File Reputation
This playbook checks the file reputation and sets the verdict as a new context key. The verdict is composed by 3 main components: * VirusTotal detection rate * Digital certificate signers * NSRL DB Note: a user can provide a list of trusted signers of his own using the playbook inputs
- Pack
- CommonPlaybooks
- Tasks
- 24
Inputs
- DetectionThreshold — The minimum number of positive engines needed to mark file as malicious.
- TrustedPublishers — A list of trusted publishers
- FileSHA256 — The file SHA256.
Outputs
- VTFileVerdict — VirusTotal file verdict.
- NSRLFileVerdict — NSRL file verdict.
- VTFileSigners — VirusTotal file signers.
- XDRFileSigners — XDR file signers.
- WildFire.Report — WildFire report details.
- WildFire.Verdicts — WildFire verdict.
Commands used
- file
- wildfire-get-verdict
- wildfire-report