analysis.Families string Malware families.
Polygon.Analysis.Score number Polygon score
Polygon.Analysis.Internet-connection string Internet availability.
Polygon.Analysis.Type string File type.
Polygon.Analysis.DumpExists boolean Network activity dump exists.
Polygon.Analysis.File unknown The information about files in analysis.
Polygon.Analysis.URL unknown The information about URL indicators.
Polygon.Analysis.IP unknown The information about IP indicators.
Polygon.Analysis.Domain unknown The information about Domain indicators.
Polygon.Analysis.RegistryKey unknown The information about registry keys which were modified during the analysis.
Polygon.Analysis.Process unknown The information about processes started during the analysis.

Command Example

!polygon-analysis-info tds_analysis_id=F2118597

Context Example

{
    "DBotScore": [
        {
            "Indicator": "ba9fe2cb8ee2421ea24a55306ce9d923",
            "Score": 3,
            "Type": "file",
            "Vendor": "Group-IB THF Polygon"
        },
        {
            "Indicator": "44b3f79dfd7c5861501a19a3bac89f544c7ff815",
            "Score": 0,
            "Type": "file",
            "Vendor": "Group-IB THF Polygon"
        },
        {
            "Indicator": "eb57446af5846faa28a726a8b7d43ce5a7fcbd55",
            "Score": 0,
            "Type": "file",
            "Vendor": "Group-IB THF Polygon"
        },
        {
            "Indicator": "3a29353e30ddd1af92f07ee0f61a3a706ee09a64",
            "Score": 0,
            "Type": "file",
            "Vendor": "Group-IB THF Polygon"
        },
        {
            "Indicator": "c41542c7dd5a714adfeafec77022ae0a722ff3a8",
            "Score": 0,
            "Type": "file",
            "Vendor": "Group-IB THF Polygon"
        },
        {
            "Indicator": "svettenkirch.de",
            "Score": 0,
            "Type": "domain",
            "Vendor": "Group-IB THF Polygon"
        },
        {
            "Indicator": "super.esu.as",
            "Score": 0,
            "Type": "domain",
            "Vendor": "Group-IB THF Polygon"
        },
        {
            "Indicator": "8.8.8.8",
            "Score": 0,
            "Type": "ip",
            "Vendor": "Group-IB THF Polygon"
        },
        {
            "Indicator": "79.98.29.14",
            "Score": 0,
            "Type": "ip",
            "Vendor": "Group-IB THF Polygon"
        },
        {
            "Indicator": "217.114.216.252",
            "Score": 0,
            "Type": "ip",
            "Vendor": "Group-IB THF Polygon"
        },
        {
            "Indicator": "http://super.esu.as/wp-content/themes/twentyeleven/inc/images/msg.jpg",
            "Score": 0,
            "Type": "url",
            "Vendor": "Group-IB THF Polygon"
        }
    ],
    "Domain": [
        {
            "DNS": "217.114.216.252",
            "Name": "svettenkirch.de"
        },
        {
            "DNS": "79.98.29.14",
            "Name": "super.esu.as"
        }
    ],
    "File": [
        {
            "MD5": "ba9fe2cb8ee2421ea24a55306ce9d923",
            "Malicious": {
                "Description": "Verdict probability: 64.8%, iocs: JS:Trojan.Agent.DQBF",
                "Vendor": "Group-IB THF Polygon"
            },
            "Name": "link.pdf",
            "SHA1": "44b3f79dfd7c5861501a19a3bac89f544c7ff815",
            "SHA256": "0d1b77c84c68c50932e28c3462a1962916abbbebb456ce654751ab401aa37697",
            "Type": "PDF document, version 1.7"
        },
        {
            "MD5": "9b52c8a74353d82ef1ebca42c9a7358c",
            "Name": "tmpfujZWn",
            "SHA1": "eb57446af5846faa28a726a8b7d43ce5a7fcbd55",
            "SHA256": "34ce805b7131eda3cec905dfd4e2708ab07dd3f038345b2ba9df51eb8fc915eb",
            "Type": "ASCII text, with no line terminators"
        },
        {
            "MD5": "3641c180f1a2c3f41fb1d974687e3553",
            "Name": "pik.zip",
            "SHA1": "3a29353e30ddd1af92f07ee0f61a3a706ee09a64",
            "SHA256": "c296d2895ac541ba16a237b2ad344b28e803b6990b7713c4c73faa9f722cf9fc",
            "Type": "Zip archive data, at least v2.0 to extract"
        },
        {
            "MD5": "9cd53f781ba0bed013ee87c5e7956f64",
            "Name": "\u041f\u0410\u041e \u00ab\u0413\u0440\u0443\u043f\u043f\u0430 \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 \u041f\u0418\u041a\u00bb \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u0437\u0430\u043a\u0430\u0437\u0430.js",
            "SHA1": "c41542c7dd5a714adfeafec77022ae0a722ff3a8",
            "SHA256": "422ea8f21b8652dd760a3f02ac3e2a4345d7e45fce49e1e45f020384c93a29ea",
            "Type": "ASCII text, with CRLF, LF line terminators"
        }
    ],
    "IP": [
        {
            "Address": "8.8.8.8"
        },
        {
            "Address": "79.98.29.14"
        },
        {
            "Address": "217.114.216.252"
        }
    ],
    "Polygon": {
        "Analysis": {
            "Analyzed": "2020-05-07 10:29:42",
            "DumpExists": true,
            "Families": "",
            "ID": "F2118597",
            "Internet-connection": "Available",
            "MD5": "ba9fe2cb8ee2421ea24a55306ce9d923",
            "Name": "link.pdf",
            "Probability": "64.80%",
            "Result": true,
            "SHA1": "44b3f79dfd7c5861501a19a3bac89f544c7ff815",
            "SHA256": "0d1b77c84c68c50932e28c3462a1962916abbbebb456ce654751ab401aa37697",
            "Score": 24.6,
            "Size": 36375,
            "Started": "2020-05-07 10:27:30",
            "Status": "Finished",
            "Type": "PDF document, version 1.7",
            "Verdict": "Malicious"
        }
    },
    "Process": [
        {
            "Child": null,
            "CommandLine": "C:\\Users\\John\\AppData\\Local\\Temp\\tmpknkzql\\link.pdf",
            "EndTime": null,
            "Hostname": null,
            "MD5": null,
            "Name": "AcroRd32.exe",
            "PID": "760",
            "Parent": null,
            "Path": "C:\\Program Files\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe",
            "SHA1": null,
            "Sibling": null,
            "StartTime": 132333460491406260
        },
        {
            "Child": null,
            "CommandLine": "\"C:\\Users\\John\\AppData\\Local\\Temp\\tmpkf9bqs\\\u041f\u0410\u041e \u00ab\u0413\u0440\u0443\u043f\u043f\u0430 \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 \u041f\u0418\u041a\u00bb \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u0437\u0430\u043a\u0430\u0437\u0430.js\"",
            "EndTime": 132333460889687500,
            "Hostname": null,
            "MD5": null,
            "Name": "wscript.exe",
            "PID": "972",
            "Parent": null,
            "Path": "C:\\Windows\\System32\\wscript.exe",
            "SHA1": null,
            "Sibling": null,
            "StartTime": 132333460491875000
        },
        {
            "Child": null,
            "CommandLine": "",
            "EndTime": null,
            "Hostname": null,
            "MD5": null,
            "Name": "(null)",
            "PID": "4",
            "Parent": null,
            "Path": "(null)",
            "SHA1": null,
            "Sibling": null,
            "StartTime": null
        },
        {
            "Child": null,
            "CommandLine": "",
            "EndTime": null,
            "Hostname": null,
            "MD5": null,
            "Name": "OSPPSVC.EXE",
            "PID": "180",
            "Parent": null,
            "Path": "C:\\Program Files\\Common Files\\microsoft shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE",
            "SHA1": null,
            "Sibling": null,
            "StartTime": null
        },
        {
            "Child": null,
            "CommandLine": "",
            "EndTime": null,
            "Hostname": null,
            "MD5": null,
            "Name": "audiodg.exe",
            "PID": "1116",
            "Parent": null,
            "Path": "C:\\Windows\\System32\\audiodg.exe",
            "SHA1": null,
            "Sibling": null,
            "StartTime": null
        },
        {
            "Child": null,
            "CommandLine": "",
            "EndTime": null,
            "Hostname": null,
            "MD5": null,
            "Name": "csrss.exe",
            "PID": "296",
            "Parent": null,
            "Path": "C:\\Windows\\System32\\csrss.exe",
            "SHA1": null,
            "Sibling": null,
            "StartTime": null
        },
        {
            "Child": null,
            "CommandLine": "",
            "EndTime": null,
            "Hostname": null,
            "MD5": null,
            "Name": "csrss.exe",
            "PID": "340",
            "Parent": null,
            "Path": "C:\\Windows\\System32\\csrss.exe",
            "SHA1": null,
            "Sibling": null,
            "StartTime": null
        },
        {
            "Child": null,
            "CommandLine": "",
            "EndTime": null,
            "Hostname": null,
            "MD5": null,
            "Name": "dwm.exe",
            "PID": "1276",
            "Parent": null,
            "Path": "C:\\Windows\\System32\\dwm.exe",
            "SHA1": null,
            "Sibling": null,
            "StartTime": null
        },
        {
            "Child": null,
            "CommandLine": "",
            "EndTime": null,
            "Hostname": null,
            "MD5": null,
            "Name": "lsass.exe",
            "PID": "396",
            "Parent": null,
            "Path": "C:\\Windows\\System32\\lsass.exe",
            "SHA1": null,
            "Sibling": null,
            "StartTime": null
        },
        {
            "Child": null,
            "CommandLine": "",
            "EndTime": null,
            "Hostname": null,
            "MD5": null,
            "Name": "lsm.exe",
            "PID": "404",
            "Parent": null,
            "Path": "C:\\Windows\\System32\\lsm.exe",
            "SHA1": null,
            "Sibling": null,
            "StartTime": null
        },
        {
            "Child": null,
            "CommandLine": "",
            "EndTime": null,
            "Hostname": null,
            "MD5": null,
            "Name": "services.exe",
            "PID": "380",
            "Parent": null,
            "Path": "C:\\Windows\\System32\\services.exe",
            "SHA1": null,
            "Sibling": null,
            "StartTime": null
        },
        {
            "Child": null,
            "CommandLine": "",
            "EndTime": null,
            "Hostname": null,
            "MD5": null,
            "Name": "smss.exe",
            "PID": "216",
            "Parent": null,
            "Path": "C:\\Windows\\System32\\smss.exe",
            "SHA1": null,
            "Sibling": null,
            "StartTime": null
        },
        {
            "Child": null,
            "CommandLine": "",
            "EndTime": null,
            "Hostname": null,
            "MD5": null,
            "Name": "spoolsv.exe",
            "PID": "1168",
            "Parent": null,
            "Path": "C:\\Windows\\System32\\spoolsv.exe",
            "SHA1": null,
            "Sibling": null,
            "StartTime": null
        },
        {
            "Child": null,
            "CommandLine": "",
            "EndTime": null,
            "Hostname": null,
            "MD5": null,
            "Name": "svchost.exe",
            "PID": "776",
            "Parent": null,
            "Path": "C:\\Windows\\System32\\svchost.exe",
            "SHA1": null,
            "Sibling": null,
            "StartTime": null
        },
        {
            "Child": null,
            "CommandLine": "",
            "EndTime": null,
            "Hostname": null,
            "MD5": null,
            "Name": "svchost.exe",
            "PID": "944",
            "Parent": null,
            "Path": "C:\\Windows\\System32\\svchost.exe",
            "SHA1": null,
            "Sibling": null,
            "StartTime": null
        },
        {
            "Child": null,
            "CommandLine": "",
            "EndTime": null,
            "Hostname": null,
            "MD5": null,
            "Name": "svchost.exe",
            "PID": "804",
            "Parent": null,
            "Path": "C:\\Windows\\System32\\svchost.exe",
            "SHA1": null,
            "Sibling": null,
            "StartTime": null
        },
        {
            "Child": null,
            "CommandLine": "",
            "EndTime": null,
            "Hostname": null,
            "MD5": null,
            "Name": "svchost.exe",
            "PID": "636",
            "Parent": null,
            "Path": "C:\\Windows\\System32\\svchost.exe",
            "SHA1": null,
            "Sibling": null,
            "StartTime": null
        },
        {
            "Child": null,
            "CommandLine": "",
            "EndTime": null,
            "Hostname": null,
            "MD5": null,
            "Name": "svchost.exe",
            "PID": "560",
            "Parent": null,
            "Path": "C:\\Windows\\System32\\svchost.exe",
            "SHA1": null,
            "Sibling": null,
            "StartTime": null
        },
        {
            "Child": null,
            "CommandLine": "",
            "EndTime": null,
            "Hostname": null,
            "MD5": null,
            "Name": "svchost.exe",
            "PID": "704",
            "Parent": null,
            "Path": "C:\\Windows\\System32\\svchost.exe",
            "SHA1": null,
            "Sibling": null,
            "StartTime": null
        },
        {
            "Child": null,
            "CommandLine": "",
            "EndTime": null,
            "Hostname": null,
            "MD5": null,
            "Name": "svchost.exe",
            "PID": "1220",
            "Parent": null,
            "Path": "C:\\Windows\\System32\\svchost.exe",
            "SHA1": null,
            "Sibling": null,
            "StartTime": null
        },
        {
            "Child": null,
            "CommandLine": "",
            "EndTime": null,
            "Hostname": null,
            "MD5": null,
            "Name": "svchost.exe",
            "PID": "724",
            "Parent": null,
            "Path": "C:\\Windows\\System32\\svchost.exe",
            "SHA1": null,
            "Sibling": null,
            "StartTime": null
        },
        {
            "Child": null,
            "CommandLine": "",
            "EndTime": null,
            "Hostname": null,
            "MD5": null,
            "Name": "svchost.exe",
            "PID": "1004",
            "Parent": null,
            "Path": "C:\\Windows\\System32\\svchost.exe",
            "SHA1": null,
            "Sibling": null,
            "StartTime": null
        },
        {
            "Child": null,
            "CommandLine": "",
            "EndTime": null,
            "Hostname": null,
            "MD5": null,
            "Name": "taskhost.exe",
            "PID": "1296",
            "Parent": null,
            "Path": "C:\\Windows\\System32\\taskhost.exe",
            "SHA1": null,
            "Sibling": null,
            "StartTime": null
        },
        {
            "Child": null,
            "CommandLine": "",
            "EndTime": 132333461081093740,
            "Hostname": null,
            "MD5": null,
            "Name": "WmiPrvSE.exe",
            "PID": "860",
            "Parent": null,
            "Path": "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe",
            "SHA1": null,
            "Sibling": null,
            "StartTime": null
        },
        {
            "Child": null,
            "CommandLine": "",
            "EndTime": null,
            "Hostname": null,
            "MD5": null,
            "Name": "winlogon.exe",
            "PID": "460",
            "Parent": null,
            "Path": "C:\\Windows\\System32\\winlogon.exe",
            "SHA1": null,
            "Sibling": null,
            "StartTime": null
        },
        {
            "Child": null,
            "CommandLine": "",
            "EndTime": null,
            "Hostname": null,
            "MD5": null,
            "Name": "explorer.exe",
            "PID": "1344",
            "Parent": null,
            "Path": "C:\\Windows\\explorer.exe",
            "SHA1": null,
            "Sibling": null,
            "StartTime": null
        }
    ],
    "RegistryKey": [
        {
            "Name": null,
            "Path": "\\REGISTRY\\USER\\S-1-5-21-3926359194-3103936542-680984010-1000\\Software\\Adobe\\Acrobat Reader\\9.0\\Installer\\Migrated\\{AC76BA86-7AD7-1033-7B44-A90000000001}",
            "Value": "1"
        },
        {
            "Name": null,
            "Path": "\\REGISTRY\\USER\\S-1-5-21-3926359194-3103936542-680984010-1000\\Software\\Adobe\\Acrobat Reader\\9.0\\Originals\\bDisplayedSplash",
            "Value": "1"
        },
        {
            "Name": null,
            "Path": "\\REGISTRY\\USER\\S-1-5-21-3926359194-3103936542-680984010-1000\\Software\\Adobe\\Acrobat Reader\\9.0\\AVGeneral\\bLastExitNormal",
            "Value": "0"
        },
        {
            "Name": null,
            "Path": "\\REGISTRY\\USER\\S-1-5-21-3926359194-3103936542-680984010-1000\\Software\\Adobe\\Acrobat Reader\\9.0\\AdobeViewer\\Launched",
            "Value": "1"
        },
        {
            "Name": null,
            "Path": "\\REGISTRY\\MACHINE\\SOFTWARE\\Adobe\\Acrobat Reader\\9.0\\AdobeViewer\\Launched",
            "Value": "1"
        },
        {
            "Name": null,
            "Path": "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Tracing\\wscript_RASAPI32\\EnableFileTracing",
            "Value": "0"
        },
        {
            "Name": null,
            "Path": "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Tracing\\wscript_RASAPI32\\EnableConsoleTracing",
            "Value": "0"
        },
        {
            "Name": null,
            "Path": "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Tracing\\wscript_RASAPI32\\FileTracingMask",
            "Value": "-65536"
        },
        {
            "Name": null,
            "Path": "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Tracing\\wscript_RASAPI32\\ConsoleTracingMask",
            "Value": "-65536"
        },
        {
            "Name": null,
            "Path": "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Tracing\\wscript_RASAPI32\\MaxFileSize",
            "Value": "1048576"
        },
        {
            "Name": null,
            "Path": "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Tracing\\wscript_RASAPI32\\FileDirectory",
            "Value": "%windir%\\tracing"
        },
        {
            "Name": null,
            "Path": "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Tracing\\wscript_RASMANCS\\EnableFileTracing",
            "Value": "0"
        },
        {
            "Name": null,
            "Path": "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Tracing\\wscript_RASMANCS\\EnableConsoleTracing",
            "Value": "0"
        },
        {
            "Name": null,
            "Path": "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Tracing\\wscript_RASMANCS\\FileTracingMask",
            "Value": "-65536"
        },
        {
            "Name": null,
            "Path": "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Tracing\\wscript_RASMANCS\\ConsoleTracingMask",
            "Value": "-65536"
        },
        {
            "Name": null,
            "Path": "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Tracing\\wscript_RASMANCS\\MaxFileSize",
            "Value": "1048576"
        },
        {
            "Name": null,
            "Path": "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Tracing\\wscript_RASMANCS\\FileDirectory",
            "Value": "%windir%\\tracing"
        },
        {
            "Name": null,
            "Path": "\\REGISTRY\\USER\\S-1-5-21-3926359194-3103936542-680984010-1000\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyEnable",
            "Value": "0"
        },
        {
            "Name": null,
            "Path": "\\REGISTRY\\USER\\S-1-5-21-3926359194-3103936542-680984010-1000\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\SavedLegacySettings",
            "Value": "{'type': 'b64_struct', 'data': 'RgAAADcAAAAJAAAAAAAAAAAAAAAAAAAABAAAAAAAAADwtLKVehjTAQAAAAAAAAAAAAAAAAIAAAAXAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAVHNMAFRzTAAAAAAAAAAAAAQAAAAAAAAAeHNMAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD/////AwAAAAAAAAACAAAAAQAAAAIAAADAqAEOAAAAAAAAAADa2traAAAAAAAAAAAFAAAAAAAAAAAAAAAptQYAAAAAAAAAAAAAAAAA8HNMAPBzTAAAAAAAAAAAAP////8AAAAAAAAAAAAAAAAAAAAAFHRMABR0TAAAAAAAIHRMACB0TAAAAAAAAAAAAAAAAAAAAAAA'}"
        },
        {
            "Name": null,
            "Path": "\\REGISTRY\\USER\\S-1-5-21-3926359194-3103936542-680984010-1000\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\UNCAsIntranet",
            "Value": "0"
        },
        {
            "Name": null,
            "Path": "\\REGISTRY\\USER\\S-1-5-21-3926359194-3103936542-680984010-1000\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\AutoDetect",
            "Value": "1"
        },
        {
            "Name": null,
            "Path": "\\REGISTRY\\USER\\S-1-5-21-3926359194-3103936542-680984010-1000\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\\Nqbor\\Ernqre 9.0\\Ernqre\\NpebEq32.rkr",
            "Value": "{'type': 'b64_struct', 'data': 'AAAAAAAAAAABAAAAAAAAAAAAgL8AAIC/AACAvwAAgL8AAIC/AACAvwAAgL8AAIC/AACAvwAAgL//////AAAAAAAAAAAAAAAA'}"
        },
        {
            "Name": null,
            "Path": "\\REGISTRY\\USER\\S-1-5-21-3926359194-3103936542-680984010-1000\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\HRZR_PGYFRFFVBA",
            "Value": "{'type': 'b64_struct', 'data': 'AAAAALoAAABhAQAAVElSABAAAAAVAAAAL0cCAE0AaQBjAHIAbwBzAG8AZgB0AC4ASQBuAHQAZQByAG4AZQB0AEUAeABwAGwAbwByAGUAcgAuAEQAZQBmAGEAdQBsAHQAAAAAAAAAAAAAAAAAAAAAACMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAqDB4CsOkGAhMAHgLiCx4Cb6m4dgYAAAAFAAAA4gseAjC1HgJU6QYC6Kq4dqECAQ5I6QYCTOsGAjC1HgIAAAAABQAAAAEAAAD8gfJ0DOgGAqECAQ7Q6QYC7eDodqRgGAD+////i43sdhCL7HYBAAAAAQAAAAAAAAD86QYCxOkGAuDpBgJshwN1AQAAAAAAAAD86QYCf4cDdWcbROsAAAAAZO8GAgIAAAAAAAAAwFS4dqECAQ4AAAAAAABLbaTpBgILAAAAQO4GAkDuBgL46QYCCwAAAFDuBgJQ7gYCCOoGAiFSvXYK5aICyv6iAgsAAABQ7gYC'}"
        }
    ],
    "URL": {
        "Data": "http://super.esu.as/wp-content/themes/twentyeleven/inc/images/msg.jpg"
    }
}

Human Readable Output

Analysis F2118597

Analyzed DumpExists ID Internet-connection MD5 Name Probability Result SHA1 SHA256 Score Size Started Status Type Verdict
2020-05-07 10:29:42 true F2118597 Available ba9fe2cb8ee2421ea24a55306ce9d923 link.pdf 64.80% true 44b3f79dfd7c5861501a19a3bac89f544c7ff815 0d1b77c84c68c50932e28c3462a1962916abbbebb456ce654751ab401aa37697 24.6 36375 2020-05-07 10:27:30 Finished PDF document, version 1.7 Malicious

polygon-export-report

Export an archive with THF Polygon report to War Room

Base Command

polygon-export-report

Input

Argument Name Description Required
tds_analysis_id Analysis ID in THF Required

Context Output

Path Type Description
File.Name string The report file name.
File.EntryID string Report file ID in Demisto.
File.Size number The report size.
File.Type string The report file type.
File.Info string The report file info.

Command Example

!polygon-export-report tds_analysis_id=F2118597

Context Example

{
    "InfoFile": {
        "EntryID": "178@2d0823ab-618b-43e8-83e7-515302bedcec",
        "Extension": "tar",
        "Info": "tar",
        "Name": "report.tar",
        "Size": 5072402,
        "Type": "gzip compressed data, last modified: Mon May 25 12:45:01 2020, max compression"
    }
}

Human Readable Output

polygon-export-pcap

Network activity dump export

Base Command

polygon-export-pcap

Input

Argument Name Description Required
tds_analysis_id Analysis ID in THF Required

Context Output

Path Type Description
File.Name string The dump file name.
File.EntryID string The dump file ID in Demisto.
File.Size number The dump file size.
File.Type string The dump file type.
File.Info unknown The dump file info.

Command Example

!polygon-export-pcap tds_analysis_id=F2118597

Context Example

{
    "InfoFile": {
        "EntryID": "186@2d0823ab-618b-43e8-83e7-515302bedcec",
        "Extension": "pcap",
        "Info": "pcap",
        "Name": "dump.pcap",
        "Size": 3655,
        "Type": "tcpdump capture file (little-endian) - version 2.4 (Ethernet, capture length 262144)"
    }
}

Human Readable Output

polygon-export-video

Screen activity video export

Base Command

polygon-export-video

Input

Argument Name Description Required
tds_analysis_id Analysis ID in THF Required

Context Output

Path Type Description
File.Name string The video file name
File.EntryID string The video file ID in Demisto
File.Size number The video file size
File.Type string The video file type
File.Info string The video file info

Command Example

!polygon-export-video tds_analysis_id=F2118597

Context Example

{
    "InfoFile": {
        "EntryID": "182@2d0823ab-618b-43e8-83e7-515302bedcec",
        "Extension": "webm",
        "Info": "webm",
        "Name": "video.webm",
        "Size": 79290,
        "Type": "WebM"
    }
}

Human Readable Output

file

Check file reputation

Base Command

file

Input

Argument Name Description Required
file File hash (MD5, SHA1, SHA256) Required

Context Output

Path Type Description
File.MD5 string The MD5 hash of the file.
File.SHA1 string The SHA1 hash of the file.
File.SHA256 string The SHA256 hash of the file.
File.Malicious.Vendor string The vendor that reported the file as malicious.
File.Malicious.Description string A description explaining why the file was determined to be malicious.
DBotScore.Indicator string The indicator that was tested.
DBotScore.Type string The indicator type.
DBotScore.Vendor string The vendor used to calculate the score.
DBotScore.Score number The actual score.
Polygon.Analysis.Score number Malware score in Polygon.
Polygon.Analysis.MD5 string The MD5 hash of the file.
Polygon.Analysis.SHA1 string The SHA1 hash of the file.
Polygon.Analysis.SHA256 string The SHA256 hash of the file.
Polygon.Analysis.Found bool File was found in cloud or not.
Polygon.Analysis.Verdict bool Polygon verdict for file.
Polygon.Analysis.Malware-families string Malware families.

Command Example

!file file=eb57446af5846faa28a726a8b7d43ce5a7fcbd55

Context Example

{
    "DBotScore": [
        {
            "Indicator": "eb57446af5846faa28a726a8b7d43ce5a7fcbd55",
            "Score": 3,
            "Type": "file",
            "Vendor": "Group-IB THF Polygon"
        }
    ],
    "File": {
        "Malicious": {
            "Description": "THF Polygon score: 24.0",
            "Vendor": "Group-IB THF Polygon"
        },
        "SHA1": "eb57446af5846faa28a726a8b7d43ce5a7fcbd55"
    },
    "Polygon": {
        "Analysis": {
            "Found": true,
            "Malware-families": [],
            "SHA1": "eb57446af5846faa28a726a8b7d43ce5a7fcbd55",
            "Score": 24,
            "Verdict": true
        }
    }
}

Human Readable Output

Results

Found Malware-families SHA1 Score Verdict
true   eb57446af5846faa28a726a8b7d43ce5a7fcbd55 24.0 true

Configuration parameters

  • server — Server URL (e.g., https://huntbox.group-ib.com) (required)
  • api_key — API Key (required)
  • report_language — Default reports language (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • integrationReliability — Source Reliability
  • feedExpirationPolicy —
  • feedExpirationInterval —

Commands (7)

  • file

    Check file reputation.

  • polygon-analysis-info

    Get THF Polygon analysis info.

  • polygon-export-pcap

    The command allows you to download a network activity dump in case the file/link is malicious.

  • polygon-export-report

    Export an archive with THF Polygon report to War Room.

  • polygon-export-video

    The command allows you to download a screen activity video in case the file/link is malicious.

  • polygon-upload-file

    Upload file for analysis.

  • polygon-upload-url

    Upload URL for analysis.

Source

Polygon.py Polygon_test.py Polygon.yml Polygon_description.md
Download History Raw 
import demistomock as demisto
from CommonServerPython import *

""" IMPORTS """
from io import StringIO

import urllib3

# Disable insecure warnings
urllib3.disable_warnings()

""" CONSTANTS """
INTEGRATION_NAME = "Group-IB THF Polygon"
LANGUAGE_TO_CODE = {"english": "en", "russian": "ru"}
FILE_TYPE = "F"
URL_TYPE = "U"

API = "api/"
ANALGIN_UPLOAD = API + "analgin/upload/"
ATTACHES = API + "attaches/"
ATTACH = ATTACHES + "?id={}"
REPORT = ATTACHES + "{}/{}/{}/polygon_report/"
REPORT_EXPORT = ATTACHES + "{}/{}/{}/polygon_report_export/"
PCAP_EXPORT = ATTACHES + "{}/{}/{}/dump.pcap/dump.pcap/polygon_report_file_download/"
VIDEO_EXPORT = ATTACHES + "{}/{}/{}/shots/video.webm/video.webm/polygon_report_file_download/"
HASH_REPUTATION = API + "reports/check_hash/{}/{}/"


class RegistryKey(Common.Indicator):
    """
    Registry Key indicator class
    """

    def __init__(self, path, value, name=None):
        self.path = path
        self.name = name
        self.value = value

    def to_context(self):
        key_context = {"Path": self.path, "Name": self.name, "Value": self.value}
        return {"RegistryKey": key_context}

    def to_minimum_context(self):
        return {"Path": self.path, "Value": self.value}


class Process(Common.Indicator):
    """
    Process indicator class
    """

    def __init__(
        self,
        name,
        pid,
        hostname=None,
        md5=None,
        sha1=None,
        command_line=None,
        path=None,
        start_time=None,
        end_time=None,
        parent=None,
        sibling=None,
        child=None,
    ):
        self.name = name
        self.pid = pid
        self.hostname = hostname
        self.md5 = md5
        self.sha1 = sha1
        self.command_line = command_line
        self.path = path
        self.start_time = start_time
        self.end_time = end_time
        self.parent = parent
        self.sibling = sibling
        self.child = child

    def to_context(self):
        process_context = {
            "Name": self.name,
            "PID": self.pid,
            "Hostname": self.hostname,
            "MD5": self.md5,
            "SHA1": self.sha1,
            "CommandLine": self.command_line,
            "Path": self.path,
            "StartTime": self.start_time,
            "EndTime": self.end_time,
            "Parent": self.parent,
            "Sibling": self.sibling,
            "Child": self.child,
        }

        return {"Process": process_context}

    def to_minimum_context(self):
        return {"Name": self.name, "PID": self.pid}


class Client(BaseClient):
    def __init__(self, base_url, verify, api_key, language):
        super().__init__(base_url=base_url, verify=verify)
        self._language = language
        self._headers = {"X-API-KEY": api_key}

    def _check_report_available(self, file_info):
        report = False
        if (
            "analgin_result" in file_info
            and "commit" in file_info.get("analgin_result", {})
            and "reports" in file_info.get("analgin_result", {})
            and len(file_info["analgin_result"].get("reports", []))
            and "id" in file_info["analgin_result"]["reports"][0]
        ):
            report = True
        return report

    def _get_fids(self, resp):
        fids = resp.get("data", {}).get("ids", [])
        if not fids:
            err_msg = "There is no analysis ID in THF response.Try to upload file/url one more time."
            raise DemistoException(err_msg)
        return fids[0]

    def upload_file(self, file_name, file_path, password=""):
        with open(file_path, "rb") as f:
            resp = self._http_request(
                method="post",
                url_suffix=ANALGIN_UPLOAD,
                files={"files": (file_name, f)},
                data={"language": self._language, "password": password},
            )
        return self._get_fids(resp)

    def upload_url(self, url):
        resp = self._http_request(
            method="post",
            url_suffix=ANALGIN_UPLOAD,
            files={"files": ("url.txt", StringIO(url))},
            data={"language": self._language},
        )
        return self._get_fids(resp)

    def get_attach(self, id=None):
        url = ATTACH.format(id) if id else ATTACHES
        results = self._http_request("get", url).get("data", {}).get("results", [])
        if id:
            try:
                results = results[0]
            except Exception:
                raise DemistoException(f"File with ID={id} does not exist")
        return results

    def get_analysis_info(self, tds_analysis_id):
        file = self.get_attach(tds_analysis_id)
        resp = {"file": file}
        if self._check_report_available(file):
            try:
                report = self._http_request(
                    "get",
                    REPORT.format(tds_analysis_id, file["analgin_result"]["commit"], file["analgin_result"]["reports"][0]["id"]),
                )
                if "data" in report:
                    resp.update({"report": report["data"]})
            except Exception:
                pass
        return resp

    def get_url(self, file):
        if self._check_report_available(file):
            return self._http_request(method="get", url_suffix=file.get("file_url")[1:], resp_type="content").decode()
        raise DemistoException("No reports found")

    def export_report(self, tds_analysis_id):
        file = self.get_attach(tds_analysis_id)
        if self._check_report_available(file):
            return self._http_request(
                method="get",
                url_suffix=REPORT_EXPORT.format(
                    tds_analysis_id, file["analgin_result"]["commit"], file["analgin_result"]["reports"][0]["id"]
                ),
                resp_type="content",
            )
        raise DemistoException(f"No reports for analysis: {tds_analysis_id}")

    def export_pcap(self, tds_analysis_id):
        file = self.get_attach(tds_analysis_id)
        if self._check_report_available(file):
            return self._http_request(
                method="get",
                url_suffix=PCAP_EXPORT.format(
                    tds_analysis_id, file["analgin_result"]["commit"], file["analgin_result"]["reports"][0]["id"]
                ),
                resp_type="content",
            )
        raise DemistoException(f"No reports for analysis: {tds_analysis_id}")

    def export_video(self, tds_analysis_id):
        file = self.get_attach(tds_analysis_id)
        if self._check_report_available(file):
            return self._http_request(
                method="get",
                url_suffix=VIDEO_EXPORT.format(
                    tds_analysis_id, file["analgin_result"]["commit"], file["analgin_result"]["reports"][0]["id"]
                ),
                resp_type="content",
            )
        raise DemistoException(f"No reports for analysis: {tds_analysis_id}")

    def get_hash_reputation(self, hash_type, hash_value):
        return self._http_request(method="get", url_suffix=HASH_REPUTATION.format(hash_type, hash_value)).get("data", {})


def drop_prefix(id_with_prefix):
    return id_with_prefix[1:]


def serialize_report_info(report, analysis_type):
    info = report.get("info", {})
    res = {
        "Verdict": "Malicious" if info.get("verdict") else "Benign",
        "Started": info.get("started"),
        "Analyzed": info.get("ended"),
        "Internet-connection": "Available" if info.get("internet_available") else "Unavailable",
    }
    if info.get("verdict"):
        res.update(
            {
                "Probability": "{:.2f}%".format(info.get("probability", 0.0)),
                "Families": ", ".join(info.get("families", [])),
                "Score": info.get("score", 0),
                "DumpExists": any(len(vals) > 0 for vals in report.get("network", {}).values()),
            }
        )
    if analysis_type == FILE_TYPE:
        res.update({"Type": report.get("target", {}).get("file", {}).get("type")})
    else:
        res.update({"URL": report.get("target", {}).get("url")})
    return res


def serialize_analysis_info(info, analysis_type, report):
    res = {
        "ID": analysis_type + str(info.get("id", "")),
        "Status": "Finished" if report else "In Progress",
        "Result": info.get("verdict"),
    }
    if analysis_type == FILE_TYPE:
        res.update(
            {
                "Name": info.get("original_filename"),
                "Size": info.get("file_size"),
                "MD5": info.get("md5"),
                "SHA1": info.get("sha1"),
                "SHA256": info.get("sha256"),
            }
        )
    return res


def get_human_readable_analysis_info(analysis_info):
    return tableToMarkdown(f"Analysis {analysis_info.get('ID')}", analysis_info, removeNull=True)


def get_main_indicator(report, analysis_type):
    score = Common.DBotScore.GOOD
    malicious = None
    if report.get("info", {}).get("verdict"):
        score = Common.DBotScore.BAD
        malicious = "Verdict probability: {}%".format(report.get("info", {}).get("probability"))
        signatures: list = []
        for signature in report.get("signatures", []):
            if signature.get("name") == "yara_rules":
                signatures += [s.get("ioc") for s in signature.get("marks", [])]
        if signatures:
            malicious += ", iocs: {}".format(", ".join(signatures))
    if analysis_type == FILE_TYPE:
        tfile = report.get("target", {}).get("file", {})
        return Common.File(
            name=tfile.get("name"),
            file_type=tfile.get("type"),
            md5=tfile.get("md5"),
            sha1=tfile.get("sha1"),
            sha256=tfile.get("sha256"),
            dbot_score=Common.DBotScore(
                indicator=tfile.get("md5"),
                indicator_type=DBotScoreType.FILE,
                integration_name=INTEGRATION_NAME,
                score=score,
                malicious_description=malicious,
                reliability=demisto.params().get("integrationReliability"),
            ),
        )
    else:
        url = report.get("target", {}).get("url")
        return Common.URL(
            url=url,
            dbot_score=Common.DBotScore(
                indicator=url,
                indicator_type=DBotScoreType.URL,
                integration_name=INTEGRATION_NAME,
                score=score,
                malicious_description=malicious,
                reliability=demisto.params().get("integrationReliability"),
            ),
        )


def get_packages_indicators(res):
    report = res["report"]
    command_results = []
    for package in report.get("packages", []):
        info = package.get("file_info", {})
        file = Common.File(
            name=info.get("name"),
            file_type=info.get("type"),
            md5=info.get("md5"),
            sha1=info.get("sha1"),
            sha256=info.get("sha256"),
            dbot_score=Common.DBotScore(
                indicator=info.get("sha1"),
                indicator_type=DBotScoreType.FILE,
                integration_name=INTEGRATION_NAME,
                score=0,
                reliability=demisto.params().get("integrationReliability"),
            ),
        )
        command_results.append(
            CommandResults(
                readable_output=tableToMarkdown(f"New File indicator was created {file.name}", {}),
                indicator=file,
                raw_response=res,
            )
        )
    return command_results


def get_network_indicators(res):
    report = res["report"]
    command_results = []
    network = report.get("network", {})
    for dns in network.get("dns", []):
        domain = Common.Domain(
            domain=dns.get("request"),
            dns=", ".join([answer.get("data") for answer in dns.get("answers")]),
            dbot_score=Common.DBotScore(
                indicator=dns.get("request"),
                indicator_type=DBotScoreType.DOMAIN,
                integration_name=INTEGRATION_NAME,
                score=0,
                reliability=demisto.params().get("integrationReliability"),
            ),
        )
        command_results.append(
            CommandResults(
                readable_output=tableToMarkdown(f"New Domain indicator was created {domain.domain}", {}),
                indicator=domain,
                raw_response=res,
            )
        )
    for host in network.get("hosts", []) + [h[0] for h in network.get("dead_hosts", [])]:
        ip = Common.IP(
            ip=host,
            dbot_score=Common.DBotScore(
                indicator=host,
                indicator_type=DBotScoreType.IP,
                integration_name=INTEGRATION_NAME,
                score=0,
                reliability=demisto.params().get("integrationReliability"),
            ),
        )
        command_results.append(
            CommandResults(
                readable_output=tableToMarkdown(f"New IP indicator was created {ip.ip}", {}), indicator=ip, raw_response=res
            )
        )
    for http in network.get("http", []):
        url = Common.URL(
            url=http.get("uri"),
            dbot_score=Common.DBotScore(
                indicator=http.get("uri"),
                indicator_type=DBotScoreType.URL,
                integration_name=INTEGRATION_NAME,
                score=0,
                reliability=demisto.params().get("integrationReliability"),
            ),
        )
        command_results.append(
            CommandResults(
                readable_output=tableToMarkdown(f"New URL indicator was created {url.url}", {}), indicator=url, raw_response=res
            )
        )
    return command_results


def get_monitor_indicators(res):
    report = res["report"]
    command_results = []
    for p in report.get("goo_monitor", {}).get("processes", []):
        process = Process(
            name=p.get("basename"),
            pid=str(p.get("pid")),
            command_line=p.get("cmdline"),
            start_time=p.get("started_at"),
            end_time=p.get("exited_at"),
            path=p.get("filename"),
        )
        command_results.append(
            CommandResults(
                readable_output=tableToMarkdown(f"New Process indicator was created {process.name}", {}),
                indicator=process,
                raw_response=res,
            )
        )
        for regkey in p.get("regkeys", []):
            if regkey.get("action") == "regkey_written":
                reg = RegistryKey(path=regkey.get("ioc"), value=str(regkey.get("value")))
                command_results.append(
                    CommandResults(
                        readable_output=tableToMarkdown(f"New RegistryKey indicator was created {reg.value}", {}),
                        indicator=reg,
                        raw_response=res,
                    )
                )
    return command_results


def get_report_indicators(res, analysis_type):
    report = res["report"]
    command_results = []
    human_readable = ""
    indicator = get_main_indicator(report, analysis_type)
    if isinstance(indicator, Common.File):
        human_readable = tableToMarkdown(f"New File indicator was created {indicator.name}", {})
    elif isinstance(indicator, Common.URL):
        human_readable = tableToMarkdown(f"New URL indicator was created {indicator.url}", {})
    command_results.append(CommandResults(readable_output=human_readable, indicator=indicator, raw_response=res))
    command_results.extend(get_packages_indicators(res))
    command_results.extend(get_network_indicators(res))
    command_results.extend(get_monitor_indicators(res))

    return command_results


def analysis_info_command(client, args):
    tds_analysis_id_array = argToList(args.get("tds_analysis_id"))
    all_results = []
    for tds_analysis_id in tds_analysis_id_array:
        analysis_type = tds_analysis_id[0]
        res = client.get_analysis_info(drop_prefix(tds_analysis_id))
        analysis_info = serialize_analysis_info(res.get("file"), analysis_type, report="report" in res)
        command_results = []
        if "report" in res:
            if analysis_type == URL_TYPE:
                res["report"]["target"]["url"] = client.get_url(res.get("file"))
            analysis_info.update(serialize_report_info(res["report"], analysis_type))
            command_results = get_report_indicators(res, analysis_type)
        human_readable = get_human_readable_analysis_info(analysis_info)
        command_results.append(
            CommandResults(
                readable_output=human_readable,
                outputs_prefix="Polygon.Analysis",
                outputs_key_field="ID",
                outputs=analysis_info,
                raw_response=res,
            )
        )
        all_results.extend(command_results)
    return all_results


def export_report_command(client, args):
    tds_analysis_id = drop_prefix(args.get("tds_analysis_id"))
    report = client.export_report(tds_analysis_id)
    demisto.results(fileResult(filename="report.tar", data=report))


def export_pcap_command(client, args):
    tds_analysis_id = drop_prefix(args.get("tds_analysis_id"))
    pcap = client.export_pcap(tds_analysis_id)
    demisto.results(fileResult(filename="dump.pcap", data=pcap))


def export_video_command(client, args):
    tds_analysis_id = drop_prefix(args.get("tds_analysis_id"))
    video = client.export_video(tds_analysis_id)
    if not video:
        return_results("No screen activity detected")
    else:
        demisto.results(fileResult(filename="video.webm", data=video))


def upload_url_command(client, args):
    url = args.get("url")
    res = client.upload_url(url)
    res = f"{URL_TYPE}{res}"
    outputs = {
        "ID": res,
        "URL": url,
        "Status": "In Progress",
    }
    results = CommandResults(
        readable_output=tableToMarkdown("Url uploaded successfully", outputs),
        outputs_prefix="Polygon.Analysis",
        outputs_key_field="ID",
        outputs=outputs,
        raw_response=res,
    )
    return results


def upload_file_command(client, args):
    file_id = args.get("file_id")
    password = args.get("password")
    file_obj = demisto.getFilePath(file_id)
    # Ignoring non ASCII
    file_name = file_obj.get("name", "").encode("ascii", "ignore")
    file_path = file_obj.get("path")
    res = client.upload_file(file_name, file_path, password)
    res = f"{FILE_TYPE}{res}"
    outputs = {"ID": res, "EntryID": file_id, "FileName": file_obj.get("name"), "Status": "In Progress"}
    results = CommandResults(
        readable_output=tableToMarkdown("File uploaded successfully", outputs),
        outputs_prefix="Polygon.Analysis",
        outputs_key_field="ID",
        outputs=outputs,
        raw_response=res,
    )
    return results


def file_command(client, args):
    files = argToList(args.get("file"))
    all_results = []
    for file in files:
        hash_type = get_hash_type(file)
        if hash_type != "Unknown":
            res = client.get_hash_reputation(hash_type, file)
            analysis_info = {
                hash_type.upper(): file,
                "Found": res.get("found"),
                "Verdict": res.get("verdict"),
                "Score": res.get("score"),
                "Malware-families": res.get("malware_families"),
            }
            score = Common.DBotScore.NONE
            malicious = None
            if res.get("found"):
                if res.get("verdict"):
                    score = Common.DBotScore.BAD
                    malicious = "THF Polygon score: {}".format(res.get("score"))
                    if res.get("malware_families"):
                        malicious += ", {}".format(", ".join(res.get("malware_families", [])))
                else:
                    score = Common.DBotScore.GOOD
            dbot_score = Common.DBotScore(
                indicator=file,
                indicator_type=DBotScoreType.FILE,
                integration_name=INTEGRATION_NAME,
                score=score,
                malicious_description=malicious,
                reliability=demisto.params().get("integrationReliability"),
            )
            indicator = Common.File(**{hash_type: file, "dbot_score": dbot_score})
            result = CommandResults(
                outputs_prefix="Polygon.Analysis",
                outputs_key_field=hash_type.upper(),
                outputs=analysis_info,
                indicator=indicator,
                raw_response=res,
            )
            all_results.append(result)
    return all_results


def test_module(client):
    client.get_attach()
    return "ok"


def main():
    """
    PARSE AND VALIDATE INTEGRATION PARAMS
    """
    params = demisto.params()
    base_url = params.get("server")
    api_key = params.get("api_key")
    verify_certificate = not params.get("insecure", False)
    report_language = LANGUAGE_TO_CODE[params.get("report_language")]

    # Remove proxy if not set to true in params
    handle_proxy()

    command = demisto.command()
    LOG(f"Command being called is {command}")
    try:
        client = Client(base_url=base_url, api_key=api_key, verify=verify_certificate, language=report_language)
        commands = {
            "polygon-upload-file": upload_file_command,
            "polygon-upload-url": upload_url_command,
            "polygon-analysis-info": analysis_info_command,
            "polygon-export-report": export_report_command,
            "polygon-export-pcap": export_pcap_command,
            "polygon-export-video": export_video_command,
            "file": file_command,
        }

        if command == "test-module":
            return_results(test_module(client))
        elif command in ["polygon-export-report", "polygon-export-pcap", "polygon-export-video"]:
            commands[command](client, demisto.args())
        elif command in ["polygon-analysis-info", "file"]:
            results = commands[command](client, demisto.args())
            for r in results:
                return_results(r)
        elif command in ["polygon-upload-file", "polygon-upload-url"]:
            return_results(commands[command](client, demisto.args()))

    # Log exceptions
    except Exception as err:
        return_error(f"Failed to execute {command} command. Error: {err!s}")


if __name__ in ("__main__", "__builtin__", "builtins"):
    main()