Detonate Remote File from URL - McAfee ATD

Detonates a File from a URL using the McAfee Advanced Threat Defense sandbox integration.

Pack

McAfee_Advanced_Threat_Defense

Tasks

10

Inputs

• URL — URL to detonate.
• Interval — Polling frequency - how often the polling command should run (minutes)
• Timeout — How much time to wait before a timeout occurs (minutes)

Outputs

• ATD.Task.taskId — The task ID of the sample uploaded
• ATD.Task.jobId — The job ID of the sample uploaded
• ATD.Task.messageId — The message Id relevant to the sample uploaded
• ATD.Task.url — The URL detonated
• ATD.Task.srcIp — Source IPv4 address
• ATD.Task.destIp — Destination IPv4 address
• ATD.Task.MD5 — MD5 of the sample uploaded
• ATD.Task.SHA1 — SHA1 of the sample uploaded
• ATD.Task.SHA256 — SHA256 of the sample uploaded
• File.Name — Filename (only in case of report type=json)
• File.Type — File type e.g. "PE" (only in case of report type=json)
• File.MD5 — MD5 hash of the file (only in case of report type=json)
• File.SHA1 — SHA1 hash of the file (only in case of report type=json)
• File.SHA256 — SHA256 hash of the file (only in case of report type=json)
• File.EntryID — The Entry ID of the sample
• DBotScore.Indicator — The indicator we tested (only in case of report type=json)
• DBotScore.Type — The type of the indicator (only in case of report type=json)
• DBotScore.Vendor — Vendor used to calculate the score (only in case of report type=json)
• DBotScore.Score — The actual score (only in case of report type=json)
• IP.Address — IP's relevant to the sample
• InfoFile.EntryID — The EntryID of the report file
• InfoFile.Extension — The extension of the report file
• InfoFile.Name — The name of the report file
• InfoFile.Info — The info of the report file
• InfoFile.Size — The size of the report file
• InfoFile.Type — The type of the report file
• File — File object
• File.Malicious — File Malicious object
• DBotScore — DBotScore object
• InfoFile — Report file object
• URL.Malicious — URL Malicious object

Commands used

• atd-check-status
• atd-file-upload
• atd-get-report