Detonate File - VMRay

Detonates a file with VMRay.

VMRay Analyzer · 15 tasks · 3 inputs · 61 outputs

Details

ID79b5d8a6-2636-480c-8e1c-a3ab2e58ffb5
From Version5.0.0
Tasks15

README

Detonates a file with VMRay.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • GenericPolling

Integrations

  • VMRay

Scripts

  • IsIntegrationAvailable

Commands

  • vmray-get-analysis-by-sample
  • vmray-get-iocs
  • vmray-get-sample
  • vmray-get-submission
  • vmray-get-threat-indicators
  • vmray-upload-sample

Playbook Inputs

Name Description Default Value Required
File The file to detonate. ${File} Optional
interval The frequency in which to poll for results (minutes). 1 Optional
timeout The amount of time to wait before giving up waiting for results (minutes). 10 Optional
document_password The password if the file is a password-protected document.   Optional
archive_password The password if the file is a password-protected archive.   Optional
sample_type The sample type.   Optional
shareable Whether to make the file shareable.   Optional
max_jobs The maximum jobs to create in VMRay.   Optional
tags The tags of the file (comma-separated).   Optional

Playbook Outputs

Path Description Type
VMRay.Job.JobID The ID of a new job. number
VMRay.Job.SampleID The ID of sample. number
VMRay.Job.Created The timestamp of the created job. date
VMRay.Job.VMName The name of virtual machine. string
VMRay.Job.VMID The ID of virtual machine. number
VMRay.Sample.SampleID The sample ID of the task. number
VMRay.Sample.Created The timestamp of the created sample. date
VMRay.Submission.SubmissionID The submission ID. number
VMRay.Submission.HadErrors Whether there are any errors in the submission. boolean
VMRay.Submission.IsFinished The status of submission. Can be, “true” or “false”. boolean
VMRay.Submission.MD5 The MD5 hash of the sample in submission. string
VMRay.Submission.SHA1 The SHA1 hash of the sample in submission. string
VMRay.Submission.SHA256 The SHA256 hash of the sample in submission. string
VMRay.Submission.Verdict Verdict for the sample (Malicious, Suspicious, Clean, Not Available). String
VMRay.Submission.VerdictReason Description of the Verdict Reason. String
VMRay.Submission.Severity Severity of the sample (Malicious, Suspicious, Good, Blacklisted, Whitelisted, Unknown). Deprecated. string
VMRay.Submission.SSDeep The SSDeep hash of the sample in submission. string
VMRay.Submission.SampleID The ID of the sample in submission. number
VMRay.Sample.FileName The file name of the sample. string
VMRay.Sample.MD5 The MD5 hash of the sample. string
VMRay.Sample.SHA1 The SHA1 hash of the sample. string
VMRay.Sample.SHA256 The SHA256 hash of the sample. string
VMRay.Sample.SSDeep The SSDeep of the sample. string
VMRay.Sample.Verdict Verdict for the sample (Malicious, Suspicious, Clean, Not Available). String
VMRay.Sample.VerdictReason Description of the Verdict Reason. String
VMRay.Sample.Severity Severity of the sample (Malicious, Suspicious, Good, Blacklisted, Whitelisted, Unknown). Deprecated. string
VMRay.Sample.Type The file type. string
VMRay.Sample.Classifications The classifications of the sample. string
VMRay.Sample.IOC.URL.AnalysisID The IDs of the other analyses that contain the given URL. number
VMRay.Sample.IOC.URL.URL The URL. unknown
VMRay.Sample.IOC.URL.Operation The operation of the specified URL. unknown
VMRay.Sample.IOC.URL.ID The ID of the URL. unknown
VMRay.Sample.IOC.URL.Type The type of the URL. unknown
VMRay.Sample.IOC.Domain.AnalysisID The IDs of the other analyses that contain the given domain. unknown
VMRay.Sample.IOC.Domain.Domain The domain. unknown
VMRay.Sample.IOC.Domain.ID The ID of the domain. unknown
VMRay.Sample.IOC.Domain.Type The type of the domain. unknown
VMRay.Sample.IOC.IP.AnalysisID The IDs of the other analyses that contain the given IP address. unknown
VMRay.Sample.IOC.IP.IP The IP address. unknown
VMRay.Sample.IOC.IP.Operation The operation of the given IP address. unknown
VMRay.Sample.IOC.IP.ID The ID of the IP address. unknown
VMRay.Sample.IOC.IP.Type The type of the IP address. unknown
VMRay.Sample.IOC.Mutex.AnalysisID The IDs of other analyses that contain the given IP address. unknown
VMRay.Sample.IOC.Mutex.Name The name of the mutex. unknown
VMRay.Sample.IOC.Mutex.Operation The operation of the given mutex unknown
VMRay.Sample.IOC.Mutex.ID The ID of the mutex. unknown
VMRay.Sample.IOC.Mutex.Type The type of the mutex. unknown
VMRay.Sample.IOC.File.AnalysisID The IDs of other analyses that contain the given file. unknown
VMRay.Sample.IOC.File.Name The name of the file. unknown
VMRay.Sample.IOC.File.Operation The operation of the given file. unknown
VMRay.Sample.IOC.File.ID The ID of the file. unknown
VMRay.Sample.IOC.File.Type The type of the file. unknown
VMRay.Sample.IOC.File.Hashes.MD5 The MD5 hash of the given file. unknown
VMRay.Sample.IOC.File.Hashes.SSDeep The SSDeep hash of the given file. unknown
VMRay.Sample.IOC.File.Hashes.SHA256 The SHA256 hash of the given file. unknown
VMRay.Sample.IOC.File.Hashes.SHA1 The SHA1 hash of the given file. unknown
VMRay.ThreatIndicator.AnalysisID The list of connected analysis IDs. unknown
VMRay.ThreatIndicator.Category The category of threat indicators. unknown
VMRay.ThreatIndicator.Classification The classifications of threat indicators. unknown
VMRay.ThreatIndicator.ID The ID of the threat indicator. unknown
VMRay.ThreatIndicator.Operation The operation that caused the indicators. unknown

Playbook Image

Detonate File - VMRay

Inputs

  • File — The file to detonate.
  • interval — The frequency in which to poll for results (minutes).
  • timeout — The amount of time to wait before giving up waiting for results (minutes).

Outputs

  • VMRay.Job.JobID — The ID of a new job.
  • VMRay.Job.SampleID — The ID of sample.
  • VMRay.Job.Created — The timestamp of the created job.
  • VMRay.Job.VMName — The name of virtual machine.
  • VMRay.Job.VMID — The ID of virtual machine.
  • VMRay.Sample.SampleID — The sample ID of the task.
  • VMRay.Sample.Created — The timestamp of the created sample.
  • VMRay.Submission.SubmissionID — The submission ID.
  • VMRay.Submission.HadErrors — Whether there are any errors in the submission.
  • VMRay.Submission.IsFinished — The status of submission. Can be, "true" or "false".
  • VMRay.Submission.MD5 — The MD5 hash of the sample in submission.
  • VMRay.Submission.SHA1 — The SHA1 hash of the sample in submission.
  • VMRay.Submission.SHA256 — The SHA256 hash of the sample in submission.
  • VMRay.Submission.Verdict — Verdict for the sample (Malicious, Suspicious, Clean, Not Available).
  • VMRay.Submission.VerdictReason — Description of the Verdict Reason.
  • VMRay.Submission.Severity — Severity of the sample (Malicious, Suspicious, Good, Blacklisted, Whitelisted, Unknown). Deprecated.
  • VMRay.Submission.SSDeep — The SSDeep hash of the sample in submission.
  • VMRay.Submission.SampleID — The ID of the sample in submission.
  • VMRay.Sample.FileName — The file name of the sample.
  • VMRay.Sample.MD5 — The MD5 hash of the sample.
  • VMRay.Sample.SHA1 — The SHA1 hash of the sample.
  • VMRay.Sample.SHA256 — The SHA256 hash of the sample.
  • VMRay.Sample.SSDeep — The SSDeep of the sample.
  • VMRay.Sample.Verdict — Verdict for the sample (Malicious, Suspicious, Clean, Not Available).
  • VMRay.Sample.VerdictReason — Description of the Verdict Reason.
  • VMRay.Sample.Severity — Severity of the sample (Malicious, Suspicious, Good, Blacklisted, Whitelisted, Unknown). Deprecated.
  • VMRay.Sample.Type — The file type.
  • VMRay.Sample.Classifications — The classifications of the sample.
  • VMRay.Sample.IOC.URL.AnalysisID — The IDs of the other analyses that contain the given URL.
  • VMRay.Sample.IOC.URL.URL — The URL.
  • VMRay.Sample.IOC.URL.Operation — The operation of the specified URL.
  • VMRay.Sample.IOC.URL.ID — The ID of the URL.
  • VMRay.Sample.IOC.URL.Type — The type of the URL.
  • VMRay.Sample.IOC.Domain.AnalysisID — The IDs of the other analyses that contain the given domain.
  • VMRay.Sample.IOC.Domain.Domain — The domain.
  • VMRay.Sample.IOC.Domain.ID — The ID of the domain.
  • VMRay.Sample.IOC.Domain.Type — The type of the domain.
  • VMRay.Sample.IOC.IP.AnalysisID — The IDs of the other analyses that contain the given IP address.
  • VMRay.Sample.IOC.IP.IP — The IP address.
  • VMRay.Sample.IOC.IP.Operation — The operation of the given IP address.
  • VMRay.Sample.IOC.IP.ID — The ID of the IP address.
  • VMRay.Sample.IOC.IP.Type — The type of the IP address.
  • VMRay.Sample.IOC.Mutex.AnalysisID — The IDs of other analyses that contain the given IP address.
  • VMRay.Sample.IOC.Mutex.Name — The name of the mutex.
  • VMRay.Sample.IOC.Mutex.Operation — The operation of the given mutex
  • VMRay.Sample.IOC.Mutex.ID — The ID of the mutex.
  • VMRay.Sample.IOC.Mutex.Type — The type of the mutex.
  • VMRay.Sample.IOC.File.AnalysisID — The IDs of other analyses that contain the given file.
  • VMRay.Sample.IOC.File.Name — The name of the file.
  • VMRay.Sample.IOC.File.Operation — The operation of the given file.
  • VMRay.Sample.IOC.File.ID — The ID of the file.
  • VMRay.Sample.IOC.File.Type — The type of the file.
  • VMRay.Sample.IOC.File.Hashes.MD5 — The MD5 hash of the given file.
  • VMRay.Sample.IOC.File.Hashes.SSDeep — The SSDeep hash of the given file.
  • VMRay.Sample.IOC.File.Hashes.SHA256 — The SHA256 hash of the given file.
  • VMRay.Sample.IOC.File.Hashes.SHA1 — The SHA1 hash of the given file.
  • VMRay.ThreatIndicator.AnalysisID — The list of connected analysis IDs.
  • VMRay.ThreatIndicator.Category — The category of threat indicators.
  • VMRay.ThreatIndicator.Classification — The classifications of threat indicators.
  • VMRay.ThreatIndicator.ID — The ID of the threat indicator.
  • VMRay.ThreatIndicator.Operation — The operation that caused the indicators.

Commands used

vmray-get-analysis-by-sample vmray-get-iocs vmray-get-sample vmray-get-submission vmray-get-threat-indicators vmray-upload-sample

Flowchart

yes yes yes yes Start Start GenericPolling - GenericPolling GenericPolling GenericPolling Is there any file to detonate? Is there any file to deto... Send file to VMRay - vmray-upload-sample Send file to VMRay vmray-upload-sample Done Done Get sample - vmray-get-sample Get sample vmray-get-sample Get submission - vmray-get-submission Get submission vmray-get-submission Get analysis - vmray-get-analysis-by-sample Get analysis vmray-get-analysis-by-sample Is sample suspicious or malicious? Is sample suspicious or m... Get IOCs - vmray-get-iocs Get IOCs vmray-get-iocs Get Threat Indicators - vmray-get-threat-indicators Get Threat Indicators vmray-get-threat-indicators Is there an active VMRay instance? - IsIntegrationAvailable Is there an active VMRay ... IsIntegrationAvailable Is there a child submission? Is there a child submission? Get Child IOCs - vmray-get-iocs Get Child IOCs vmray-get-iocs Get Child VTIs - vmray-get-threat-indicators Get Child VTIs vmray-get-threat-indicators

Source

playbook-VMRay-Detonate-File.yml
Download History Raw 
id: 79b5d8a6-2636-480c-8e1c-a3ab2e58ffb5
version: -1
name: Detonate File - VMRay
description: Detonates a file with VMRay.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: c1de2f2b-64cb-4df5-8490-07c49e7255b6
    type: start
    task:
      id: c1de2f2b-64cb-4df5-8490-07c49e7255b6
      version: -1
      name: ""
      description: start
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "15"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 7421a2fc-d22a-41f9-8876-e7735d25ea6b
    type: playbook
    task:
      id: 7421a2fc-d22a-41f9-8876-e7735d25ea6b
      version: -1
      name: GenericPolling
      description: |-
        Use as a sub-playbook to block execution of the master playbook until a remote action is complete.
        This playbook implements polling by continually running the command in Step #2 until the operation completes.
        The remote action should have the following structure:

        1. Initiate the operation.
        2. Poll to check if the operation completed.
        3. (optional) Get the results of the operation.
      playbookName: GenericPolling
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      Ids:
        simple: ${VMRay.Submission.SubmissionID}
      Interval:
        simple: ${inputs.interval}
      PollingCommandArgName:
        simple: submission_id
      PollingCommandName:
        simple: vmray-get-submission
      Timeout:
        simple: ${inputs.timeout}
      dt:
        simple: VMRay.Submission(val.IsFinished == false).SubmissionID
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 377.5,
          "y": 895
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: 087ea815-c0b4-4604-8b43-099927639fa9
    type: condition
    task:
      id: 087ea815-c0b4-4604-8b43-099927639fa9
      version: -1
      name: Is there any file to detonate?
      description: Check if file exist
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "6"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: inputs.File
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: 46c971ef-9691-4b18-888b-a8fccf7b8c7c
    type: regular
    task:
      id: 46c971ef-9691-4b18-888b-a8fccf7b8c7c
      version: -1
      name: Send file to VMRay
      description: Submit sample to VMRay
      script: '|||vmray-upload-sample'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "10"
    scriptarguments:
      entry_id:
        simple: ${inputs.File.EntryID}
      file_id:
        simple: ${File.EntryID}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 377.5,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: b5eb756b-903d-4f8e-8b09-f8bcad28627c
    type: title
    task:
      id: b5eb756b-903d-4f8e-8b09-f8bcad28627c
      version: -1
      name: Done
      description: Done
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 130,
          "y": 2760
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: 2a0709fc-42f1-4ac8-80ef-aa53b3b65576
    type: regular
    task:
      id: 2a0709fc-42f1-4ac8-80ef-aa53b3b65576
      version: -1
      name: Get sample
      description: get sample by sample id
      script: '|||vmray-get-sample'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "11"
    scriptarguments:
      sample_id:
        complex:
          root: VMRay.Submission
          accessor: SampleID
          transformers:
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 377.5,
          "y": 1070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: ca3caa5c-0828-41e1-8b12-77771fdaf140
    type: regular
    task:
      id: ca3caa5c-0828-41e1-8b12-77771fdaf140
      version: -1
      name: Get submission
      description: Gets a submission result
      script: '|||vmray-get-submission'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "1"
    scriptarguments:
      submission_id:
        complex:
          root: VMRay.Submission
          accessor: SubmissionID
          transformers:
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 377.5,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: 1735cc5d-e223-47ea-8905-51616bed94f1
    type: regular
    task:
      id: 1735cc5d-e223-47ea-8905-51616bed94f1
      version: -1
      name: Get analysis
      description: Retrieves all analysis details for a specified sample.
      script: '|||vmray-get-analysis-by-sample'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "12"
    scriptarguments:
      sample_id:
        complex:
          root: VMRay
          accessor: Sample.SampleID
          transformers:
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 377.5,
          "y": 1245
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: d9177a3a-b705-45af-8b42-7ee487c17eda
    type: condition
    task:
      id: d9177a3a-b705-45af-8b42-7ee487c17eda
      version: -1
      name: Is sample suspicious or malicious?
      description: check term
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "13"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: VMRay.Sample
                accessor: Verdict
            iscontext: true
          right:
            value: {}
        - operator: isExists
          left:
            value:
              complex:
                root: VMRay.Sample
                accessor: Verdict
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 377.5,
          "y": 1420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: c935d709-7974-4075-85a5-13e24aa25cdd
    type: regular
    task:
      id: c935d709-7974-4075-85a5-13e24aa25cdd
      version: -1
      name: Get IOCs
      description: Retrieves Indicators of Compromise for a specified sample.
      script: '|||vmray-get-iocs'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "14"
    scriptarguments:
      sample_id:
        complex:
          root: VMRay
          accessor: Analysis.SampleID
          transformers:
          - operator: uniq
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: ${VMRay.Sample.SampleID}
    reputationcalc: 2
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 542.5,
          "y": 1595
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: 1ed93841-acec-451d-8c9b-ef42d1f75548
    type: regular
    task:
      id: 1ed93841-acec-451d-8c9b-ef42d1f75548
      version: -1
      name: Get Threat Indicators
      description: Retrieves threat indicators (VTI).
      script: '|||vmray-get-threat-indicators'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "16"
    scriptarguments:
      sample_id:
        complex:
          root: VMRay
          accessor: Analysis.SampleID
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: ${VMRay.Sample.SampleID}
                iscontext: true
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 542.5,
          "y": 1760
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: e01bcec4-aae2-4845-823c-82ef27b884d7
    type: condition
    task:
      id: e01bcec4-aae2-4845-823c-82ef27b884d7
      version: -1
      name: Is there an active VMRay instance?
      description: Returns 'yes' if integration brand is available. Otherwise returns
        'no'
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "4"
    scriptarguments:
      brandname:
        simple: vmray
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 180
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "16":
    id: "16"
    taskid: 9ad67e3a-c815-4e79-842c-ea509d293e1e
    type: condition
    task:
      id: 9ad67e3a-c815-4e79-842c-ea509d293e1e
      version: -1
      name: Is there a child submission?
      description: Returns "yes" if a child submission is available
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "17"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: VMRay.Sample.ChildSampleIDs
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 542.5,
          "y": 1960
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "17":
    id: "17"
    taskid: 33703a1b-05f4-40fa-8131-2393fda81444
    type: regular
    task:
      id: 33703a1b-05f4-40fa-8131-2393fda81444
      version: -1
      name: Get Child IOCs
      description: Retrieves Indicators of Compromise for a specified sample.
      script: '|||vmray-get-iocs'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "18"
    scriptarguments:
      sample_id:
        simple: ${VMRay.Sample.ChildSampleIDs}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 780,
          "y": 2170
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "18":
    id: "18"
    taskid: b66f9103-83bf-4795-8fec-f050c3f88f0d
    type: regular
    task:
      id: b66f9103-83bf-4795-8fec-f050c3f88f0d
      version: -1
      name: Get Child VTIs
      description: Retrieves Threat Indicators (VTI).
      script: '|||vmray-get-threat-indicators'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      sample_id:
        simple: ${VMRay.Sample.ChildSampleIDs}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 780,
          "y": 2330
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "4_6_yes": 0.89
    },
    "paper": {
      "dimensions": {
        "height": 2775,
        "width": 1110,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: File
  value:
    simple: ${File}
  required: false
  description: The file to detonate.
  playbookInputQuery: null
- key: interval
  value:
    simple: "1"
  required: false
  description: The frequency in which to poll for results (minutes).
  playbookInputQuery: null
- key: timeout
  value:
    simple: "10"
  required: false
  description: The amount of time to wait before giving up waiting for results (minutes).
  playbookInputQuery: null
outputs:
- contextPath: VMRay.Job.JobID
  description: The ID of a new job.
  type: number
- contextPath: VMRay.Job.SampleID
  description: The ID of sample.
  type: number
- contextPath: VMRay.Job.Created
  description: The timestamp of the created job.
  type: date
- contextPath: VMRay.Job.VMName
  description: The name of virtual machine.
  type: string
- contextPath: VMRay.Job.VMID
  description: The ID of virtual machine.
  type: number
- contextPath: VMRay.Sample.SampleID
  description: The sample ID of the task.
  type: number
- contextPath: VMRay.Sample.Created
  description: The timestamp of the created sample.
  type: date
- contextPath: VMRay.Submission.SubmissionID
  description: The submission ID.
  type: number
- contextPath: VMRay.Submission.HadErrors
  description: Whether there are any errors in the submission.
  type: boolean
- contextPath: VMRay.Submission.IsFinished
  description: The status of submission. Can be, "true" or "false".
  type: boolean
- contextPath: VMRay.Submission.MD5
  description: The MD5 hash of the sample in submission.
  type: string
- contextPath: VMRay.Submission.SHA1
  description: The SHA1 hash of the sample in submission.
  type: string
- contextPath: VMRay.Submission.SHA256
  description: The SHA256 hash of the sample in submission.
  type: string
- contextPath: VMRay.Submission.Verdict
  description: Verdict for the sample (Malicious, Suspicious, Clean, Not Available).
  type: String
- contextPath: VMRay.Submission.VerdictReason
  description: Description of the Verdict Reason.
  type: String
- contextPath: VMRay.Submission.Severity
  description: Severity of the sample (Malicious, Suspicious, Good, Blacklisted, Whitelisted,
    Unknown). Deprecated.
  type: string
- contextPath: VMRay.Submission.SSDeep
  description: The SSDeep hash of the sample in submission.
  type: string
- contextPath: VMRay.Submission.SampleID
  description: The ID of the sample in submission.
  type: number
- contextPath: VMRay.Sample.FileName
  description: The file name of the sample.
  type: string
- contextPath: VMRay.Sample.MD5
  description: The MD5 hash of the sample.
  type: string
- contextPath: VMRay.Sample.SHA1
  description: The SHA1 hash of the sample.
  type: string
- contextPath: VMRay.Sample.SHA256
  description: The SHA256 hash of the sample.
  type: string
- contextPath: VMRay.Sample.SSDeep
  description: The SSDeep of the sample.
  type: string
- contextPath: VMRay.Sample.Verdict
  description: Verdict for the sample (Malicious, Suspicious, Clean, Not Available).
  type: String
- contextPath: VMRay.Sample.VerdictReason
  description: Description of the Verdict Reason.
  type: String
- contextPath: VMRay.Sample.Severity
  description: Severity of the sample (Malicious, Suspicious, Good, Blacklisted, Whitelisted,
    Unknown). Deprecated.
  type: string
- contextPath: VMRay.Sample.Type
  description: The file type.
  type: string
- contextPath: VMRay.Sample.Classifications
  description: The classifications of the sample.
  type: string
- contextPath: VMRay.Sample.IOC.URL.AnalysisID
  description: The IDs of the other analyses that contain the given URL.
  type: number
- contextPath: VMRay.Sample.IOC.URL.URL
  description: The URL.
- contextPath: VMRay.Sample.IOC.URL.Operation
  description: The operation of the specified URL.
- contextPath: VMRay.Sample.IOC.URL.ID
  description: The ID of the URL.
- contextPath: VMRay.Sample.IOC.URL.Type
  description: The type of the URL.
- contextPath: VMRay.Sample.IOC.Domain.AnalysisID
  description: The IDs of the other analyses that contain the given domain.
- contextPath: VMRay.Sample.IOC.Domain.Domain
  description: The domain.
- contextPath: VMRay.Sample.IOC.Domain.ID
  description: The ID of the domain.
- contextPath: VMRay.Sample.IOC.Domain.Type
  description: The type of the domain.
- contextPath: VMRay.Sample.IOC.IP.AnalysisID
  description: The IDs of the other analyses that contain the given IP address.
- contextPath: VMRay.Sample.IOC.IP.IP
  description: The IP address.
- contextPath: VMRay.Sample.IOC.IP.Operation
  description: The operation of the given IP address.
- contextPath: VMRay.Sample.IOC.IP.ID
  description: The ID of the IP address.
- contextPath: VMRay.Sample.IOC.IP.Type
  description: The type of the IP address.
- contextPath: VMRay.Sample.IOC.Mutex.AnalysisID
  description: The IDs of other analyses that contain the given IP address.
- contextPath: VMRay.Sample.IOC.Mutex.Name
  description: The name of the mutex.
- contextPath: VMRay.Sample.IOC.Mutex.Operation
  description: The operation of the given mutex
- contextPath: VMRay.Sample.IOC.Mutex.ID
  description: The ID of the mutex.
- contextPath: VMRay.Sample.IOC.Mutex.Type
  description: The type of the mutex.
- contextPath: VMRay.Sample.IOC.File.AnalysisID
  description: The IDs of other analyses that contain the given file.
- contextPath: VMRay.Sample.IOC.File.Name
  description: The name of the file.
- contextPath: VMRay.Sample.IOC.File.Operation
  description: The operation of the given file.
- contextPath: VMRay.Sample.IOC.File.ID
  description: The ID of the file.
- contextPath: VMRay.Sample.IOC.File.Type
  description: The type of the file.
- contextPath: VMRay.Sample.IOC.File.Hashes.MD5
  description: The MD5 hash of the given file.
- contextPath: VMRay.Sample.IOC.File.Hashes.SSDeep
  description: The SSDeep hash of the given file.
- contextPath: VMRay.Sample.IOC.File.Hashes.SHA256
  description: The SHA256 hash of the given file.
- contextPath: VMRay.Sample.IOC.File.Hashes.SHA1
  description: The SHA1 hash of the given file.
- contextPath: VMRay.ThreatIndicator.AnalysisID
  description: The list of connected analysis IDs.
- contextPath: VMRay.ThreatIndicator.Category
  description: The category of threat indicators.
- contextPath: VMRay.ThreatIndicator.Classification
  description: The classifications of threat indicators.
- contextPath: VMRay.ThreatIndicator.ID
  description: The ID of the threat indicator.
- contextPath: VMRay.ThreatIndicator.Operation
  description: The operation that caused the indicators.
fromversion: 5.0.0
tests:
- VMRay-Test-File