Detonate URL - ThreatStream

Detonates one or more URLs using the Anomali ThreatStream sandbox integration. Returns relevant reports to the War Room and URL reputations to the context data.

Pack

Anomali_ThreatStream

Tasks

7

Inputs

• URL — URL to detonate.
• Interval — How often to execute polling (in minutes).
• Timeout — The duration after which to stop polling and to resume the playbook (in minutes).
• VM — The VM to use (string)
• SubmissionClassification — Classification of the sandbox submission.
• PremiumSandbox — Specifies if the premium sandbox should be used for detonation.
• Tags — A CSV list of tags applied to this sample.

Outputs

• ThreatStream.Analysis.ReportID — The report ID submitted to the sandbox.
• ThreatStream.Analysis.Status — The analysis status.
• ThreatStream.Analysis.Platform — The platform of the submission submitted to the sandbox.
• ThreatStream.Analysis.Category — The report category.
• ThreatStream.Analysis.Started — The detonation start time.
• ThreatStream.Analysis.Completed — The detonation completion time.
• ThreatStream.Analysis.Duration — The duration of the detonation (in seconds).
• ThreatStream.Analysis.VmName — The VM name.
• ThreatStream.Analysis.VmID — The VM ID.
• ThreatStream.Analysis.Verdict — The verdict of the sandbox detonation.
• ThreatStream.Analysis.Network.UdpSource — The UDP source.
• ThreatStream.Analysis.Network.UdpDestination — The UDP destination.
• ThreatStream.Analysis.Network.UdpPort — The UDP port.
• ThreatStream.Analysis.Network.IcmpSource — The ICMP source.
• ThreatStream.Analysis.Network.IcmpDestination — The ICMP destination.
• ThreatStream.Analysis.Network.IcmpPort — The ICMP port.
• ThreatStream.Analysis.Network.TcpSource — The TCP source.
• ThreatStream.Analysis.Network.TcpDestination — The TCP destination.
• ThreatStream.Analysis.Network.TcpPort — The TCP port.
• ThreatStream.Analysis.Network.HttpSource — The source of the HTTP address.
• ThreatStream.Analysis.Network.HttpDestinaton — The destination of the HTTP address.
• ThreatStream.Analysis.Network.HttpPort — The port of the HTTP address.
• ThreatStream.Analysis.Network.HttpsSource — The source of the HTTPS address.
• ThreatStream.Analysis.Network.HttpsDestinaton — The destination of the HTTPS address.
• ThreatStream.Analysis.Network.HttpsPort — The port of the HTTPS address.
• ThreatStream.Analysis.Network.Hosts — The network analysis hosts.

Commands used

• threatstream-analysis-report
• threatstream-submit-to-sandbox