ATD - Detonate File

Detonates a File using the McAfee Advanced Threat Defense sandbox. Advanced Threat Defense supports the following File Types: 32-bit Portable Executables (PE)files; 64-bit PE+files exe, sys, dll, com, scr, cpl, ocx, cgi Microsoft Office Suite documents doc,dotm, docx, dotx, xls, ppam, xlsx, pps, xlsb, ppsx, xlsm, ppsm, ppt, ppt, pptx, pptm, rtf, shs, xltm, sldm, xltx, sldx, xlam, thmx, docm, xar Just Systems Ichitaro documents jtd, jtdc Adobe pdf, swf Compressed files gz, 7z, tgz, msi, zip, lzh, cab, lzma, rar Android application package apk, Java, JAR, CLASS, Java Script, Java bin files Image files jpeg, png, gif Other file types cmd, ace, bat, arj, vbs, chm, xml, lnk, url, mof, htm, ocx, html, potm, eml, potx, msg, ps1, vb, reg, vba, wsc, vbe, wsf, vbs, wsh

McAfee Advanced Threat Defense · 12 tasks · 3 inputs · 32 outputs

Details

ID	`ATD - Detonate File`
From Version	5.0.0
Tasks	12

README

Detonates a File using the McAfee Advanced Threat Defense sandbox.

Advanced Threat Defense supports the following File Types:

32-bit Portable Executables (PE)files; 64-bit PE+files exe, sys, dll, com, scr, cpl, ocx, cgi.

Microsoft Office Suite documents:

doc, dotm, docx, dotx, xls, ppam, xlsx, pps, xlsb, ppsx, xlsm, ppsm, ppt, ppt, pptx, pptm, rtf, shs, xltm, sldm, xltx, sldx, xlam, thmx, docm, xar.

Just Systems Ichitaro documents:

jtd, jtdc.

Adobe

pdf, swf.

Compressed files:

gz, 7z, tgz, msi, zip, lzh, cab, lzma, rar.

Android application package:

apk, Java, JAR, CLASS, Java Script, Java bin files.

Image files:

jpeg, png, gif.

Other file types:

cmd, ace, bat, arj, vbs, chm, xml, lnk, url, mof, htm, ocx, html, potm, eml, potx, msg, ps1, vb, reg, vba, wsc, vbe, wsf, vbs, wsh.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

GenericPolling

Integrations

This playbook does not use any integrations.

Scripts

Commands

atd-file-upload
atd-get-report
atd-check-status

Playbook Inputs

Name	Description	Default Value	Source	Required
File	The file to detonate. The file is taken from the context.	None	File	Optional
Interval	How often the polling command should run (in minutes).	1	-	Optional
Timeout	How much time to wait before a timeout occurs (in minutes).	15	-	Optional

Playbook Outputs

Path	Description	Type
ATD.Task.taskId	The task ID of the sample uploaded.	string
ATD.Task.jobId	The job ID of the sample uploaded.	string
ATD.Task.messageId	The message ID relevant to the sample uploaded.	string
ATD.Task.srcIp	The source IPv4 address.	string
ATD.Task.destIp	The destination IPv4 address.	string
ATD.Task.MD5	The MD5 hash of the sample uploaded.	string
ATD.Task.SHA1	The SHA1 hash of the sample uploaded.	string
ATD.Task.SHA256	The SHA256 hash of the sample uploaded.	string
File.Name	The filename (only in case of report type=json).	string
File.Type	The file type. For example, “PE” (only in case of report type=json).	string
File.Size	The file size (only in case of report type=json).	number
File.MD5	The MD5 hash of the file (only in case of report type=json).	string
File.SHA1	The SHA1 hash of the file (only in case of report type=json).	string
File.SHA256	The SHA256 hash of the file (only in case of report type=json).	string
File.EntryID	The entry ID of the sample.	string
File.Malicious.Vendor	The vendor that made the decision that the file is malicious.	string
File.Malicious.Description	The reason for the vendor to make the decision that the file is malicious.	string
DBotScore.Indicator	The indicator that was tested (only in case of report type=json).	string
DBotScore.Type	The type of the indicator (only in case of report type=json).	string
DBotScore.Vendor	The vendor used to calculate the score (only in case of report type=json).	string
DBotScore.Score	The actual score (only in case of report type=json).	number
IP.Address	The IP addresses’s relevant to the sample.	string
InfoFile.EntryID	The EntryID of the report file.	string
InfoFile.Extension	The extension of the report file.	string
InfoFile.Name	The name of the report file.	string
InfoFile.Info	The info of the report file.	string
InfoFile.Size	The size of the report file.	number
InfoFile.Type	The type of the report file.	string
File	The file object.	unknown
File.Malicious	The file malicious object.	unknown
DBotScore	The DBotScore object.	unknown
InfoFile	The report file object.	unknown

Playbook Image

Detonate_File_McAfee_ATD

Inputs

File — The file to detonate. File is taken from the context.
Interval — Polling frequency - how often the polling command should run (minutes)
Timeout — How much time to wait before a timeout occurs (minutes)

Outputs

ATD.Task.taskId — The task ID of the sample uploaded
ATD.Task.jobId — The job ID of the sample uploaded
ATD.Task.messageId — The message Id relevant to the sample uploaded
ATD.Task.srcIp — Source IPv4 address
ATD.Task.destIp — Destination IPv4 address
ATD.Task.MD5 — MD5 of the sample uploaded
ATD.Task.SHA1 — SHA1 of the sample uploaded
ATD.Task.SHA256 — SHA256 of the sample uploaded
File.Name — Filename (only in case of report type=json)
File.Type — File type e.g. "PE" (only in case of report type=json)
File.Size — File size (only in case of report type=json)
File.MD5 — MD5 hash of the file (only in case of report type=json)
File.SHA1 — SHA1 hash of the file (only in case of report type=json)
File.SHA256 — SHA256 hash of the file (only in case of report type=json)
File.EntryID — The Entry ID of the sample
File.Malicious.Vendor — For malicious files, the vendor that made the decision
File.Malicious.Description — For malicious files, the reason for the vendor to make the decision
DBotScore.Indicator — The indicator we tested (only in case of report type=json)
DBotScore.Type — The type of the indicator (only in case of report type=json)
DBotScore.Vendor — Vendor used to calculate the score (only in case of report type=json)
DBotScore.Score — The actual score (only in case of report type=json)
IP.Address — IP's relevant to the sample
InfoFile.EntryID — The EntryID of the report file
InfoFile.Extension — The extension of the report file
InfoFile.Name — The name of the report file
InfoFile.Info — The info of the report file
InfoFile.Size — The size of the report file
InfoFile.Type — The type of the report file
File — File object
File.Malicious — File Malicious object
DBotScore — DBotScore object
InfoFile — Report file object

Commands used

atd-check-status atd-file-upload atd-get-report

Flowchart

Source

playbook-Detonate_File_-_McAfee_ATD.yml

Download History Raw

id: ATD - Detonate File
version: -1
name: ATD - Detonate File
fromversion: 5.0.0
description: |-
  Detonates a File using the McAfee Advanced Threat Defense sandbox.
  Advanced Threat Defense supports the following File Types:
  32-bit Portable Executables (PE)files; 64-bit PE+files
  exe, sys, dll, com, scr, cpl, ocx, cgi
  Microsoft Office Suite documents
  doc,dotm, docx, dotx, xls, ppam, xlsx, pps, xlsb, ppsx, xlsm, ppsm, ppt, ppt, pptx, pptm, rtf, shs, xltm, sldm, xltx, sldx, xlam, thmx, docm, xar
  Just Systems Ichitaro documents
  jtd, jtdc
  Adobe
  pdf, swf
  Compressed files
  gz, 7z, tgz, msi, zip, lzh, cab, lzma, rar
  Android application package
  apk, Java, JAR, CLASS, Java Script, Java bin files
  Image files
  jpeg, png, gif
  Other file types
  cmd, ace, bat, arj, vbs, chm, xml, lnk, url, mof, htm, ocx, html, potm, eml, potx, msg, ps1, vb, reg, vba, wsc, vbe, wsf, vbs, wsh
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 489b704c-bef9-40e7-8aa8-f74cca308a94
    type: start
    task:
      id: 489b704c-bef9-40e7-8aa8-f74cca308a94
      version: -1
      name: ""
      description: '-'
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "2":
    id: "2"
    taskid: a846a181-2b08-4280-8508-58e628e10a73
    type: playbook
    task:
      id: a846a181-2b08-4280-8508-58e628e10a73
      version: -1
      name: GenericPolling
      description: |-
        Use this playbook as a sub-playbook to block execution of the master playbook until a remote action is complete.
        This playbook implements polling by continuously running the command in Step \#2 until the operation completes.
        The remote action should have the following structure:

        1. Initiate the operation.
        2. Poll to check if the operation completed.
        3. (optional) Get the results of the operation.
      playbookName: GenericPolling
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      AdditionalPollingCommandArgNames: {}
      AdditionalPollingCommandArgValues: {}
      Ids:
        complex:
          root: ATD.Task.taskId
          filters:
          - - operator: isNotEqualNumber
              left:
                value:
                  simple: ATD.Task.taskId
                iscontext: true
              right:
                value:
                  simple: "-1"
      Interval:
        complex:
          root: inputs.Interval
      PollingCommandArgName:
        simple: taskId
      PollingCommandName:
        simple: atd-check-status
      Timeout:
        complex:
          root: inputs.Timeout
      dt:
        simple: ATD.Task(val.status != 'Completed').taskId
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
    view: |-
      {
        "position": {
          "x": 500,
          "y": 1245
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "3":
    id: "3"
    taskid: e73794b6-a925-4e53-83f5-d1d764b62a48
    type: regular
    task:
      id: e73794b6-a925-4e53-83f5-d1d764b62a48
      version: -1
      name: McAfee ATD Get Report
      description: Retrieve the reports from McAfee ATD.
      script: '|||atd-get-report'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      jobId: {}
      taskId:
        complex:
          root: ATDTask
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: ATDTask.status
                iscontext: true
              right:
                value:
                  simple: Completed
          transformers:
          - operator: getField
            args:
              field:
                value:
                  simple: taskId
      threshold: {}
      type:
        simple: pdf
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 500,
          "y": 1770
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "5":
    id: "5"
    taskid: e589b774-3cee-4dff-8e14-788ef3590dfa
    type: title
    task:
      id: e589b774-3cee-4dff-8e14-788ef3590dfa
      version: -1
      name: Done
      description: finished
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 70,
          "y": 1945
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "7":
    id: "7"
    taskid: fddc93e3-f6fc-481c-8696-1bdaaf591562
    type: condition
    task:
      id: fddc93e3-f6fc-481c-8696-1bdaaf591562
      version: -1
      name: Is McAfee ATD sandbox enabled?
      description: |
        Verify that there is a valid instance of McAfee ATD enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "12"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: McAfee Advanced Threat Defense
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "8":
    id: "8"
    taskid: ac109c6f-fb89-498f-8ba7-877e50ee9019
    type: condition
    task:
      id: ac109c6f-fb89-498f-8ba7-877e50ee9019
      version: -1
      name: Filter taskId
      description: Checks that valid files only have been sent to detonation.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "2"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: ATD.Task.taskId(val != -1)
            iscontext: true
    view: |-
      {
        "position": {
          "x": 387.5,
          "y": 1070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "9":
    id: "9"
    taskid: 7543cf0f-a33a-4bf3-8bac-7a5669cb4f44
    type: regular
    task:
      id: 7543cf0f-a33a-4bf3-8bac-7a5669cb4f44
      version: -1
      name: atd-check-status
      description: Updates the status of the tasks in the context.
      script: '|||atd-check-status'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "13"
    scriptarguments:
      jobId: {}
      taskId:
        complex:
          root: ATD.Task.taskId
          filters:
          - - operator: isNotEqualNumber
              left:
                value:
                  simple: ATD.Task.taskId
                iscontext: true
              right:
                value:
                  simple: "-1"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 500,
          "y": 1420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "10":
    id: "10"
    taskid: d8e19b0c-3dfa-41f8-86fa-2d12ff711340
    type: condition
    task:
      id: d8e19b0c-3dfa-41f8-86fa-2d12ff711340
      version: -1
      name: Is File type supported?
      description: Check if file type is supported.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "14"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: File
                filters:
                - - operator: match
                    left:
                      value:
                        simple: File.Type
                      iscontext: true
                    right:
                      value:
                        simple: .*(?:EXE|SYS|DLL|COM|SCR|CPL|OCX|CGI|DOC|DOTM|DOCX|DOTX|XLS|PPAM|XSLX|PPS|XLSB|PPSX|XLSM|PPSM|PPT|PPTX|PPTM|RTF|SHS|XLTM|SLDM|XLTX|SLDX|XLAM|THMX|DOCM|XAR|JTD|JTDC|PDF|SWF|GZ|7Z|TGZ|MSI|ZIP|LZH|CAB|LZMA|APK|JAR|CLASS|JPEG|PNG|GIF|CMD|ACE|BAT|ARJ|VBS|CHM|XML|LNK|URL|MOF|HTM|OCX|HTML|POTM|EML|POTX|MSG|PS1|VB|REG|VBA|WSC|VBE|WSF|VBS|WSH)\b
                    ignorecase: true
                  - operator: match
                    left:
                      value:
                        simple: File.Extension
                      iscontext: true
                    right:
                      value:
                        simple: .*(?:EXE|SYS|DLL|COM|SCR|CPL|OCX|CGI|DOC|DOTM|DOCX|DOTX|XLS|PPAM|XSLX|PPS|XLSB|PPSX|XLSM|PPSM|PPT|PPTX|PPTM|RTF|SHS|XLTM|SLDM|XLTX|SLDX|XLAM|THMX|DOCM|XAR|JTD|JTDC|PDF|SWF|GZ|7Z|TGZ|MSI|ZIP|LZH|CAB|LZMA|APK|JAR|CLASS|JPEG|PNG|GIF|CMD|ACE|BAT|ARJ|VBS|CHM|XML|LNK|URL|MOF|HTM|OCX|HTML|POTM|EML|POTX|MSG|PS1|VB|REG|VBA|WSC|VBE|WSF|VBS|WSH)\b
                    ignorecase: true
                  - operator: match
                    left:
                      value:
                        simple: File.Info
                      iscontext: true
                    right:
                      value:
                        simple: .*(?:EXE|SYS|DLL|COM|SCR|CPL|OCX|CGI|DOC|DOTM|DOCX|DOTX|XLS|PPAM|XSLX|PPS|XLSB|PPSX|XLSM|PPSM|PPT|PPTX|PPTM|RTF|SHS|XLTM|SLDM|XLTX|SLDX|XLAM|THMX|DOCM|XAR|JTD|JTDC|PDF|SWF|GZ|7Z|TGZ|MSI|ZIP|LZH|CAB|LZMA|APK|JAR|CLASS|JPEG|PNG|GIF|CMD|ACE|BAT|ARJ|VBS|CHM|XML|LNK|URL|MOF|HTM|OCX|HTML|POTM|EML|POTX|MSG|PS1|VB|REG|VBA|WSC|VBE|WSF|VBS|WSH)\b
                    ignorecase: true
                accessor: EntryID
            iscontext: true
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 275,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "11":
    id: "11"
    taskid: 3814f559-a639-4e80-8d6e-c74b9e96e495
    type: regular
    task:
      id: 3814f559-a639-4e80-8d6e-c74b9e96e495
      version: -1
      name: Set File to context
      description: Set the file object into context.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "10"
    scriptarguments:
      append: {}
      key:
        simple: File
      value:
        complex:
          root: inputs.File
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 275,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "12":
    id: "12"
    taskid: 9b8022fc-dfd0-4806-8ead-65f53804065f
    type: condition
    task:
      id: 9b8022fc-dfd0-4806-8ead-65f53804065f
      version: -1
      name: Is there a File to Detonate?
      description: Checks that there is a file in the playbook’s input.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "11"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: inputs.File
            iscontext: true
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "13":
    id: "13"
    taskid: 5ae9c6b1-314f-44c8-8f95-8aa76fc6e658
    type: regular
    task:
      id: 5ae9c6b1-314f-44c8-8f95-8aa76fc6e658
      version: -1
      name: Set Context
      description: '-'
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      append: {}
      key:
        simple: ATDTask
      value:
        complex:
          root: ATD
          filters:
          - - operator: isNotEqualNumber
              left:
                value:
                  simple: ATD.Task.taskId
                iscontext: true
              right:
                value:
                  simple: "-1"
          accessor: Task
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 500,
          "y": 1595
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "14":
    id: "14"
    taskid: 6e299488-408a-4b9d-82d0-cb053caf322e
    type: regular
    task:
      id: 6e299488-408a-4b9d-82d0-cb053caf322e
      version: -1
      name: Mcafee ATD Upload File
      description: upload a file/web URL for dynamic analysis by using the provided Analyzer Profile. Only single file/web URL can be submitted at a time.
      script: '|||atd-file-upload'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      analyzeAgain: {}
      dstIp: {}
      entryID:
        complex:
          root: inputs.File
          filters:
          - - operator: match
              left:
                value:
                  simple: inputs.File.Type
                iscontext: true
              right:
                value:
                  simple: .*(?:EXE|SYS|DLL|COM|SCR|CPL|OCX|CGI|DOC|DOTM|DOCX|DOTX|XLS|PPAM|XSLX|PPS|XLSB|PPSX|XLSM|PPSM|PPT|PPTX|PPTM|RTF|SHS|XLTM|SLDM|XLTX|SLDX|XLAM|THMX|DOCM|XAR|JTD|JTDC|PDF|SWF|GZ|7Z|TGZ|MSI|ZIP|LZH|CAB|LZMA|APK|JAR|CLASS|JPEG|PNG|GIF|CMD|ACE|BAT|ARJ|VBS|CHM|XML|LNK|URL|MOF|HTM|OCX|HTML|POTM|EML|POTX|MSG|PS1|VB|REG|VBA|WSC|VBE|WSF|VBS|WSH)\b
              ignorecase: true
            - operator: match
              left:
                value:
                  simple: inputs.File.Info
                iscontext: true
              right:
                value:
                  simple: .*(?:EXE|SYS|DLL|COM|SCR|CPL|OCX|CGI|DOC|DOTM|DOCX|DOTX|XLS|PPAM|XSLX|PPS|XLSB|PPSX|XLSM|PPSM|PPT|PPTX|PPTM|RTF|SHS|XLTM|SLDM|XLTX|SLDX|XLAM|THMX|DOCM|XAR|JTD|JTDC|PDF|SWF|GZ|7Z|TGZ|MSI|ZIP|LZH|CAB|LZMA|APK|JAR|CLASS|JPEG|PNG|GIF|CMD|ACE|BAT|ARJ|VBS|CHM|XML|LNK|URL|MOF|HTM|OCX|HTML|POTM|EML|POTX|MSG|PS1|VB|REG|VBA|WSC|VBE|WSF|VBS|WSH)\b
              ignorecase: true
            - operator: match
              left:
                value:
                  simple: inputs.File.Extension
                iscontext: true
              right:
                value:
                  simple: .*(?:EXE|SYS|DLL|COM|SCR|CPL|OCX|CGI|DOC|DOTM|DOCX|DOTX|XLS|PPAM|XSLX|PPS|XLSB|PPSX|XLSM|PPSM|PPT|PPTX|PPTM|RTF|SHS|XLTM|SLDM|XLTX|SLDX|XLAM|THMX|DOCM|XAR|JTD|JTDC|PDF|SWF|GZ|7Z|TGZ|MSI|ZIP|LZH|CAB|LZMA|APK|JAR|CLASS|JPEG|PNG|GIF|CMD|ACE|BAT|ARJ|VBS|CHM|XML|LNK|URL|MOF|HTM|OCX|HTML|POTM|EML|POTX|MSG|PS1|VB|REG|VBA|WSC|VBE|WSF|VBS|WSH)\b
              ignorecase: true
          accessor: EntryID
      fileName: {}
      filePriorityQ: {}
      messageId: {}
      skipTaskId: {}
      srcIp: {}
      submitType:
        simple: "0"
      url: {}
      vmProfileList: {}
      xMode: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 387.5,
          "y": 895
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1960,
        "width": 830,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: File
  value:
    complex:
      root: File
  required: false
  description: The file to detonate. File is taken from the context.
- key: Interval
  value:
    simple: "1"
  required: false
  description: Polling frequency - how often the polling command should run (minutes)
- key: Timeout
  value:
    simple: "15"
  required: false
  description: How much time to wait before a timeout occurs (minutes)
outputs:
- contextPath: ATD.Task.taskId
  description: The task ID of the sample uploaded
  type: string
- contextPath: ATD.Task.jobId
  description: The job ID of the sample uploaded
  type: string
- contextPath: ATD.Task.messageId
  description: The message Id relevant to the sample uploaded
  type: string
- contextPath: ATD.Task.srcIp
  description: Source IPv4 address
  type: string
- contextPath: ATD.Task.destIp
  description: Destination IPv4 address
  type: string
- contextPath: ATD.Task.MD5
  description: MD5 of the sample uploaded
  type: string
- contextPath: ATD.Task.SHA1
  description: SHA1 of the sample uploaded
  type: string
- contextPath: ATD.Task.SHA256
  description: SHA256 of the sample uploaded
  type: string
- contextPath: File.Name
  description: Filename (only in case of report type=json)
  type: string
- contextPath: File.Type
  description: File type e.g. "PE" (only in case of report type=json)
  type: string
- contextPath: File.Size
  description: File size (only in case of report type=json)
  type: number
- contextPath: File.MD5
  description: MD5 hash of the file (only in case of report type=json)
  type: string
- contextPath: File.SHA1
  description: SHA1 hash of the file (only in case of report type=json)
  type: string
- contextPath: File.SHA256
  description: SHA256 hash of the file (only in case of report type=json)
  type: string
- contextPath: File.EntryID
  description: The Entry ID of the sample
  type: string
- contextPath: File.Malicious.Vendor
  description: For malicious files, the vendor that made the decision
  type: string
- contextPath: File.Malicious.Description
  description: For malicious files, the reason for the vendor to make the decision
  type: string
- contextPath: DBotScore.Indicator
  description: The indicator we tested (only in case of report type=json)
  type: string
- contextPath: DBotScore.Type
  description: The type of the indicator (only in case of report type=json)
  type: string
- contextPath: DBotScore.Vendor
  description: Vendor used to calculate the score (only in case of report type=json)
  type: string
- contextPath: DBotScore.Score
  description: The actual score (only in case of report type=json)
  type: number
- contextPath: IP.Address
  description: IP's relevant to the sample
  type: string
- contextPath: InfoFile.EntryID
  description: The EntryID of the report file
  type: string
- contextPath: InfoFile.Extension
  description: The extension of the report file
  type: string
- contextPath: InfoFile.Name
  description: The name of the report file
  type: string
- contextPath: InfoFile.Info
  description: The info of the report file
  type: string
- contextPath: InfoFile.Size
  description: The size of the report file
  type: number
- contextPath: InfoFile.Type
  description: The type of the report file
  type: string
- contextPath: File
  description: File object
  type: unknown
- contextPath: File.Malicious
  description: File Malicious object
  type: unknown
- contextPath: DBotScore
  description: DBotScore object
  type: unknown
- contextPath: InfoFile
  description: Report file object
  type: unknown
tests:
- Test Playbook McAfee ATD
- Detonate File - Generic Test