Detonate File - HybridAnalysis

Deprecated. Use cs-falcon-sandbox-submit-sample with polling=true instead.

Inputs

File — File object of the file to detonate. The File is taken from the context.
Interval — Duration for executing the pooling (in minutes)
Timeout — The duration after which to stop pooling and to resume the playbook (in minutes)
Systems — Operating system to run the analysis on (comma-separated). Supported values are: w7, w7x64, w7_1, w7_2, w7native, android2, android3, mac1, w7l, w7x64l, w10, android4, w7x64native, w7_3, w10native, android5native_1, w7_4, w7_5, w10x64, w7x64_hvm, android6, iphone1, w7_sec, macvm, w7_lang_packs, w7x64native_hvm, lnxubuntu1, lnxcentos1, android7_nougat
Comments — Comments for the analysis.
InternetAccess — Enable internet access (boolean). True= internet access (default), False= no internet access.
ReportFileType — The resource type to download. Default is html. Supported values are: html, lighthtml, executive, pdf, classhtml, xml, lightxml, classxml, clusterxml, irxml, json, jsonfixed, lightjson, lightjsonfixed, irjson, irjsonfixed, shoots (screenshots), openioc, maec, misp, graphreports, memstrings, binstrings, sample, cookbook, bins (dropped files), unpackpe (unpacked PE files), unpack, ida, pcap, pcapslim, memdumps, yara
EnvironmentID — Hybrid Analysis environment ID to submit file to

File.SHA256 — SHA256 of the file
File.SHA1 — SHA1 of the file
File.MD5 — MD5 of the file
File.environmentId — Environment id of the file
File.analysis_start_time — Analysis start time of the file
File.submitname — Submission name of the file
File.classification_tags — List of classification tags of the file
File.vxfamily — Family classification of the file
File.total_network_connections — Total network connections of the file
File.total_processes — Total processes count of the file
File.total_signatures — Total signatures count if the file
File.hosts — List of file's hosts
File.isinteresting — If server found this file interesting
File.domains — List of file's related domains
File.isurlanalysis — If file analyzed by url
File.Malicious.Vendor — or malicious files, the vendor that made the decision
File.Malicious.Description — For malicious files, the reason for the vendor to make the decision
HybridAnalysis.Submit.State — The state of the process
HybridAnalysis.Submit.SHA256 — The submission SHA256
HybridAnalysis.Submit.JobID — The JobID of the submission
HybridAnalysis.Submit.EnvironmentID — The environmentID of the submission