Trend Micro Deep Discovery Analyzer

TrendAI™ Deep Discovery™ Analyzer is a turnkey appliance that uses virtual images of endpoint configurations to analyze and detect targeted attacks.

Forensics & Malware Analysis · TrendAI™ Deep Discovery™ Analyzer

Details

IDTrend Micro Deep Discovery Analyzer
ProviderTrendAI™
CategoryForensics & Malware Analysis
From Version5.0.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

trendmicro-dda-get-sample

Retrieves a sample

Base Command

trendmicro-dda-get-sample

Input

Argument Name Description Required
sha1 The SHA1 of the sample to get. Required
type The export data type. Possible values are: tgz, zip. Default is zip. Optional
encrypted 0 (not encrypted) or 1 (Encrypted with password “virus”). Possible values are: 0, 1. Default is 0. Optional
archive_name A name for the retrieved archive. Optional

Context Output

Path Type Description
File.EntryID string Demisto entry ID of archive
File.Size number File size
File.SHA1 string File SHA1
File SHA256 string File SHA256
File.Name string File name
File.SSDeep string File SSDeep
File.Info string File info
File.Type string File type
File.MD5 string File MD5
File.Extension string File extension

trendmicro-dda-get-report

Retrieves XML report of a given submission

Base Command

trendmicro-dda-get-report

Input

Argument Name Description Required
sha1 The SHA1 of the submission. Required
threshold DDA severity score (greater or equal to) for which the submission will be considered malicious. Possible values are: 0, 1, 2, 3. Default is 1. Optional
verbose Return detailed report. Possible values are: false, true. Default is false. Optional

Context Output

Path Type Description
TrendMicroDDA.Submission.Status string The status of the submission
TrendMicroDDA.Submission.SHA1 string SHA1 of the submission
TrendMicroDDA.Submission.RiskLevel number The Risk Level of the submission
DBotScore.Score number The actual score
DBotScore.Indicator string The indicator we tested
DBotScore.Type string The type of the indicator
DBotScore.Vendor string Vendor used to calculate the score
InfoFile.MD5 string MD5 hash of the report file
InfoFile.SHA1 string SHA1 hash of the report file
InfoFile.SHA256 string SHA256 hash of the report file
InfoFile.Name string Report file name
InfoFile.Type string Report file type e.g. “PE”
InfoFile.Size number Report file size
File.Malicious.Vendor string For malicious files, the vendor that made the decision
File.Malicious.Description string For malicious files, the reason for the vendor to make the decision
IP.Address string IPs relevant to the submission
Domain.Name string Domains relevant to the submission
URL.Data string URL data
File.MD5 string MD5 hash of the file
File.SHA1 string SHA1 hash of the file
File.SHA256 string SHA256 hash of the file
File.Size number File size
File.Name string File name
TrendMicroDDA.Submission.SHA256 string SHA256 of the submission
TrendMicroDDA.Submission.MD5 string MD5 of the submission
TrendMicroDDA.Submission.VirusDetected boolean True if virus detected, else Flase
TrendMicroDDA.Submission.DownloadURL string Download URL address of files

trendmicro-dda-get-sample-list

Retrieves a list of SHA1 of samples submitted within the given time interval

Base Command

trendmicro-dda-get-sample-list

Input

Argument Name Description Required
interval_start Interval start time, given in format ~~YYYY-MM-DD HH:MM:SS, e.g. 2008-11-22 19:53:42. Required
interval_end Interval end time, given in format YYYY-MM-DD HH:MM:SS, e.g. 2008-11-22 19:53:42. Required
interval_type 0: Submission time, 1: Completion time. Possible values are: 0, 1. Default is 0. Optional

Context Output

There is no context output for this command.

trendmicro-dda-check-status

Checks the analysis status of the submissions

Base Command

trendmicro-dda-check-status

Input

Argument Name Description Required
sha1 The SHA1 of the submissions. Example: “2492A18532745251FBC5DAF7160DAA49B90DBBE1, 52483514F07EB14570142F6927B77DEB7B4DA99F”. Required

Context Output

Path Type Description
TrendMicroDDA.Submission.Status string The status of the submission
TrendMicroDDA.Submission.SHA1 string The SHA1 of the submission

trendmicro-dda-upload-url

Upload a URL to TrendAI™ DDA

Base Command

trendmicro-dda-upload-url

Input

Argument Name Description Required
url The URL to upload. Required

Context Output

Path Type Description
TrendMicroDDA.Submission.SHA1 string The SHA1 of the submission
TrendMicroDDA.Submission.URL string The submitted URL

trendmicro-dda-upload-file

Upload a file to TrendAI™ DDA

Base Command

trendmicro-dda-upload-file

Input

Argument Name Description Required
entryID EntryID of the file to upload. Required

Context Output

Path Type Description
TrendMicroDDA.Submission.SHA1 string The SHA1 of the submission

trendmicro-dda-get-brief-report

Retrieves a brief XML report of a given submission

Base Command

trendmicro-dda-get-brief-report

Input

Argument Name Description Required
sha1 SHA1 of the submission. Required
threshold DDA severity score (greater or equal to) for which the submission will be considered malicious. Possible values are: 0, 1, 2, 3. Default is 1. Optional

Context Output

There is no context output for this command.

Configuration parameters

  • server — DDA Server and Port (e.g https://192.168.0.1:<port>) (required)
  • ip_address — Internal IP address (only needed if the server URL is external)
  • apiKey — API Key
  • credentials_api_key —
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • protocol_version — Protocol Version

Commands (8)

  • trendmicro-dda-check-status

    Checks the analysis status of the submissions

  • trendmicro-dda-get-brief-report

    Retrieves a brief XML report of a given submission

  • trendmicro-dda-get-openioc Deprecated

    Retrieves IOC for a given submission, returns an error if submission has no IOC

  • trendmicro-dda-get-report

    Retrieves XML report of a given submission

  • trendmicro-dda-get-sample

    Retrieves a sample

  • trendmicro-dda-get-sample-list

    Retrieves a list of SHA1 of samples submitted within the given time interval

  • trendmicro-dda-upload-file

    Upload a file to TrendAI™ DDA

  • trendmicro-dda-upload-url

    Upload a URL to TrendAI™ DDA

Source

TrendMicroDDA.py TrendMicroDDA_test.py TrendMicroDDA.yml TrendMicroDDA_description.md
Download History Raw 
commonfields:
  id: Trend Micro Deep Discovery Analyzer
  version: -1
sectionorder:
- Connect
- Collect
name: Trend Micro Deep Discovery Analyzer
display: TrendAI™ Deep Discovery™ Analyzer (Beta)
category: Forensics & Malware Analysis
provider: TrendAI™
description: TrendAI™ Deep Discovery™ Analyzer is a turnkey appliance that uses virtual images of endpoint configurations to analyze and detect targeted attacks.
configuration:
- display: DDA Server and Port  (e.g https://192.168.0.1:<port>)
  name: server
  defaultvalue: ""
  type: 0
  required: true
  section: Connect
- display: Internal IP address (only needed if the server URL is external)
  name: ip_address
  defaultvalue: ""
  type: 0
  section: Connect
  required: false
- display: API Key
  name: apiKey
  defaultvalue: ""
  type: 4
  required: false
  section: Connect
  hidden: true
- displaypassword: API Key
  name:  credentials_api_key
  required: false
  hiddenusername: true
  section: Connect
  type: 9
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- display: Protocol Version
  name: protocol_version
  defaultvalue: "1.5"
  type: 0
  required: false
  section: Connect
script:
  script: ''
  type: python
  subtype: python3
  commands:
  - name: trendmicro-dda-get-sample
    arguments:
    - name: sha1
      required: true
      description: The SHA1 of the sample to get.
    - name: type
      auto: PREDEFINED
      predefined:
      - tgz
      - zip
      description: The export data type.
      defaultValue: zip
    - name: encrypted
      auto: PREDEFINED
      predefined:
      - "0"
      - "1"
      description: '0 (not encrypted) or 1 (Encrypted with password "virus").'
      defaultValue: "0"
    - name: archive_name
      description: A name for the retrieved archive.
    outputs:
    - contextPath: File.EntryID
      description: Demisto entry ID of archive.
      type: string
    - contextPath: File.Size
      description: File size.
      type: number
    - contextPath: File.SHA1
      description: File SHA1.
      type: string
    - contextPath: File SHA256
      description: File SHA256.
      type: string
    - contextPath: File.Name
      description: File name.
      type: string
    - contextPath: File.SSDeep
      description: File SSDeep.
      type: string
    - contextPath: File.Info
      description: File info.
      type: string
    - contextPath: File.Type
      description: File type.
      type: string
    - contextPath: File.MD5
      description: File MD5.
      type: string
    - contextPath: File.Extension
      description: File extension.
      type: string
    description: Retrieves a sample
  - name: trendmicro-dda-get-openioc
    deprecated: true
    arguments:
    - name: sha1
      description: SHA1 of the submission.
    description: Retrieves IOC for a given submission, returns an error if submission has no IOC
  - name: trendmicro-dda-get-report
    arguments:
    - name: sha1
      required: true
      description: The SHA1 of the submission.
    - name: threshold
      auto: PREDEFINED
      predefined:
      - "0"
      - "1"
      - "2"
      - "3"
      description: DDA severity score (greater or equal to) for which the submission will be considered malicious.
      defaultValue: "1"
    - name: verbose
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Return detailed report.
      defaultValue: "false"
    outputs:
    - contextPath: TrendMicroDDA.Submission.Status
      description: The status of the submission.
      type: string
    - contextPath: TrendMicroDDA.Submission.SHA1
      description: SHA1 of the submission.
      type: string
    - contextPath: TrendMicroDDA.Submission.RiskLevel
      description: The Risk Level of the submission.
      type: number
    - contextPath: DBotScore.Score
      description: The actual score.
      type: number
    - contextPath: DBotScore.Indicator
      description: The indicator we tested.
      type: string
    - contextPath: DBotScore.Type
      description: The type of the indicator.
      type: string
    - contextPath: DBotScore.Vendor
      description: Vendor used to calculate the score.
      type: string
    - contextPath: InfoFile.MD5
      description: MD5 hash of the report file.
      type: string
    - contextPath: InfoFile.SHA1
      description: SHA1 hash of the report file.
      type: string
    - contextPath: InfoFile.SHA256
      description: SHA256 hash of the report  file.
      type: string
    - contextPath: InfoFile.Name
      description: Report file name.
      type: string
    - contextPath: InfoFile.Type
      description: Report file type e.g. "PE".
      type: string
    - contextPath: InfoFile.Size
      description: Report file size.
      type: number
    - contextPath: File.Malicious.Vendor
      description: For malicious files, the vendor that made the decision.
      type: string
    - contextPath: File.Malicious.Description
      description: For malicious files, the reason for the vendor to make the decision.
      type: string
    - contextPath: IP.Address
      description: IPs relevant to the submission.
      type: string
    - contextPath: Domain.Name
      description: Domains relevant to the submission.
      type: string
    - contextPath: URL.Data
      description: URL data.
      type: string
    - contextPath: File.MD5
      description: MD5 hash of the file.
      type: string
    - contextPath: File.SHA1
      description: SHA1 hash of the file.
      type: string
    - contextPath: File.SHA256
      description: SHA256 hash of the file.
      type: string
    - contextPath: File.Size
      description: File size.
      type: number
    - contextPath: File.Name
      description: File name.
      type: string
    - contextPath: TrendMicroDDA.Submission.SHA256
      description: SHA256 of the submission.
      type: string
    - contextPath: TrendMicroDDA.Submission.MD5
      description: MD5 of the submission.
      type: string
    - contextPath: TrendMicroDDA.Submission.VirusDetected
      description: True if virus detected, else Flase.
      type: boolean
    - contextPath: TrendMicroDDA.Submission.DownloadURL
      description: Download URL address of files.
      type: string
    description: Retrieves XML report of a given submission
  - name: trendmicro-dda-get-sample-list
    arguments:
    - name: interval_start
      required: true
      description: Interval start time, given in format ~~YYYY-MM-DD HH:MM:SS, e.g. 2008-11-22 19:53:42.
    - name: interval_end
      required: true
      description: Interval end time, given in format YYYY-MM-DD HH:MM:SS, e.g. 2008-11-22 19:53:42.
    - name: interval_type
      auto: PREDEFINED
      predefined:
      - "0"
      - "1"
      description: '0: Submission time, 1: Completion time.'
      defaultValue: "0"
    description: Retrieves a list of SHA1 of samples submitted within the given time interval
  - name: trendmicro-dda-check-status
    arguments:
    - name: sha1
      required: true
      description: 'The SHA1 of the submissions. Example: "2492A18532745251FBC5DAF7160DAA49B90DBBE1,  52483514F07EB14570142F6927B77DEB7B4DA99F".'
      isArray: true
    outputs:
    - contextPath: TrendMicroDDA.Submission.Status
      description: The status of the submission.
      type: string
    - contextPath: TrendMicroDDA.Submission.SHA1
      description: The SHA1 of the submission.
      type: string
    description: Checks the analysis status of the submissions
  - name: trendmicro-dda-upload-url
    arguments:
    - name: url
      required: true
      description: The URL to upload.
      isArray: true
    outputs:
    - contextPath: TrendMicroDDA.Submission.SHA1
      description: The SHA1 of the submission.
      type: string
    - contextPath: TrendMicroDDA.Submission.URL
      description: The submitted URL.
      type: string
    description: 'Upload a URL to TrendAI™ DDA '
  - name: trendmicro-dda-upload-file
    arguments:
    - name: entryID
      required: true
      description: EntryID of the file to upload.
      isArray: true
    outputs:
    - contextPath: TrendMicroDDA.Submission.SHA1
      description: The SHA1 of the submission.
      type: string
    description: 'Upload a file to TrendAI™ DDA '
  - name: trendmicro-dda-get-brief-report
    arguments:
    - name: sha1
      required: true
      description: SHA1 of the submission.
    - name: threshold
      auto: PREDEFINED
      predefined:
      - "0"
      - "1"
      - "2"
      - "3"
      description: DDA severity score (greater or equal to) for which the submission will be considered malicious.
      defaultValue: "1"
    description: Retrieves a brief XML report of a given submission
  runonce: false
  dockerimage: demisto/python3:3.12.13.10116658
beta: true
tests:
- No Test - run "Test Playbook TrendMicroDDA" manually
fromversion: 5.0.0