Detonate and Analyze File - Generic

This playbook uploads, detonates, and analyzes files for supported sandboxes. Currently supported sandboxes are Falcon Intelligence Sandbox, JoeSecurity, and Wildfire.

Pack

CommonPlaybooks

Tasks

18

Inputs

• File — The details of the file to search for.

Outputs

• csfalconx.resource.tags — The analysis tags.
• csfalconx.resource.sha256 — The SHA256 hash of the scanned file.
• csfalconx.resource.file_name — The name of the uploaded file.
• csfalconx.resource.sandbox — The Falcon Intelligence Sandbox findings.
• csfalconx.resource.intel — The Falcon Intelligence Sandbox intelligence results.
• WildFire.Report — The Wildfire findings.
• AttackPattern — The MITRE Attack pattern information.
• MITREATTACK — Full MITRE data for the attack pattern.
• DBotScore — DBotScore object.
• Joe.Analysis — Joe Analysis object.
• DBotScore.Vendor — The vendor used to calculate the score.
• DBotScore.Indicator — The indicator that was tested.
• DBotScore.Type — The indicator type.
• DBotScore.Score — The actual score.
• DBotScore.Malicious — DBotScore Malicious object
• DBotScore.Malicious.Vendor — The vendor used to calculate the score.
• DBotScore.Malicious.Detections — The sub analysis detection statuses
• DBotScore.Malicious.SHA1 — The SHA1 of the file
• Joe.Analysis.ID — Web ID
• Joe.Analysis.Status — Analysis Status
• Joe.Analysis.Comments — Analysis Comments
• Joe.Analysis.Time — Submitted Time
• Joe.Analysis.Runs — Sub-Analysis Information
• Joe.Analysis.Result — Analysis Results
• Joe.Analysis.Errors — Raised errors during sampling
• Joe.Analysis.Systems — Analysis OS
• Joe.Analysis.MD5 — MD5 of analysis sample
• Joe.Analysis.SHA1 — SHA1 of analysis sample
• Joe.Analysis.SHA256 — SHA256 of analysis sample
• Joe.Analysis.SampleName — Sample Data, could be a file name or URL
• InfoFile — Report file object
• InfoFile.Name — The filename.
• InfoFile.EntryID — The entry ID of the report.
• InfoFile.Size — File size.
• InfoFile.Type — File type, e.g., "PE".
• InfoFile.Info — Basic information of the file.
• InfoFile.Extension — The extension of the image file.
• File — File object
• File.Extension — File extension.
• File.MD5 — The MD5 hash of the file.
• File.Name — The full file name.
• File.SHA1 — The SHA1 hash of the file.
• File.SHA256 — The SHA256 hash of the file.
• ExtractedIndicators — outputs.extractindicators
• AttackPattern.STIXID — The STIX ID of the Attack Pattern.
• AttackPattern.KillChainPhases — The kill chain phases of the Attack Pattern.
• AttackPattern.FirstSeenBySource — The first seen by source of the Attack Pattern.
• AttackPattern.Description — The description of the Attack Pattern.
• AttackPattern.OperatingSystemRefs — The operating system references of the Attack Pattern.
• AttackPattern.Publications — The publications of the Attack Pattern.
• AttackPattern.MITREID — The MITRE ID of the Attack Pattern.
• AttackPattern.Tags — The tags of the Attack Pattern.

Commands used

• attack-pattern
• extractIndicators
• joe-download-report
• rasterize-pdf