Detonate URL - McAfee ATD

Detonates a URL using the McAfee Advanced Threat Defense sandbox integration.

Pack: McAfee_Advanced_Threat_Defense
Tasks: 10

Inputs

URL — URL to detonate.
Interval — Polling frequency - how often the polling command should run (minutes)
Timeout — How much time to wait before a timeout occurs (minutes)

Outputs

ATD.Task.taskId — The task ID of the sample uploaded
ATD.Task.jobId — The job ID of the sample uploaded
ATD.Task.messageId — The message Id relevant to the sample uploaded
ATD.Task.url — The URL detonated
ATD.Task.srcIp — Source IPv4 address
ATD.Task.destIp — Destination IPv4 address
ATD.Task.MD5 — MD5 of the sample uploaded
ATD.Task.SHA1 — SHA1 of the sample uploaded
ATD.Task.SHA256 — SHA256 of the sample uploaded
File.Name — Filename (only in case of report type=json)
File.Type — File type e.g. "PE" (only in case of report type=json)
File.MD5 — MD5 hash of the file (only in case of report type=json)
File.SHA1 — SHA1 hash of the file (only in case of report type=json)
File.SHA256 — SHA256 hash of the file (only in case of report type=json)
File.EntryID — The Entry ID of the sample
DBotScore.Indicator — The indicator we tested (only in case of report type=json)
DBotScore.Type — The type of the indicator (only in case of report type=json)
DBotScore.Vendor — Vendor used to calculate the score (only in case of report type=json)
DBotScore.Score — The actual score (only in case of report type=json)
IP.Address — IP's relevant to the sample
InfoFile.EntryID — The EntryID of the report file
InfoFile.Extension — The extension of the report file
InfoFile.Name — The name of the report file
InfoFile.Info — The info of the report file
InfoFile.Size — The size of the report file
InfoFile.Type — The type of the report file
File — File object
File.Malicious — File Malicious object
DBotScore — DBotScore object
InfoFile — Report file object
URL.Malicious — URL Malicious object

Commands used

atd-check-status
atd-file-upload
atd-get-report