Convert file hash to corresponding hashes

The playbook enables you to get all of the corresponding file hashes for a file even if there is only one hash type available. For example, if we have only the SHA256 hash, the playbook will get the SHA1 and MD5 hashes as long as the original searched hash is recognized by any our the threat intelligence integrations.
Common Playbooks · 20 tasks · 3 inputs · 4 outputs
Details

ID	`Convert file hash to corresponding hashes`
From Version	5.0.0
Tasks	20
README

The playbook enables you to get all of the corresponding file hashes for a file even if there is only one hash type available.
For example, if we have only the SHA256 hash, the playbook will get the SHA1 and MD5 hashes as long as the
original searched hash is recognized by any our the threat intelligence integrations.
Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.
Sub-playbooks

This playbook does not use any sub-playbooks.
Integrations

This playbook does not use any integrations.
Scripts

SearchIndicator
Commands

enrichIndicators
file
Playbook Inputs

Name	Description	Default Value	Required
SHA256	The SHA256 hash on which to search.	File.SHA256	Optional
SHA1	The SHA1 hash on which to search.	File.SHA1	Optional
MD5	The MD5 hash on which to search.	File.MD5	Optional
Playbook Outputs

Path	Description	Type
File.SHA256	Output for detected SHA256 hash.	string
File.SHA1	Output for detected SHA1 hash.	string
File.MD5	Output for detected MD5 hash.	string
Indicators.Value	Output for detected hashes.	unknown
Playbook Image

Convert file hash to corresponding hashes
Inputs

SHA256 — The SHA256 hash on which to search.
SHA1 — The SHA1 hash on which to search.
MD5 — The MD5 hash on which to search.
Outputs

File.SHA256 — Output for detected SHA256 hash.
File.SHA1 — Output for detected SHA1 hash.
File.MD5 — Output for detected MD5 hash.
Indicators.Value — Output for detected hashes.
Commands used

enrichIndicators file
Flowchart

Source

playbook-Convert_file_hash_to_corresponding_hashes.yml
Download History Raw
id: Convert file hash to corresponding hashes
version: -1
fromversion: 5.0.0
name: Convert file hash to corresponding hashes
description: |
  The playbook enables you to get all of the corresponding file hashes for a file even if there is only one hash type available.
  For example, if we have only the SHA256 hash, the playbook will get the SHA1 and MD5 hashes as long as the
  original searched hash is recognized by any our the threat intelligence integrations.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: f3d44d02-1482-4dd0-8055-34128346e4ec
    type: start
    task:
      id: f3d44d02-1482-4dd0-8055-34128346e4ec
      version: -1
      name: ""
      description: Start
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "35"
      - "36"
      - "37"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 520,
          "y": -100
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: d0c581d2-789c-4a12-8940-37f17a47b4f6
    type: title
    task:
      id: d0c581d2-789c-4a12-8940-37f17a47b4f6
      version: -1
      name: Done
      description: Done
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 530,
          "y": 950
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: b797fdc7-1704-442a-8605-ee06bfb0bf54
    type: condition
    task:
      id: b797fdc7-1704-442a-8605-ee06bfb0bf54
      version: -1
      name: Does SHA256 hash exist?
      description: Does SHA256 hash exist?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "44"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.SHA256
            iscontext: true
    view: |-
      {
        "position": {
          "x": 1080,
          "y": 200
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: f7142eb2-9483-4546-8d07-a828d636d0ad
    type: condition
    task:
      id: f7142eb2-9483-4546-8d07-a828d636d0ad
      version: -1
      name: Does MD5 hash exist?
      description: Does MD5 hash exist?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "46"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.MD5
            iscontext: true
    view: |-
      {
        "position": {
          "x": -40,
          "y": 190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: eff5d9b7-ea36-4310-8650-5e26fa38209e
    type: condition
    task:
      id: eff5d9b7-ea36-4310-8650-5e26fa38209e
      version: -1
      name: Does SHA1 hash exist?
      description: Does SHA1 hash exist?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "45"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.SHA1
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 520,
          "y": 190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: 65ff1c51-6bc1-4171-8bde-eb6ecb862f4e
    type: regular
    task:
      id: 65ff1c51-6bc1-4171-8bde-eb6ecb862f4e
      version: -1
      name: Get hashes by SHA1
      description: Uses the SHA1 hash as a reference to check for other corresponding hashes of the same file.
      script: '|||file'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      file:
        complex:
          root: inputs.SHA1
    reputationcalc: 2
    continueonerror: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 300,
          "y": 750
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "16":
    id: "16"
    taskid: 9e3c8b51-dbc6-464a-8af7-f5d43b663bd4
    type: regular
    task:
      id: 9e3c8b51-dbc6-464a-8af7-f5d43b663bd4
      version: -1
      name: Get hashes by MD5
      description: Uses the MD5 hash as a reference to check for other corresponding hashes of the same file.
      script: '|||file'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      confidenceThreshold: {}
      file:
        complex:
          root: inputs.MD5
    reputationcalc: 2
    continueonerror: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -550,
          "y": 750
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "18":
    id: "18"
    taskid: 29ef7703-de75-4ff3-844c-a852e333bdbe
    type: regular
    task:
      id: 29ef7703-de75-4ff3-844c-a852e333bdbe
      version: -1
      name: Get Hashes by SHA256
      description: Uses the SHA256 hash as a reference to check for other corresponding hashes of the same file.
      script: '|||file'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      confidenceThreshold: {}
      file:
        complex:
          root: inputs.SHA256
    reputationcalc: 2
    continueonerror: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1180,
          "y": 750
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "35":
    id: "35"
    taskid: fdfd1cd9-3095-455b-8481-072b140ee5de
    type: title
    task:
      id: fdfd1cd9-3095-455b-8481-072b140ee5de
      version: -1
      name: MD5
      description: MD5
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -40,
          "y": 60
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "36":
    id: "36"
    taskid: a75bc19c-d514-44ab-885d-fb6664dd0b29
    type: title
    task:
      id: a75bc19c-d514-44ab-885d-fb6664dd0b29
      version: -1
      name: SHA1
      description: SHA1
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "10"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 520,
          "y": 60
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "37":
    id: "37"
    taskid: a2d56e80-d468-46a0-891d-3792a6bf0bd9
    type: title
    task:
      id: a2d56e80-d468-46a0-891d-3792a6bf0bd9
      version: -1
      name: SHA256
      description: SHA256
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1080,
          "y": 60
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "39":
    id: "39"
    taskid: 336d7e69-334b-490c-81c4-4b48788a56be
    type: condition
    task:
      id: 336d7e69-334b-490c-81c4-4b48788a56be
      version: -1
      name: Have the hashes been retrieved?
      type: condition
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      '#default#':
      - "18"
      "yes":
      - "40"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: foundIndicators.value
            iscontext: true
          right:
            value: {}
      - - operator: stringHasLength
          left:
            value:
              complex:
                root: foundIndicators
                accessor: value
            iscontext: true
          right:
            value:
              simple: "64"
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1350,
          "y": 540
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "40":
    id: "40"
    taskid: 4cbe3c2a-dc3d-46fc-8b6a-b589accfdba3
    type: regular
    task:
      id: 4cbe3c2a-dc3d-46fc-8b6a-b589accfdba3
      version: -1
      name: Enrich indicators
      description: commands.local.cmd.enrich.indicators
      script: Builtin|||enrichIndicators
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      indicatorsValues:
        complex:
          root: foundIndicators
          accessor: value
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1600,
          "y": 750
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "44":
    id: "44"
    taskid: b27dc11a-1b9f-4056-8288-776eaa57bd63
    type: regular
    task:
      id: b27dc11a-1b9f-4056-8288-776eaa57bd63
      version: -1
      name: Search indicators
      description: |-
        Searches Cortex XSOAR indicators.

        Searches for Cortex XSOAR indicators and returns the id, indicator_type, value, and score/verdict.

        You can add additional fields from the indicators using the add_field_to_context argument.
      scriptName: SearchIndicator
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "39"
    scriptarguments:
      query:
        simple: value:${inputs.SHA256}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1350,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "45":
    id: "45"
    taskid: 1b49a035-86f4-4e1d-81ac-add593725d88
    type: regular
    task:
      id: 1b49a035-86f4-4e1d-81ac-add593725d88
      version: -1
      name: Search indicators
      description: |-
        Searches Cortex XSOAR indicators.

        Searches for Cortex XSOAR Indicators and returns the id, indicator_type, value, and score/verdict.

        You can add additional fields from the indicators using the add_field_to_context argument.
      scriptName: SearchIndicator
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "47"
    scriptarguments:
      query:
        simple: value:${inputs.SHA1}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 520,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "46":
    id: "46"
    taskid: f9974076-074f-4bf4-82a5-0c804fb7875b
    type: regular
    task:
      id: f9974076-074f-4bf4-82a5-0c804fb7875b
      version: -1
      name: Search indicators
      description: |-
        Searches Cortex XSOAR indicators.

        Searches for Cortex XSOAR Indicators and returns the id, indicator_type, value, and score/verdict.

        You can add additional fields from the indicators using the add_field_to_context argument.
      scriptName: SearchIndicator
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "48"
    scriptarguments:
      query:
        simple: value:${inputs.MD5}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -330,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "47":
    id: "47"
    taskid: 0161e3d5-ca7c-4e0e-86d4-f767f1c7b64c
    type: condition
    task:
      id: 0161e3d5-ca7c-4e0e-86d4-f767f1c7b64c
      version: -1
      name: Have the hashes been retrieved?
      type: condition
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      '#default#':
      - "15"
      "yes":
      - "49"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: foundIndicators.value
            iscontext: true
          right:
            value: {}
      - - operator: stringHasLength
          left:
            value:
              complex:
                root: foundIndicators
                accessor: value
            iscontext: true
          right:
            value:
              simple: "40"
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 520,
          "y": 540
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "48":
    id: "48"
    taskid: 9fb9988f-d614-4a30-8eb9-09c8a05ad461
    type: condition
    task:
      id: 9fb9988f-d614-4a30-8eb9-09c8a05ad461
      version: -1
      name: Have the hashes been retrieved?
      type: condition
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      '#default#':
      - "16"
      "yes":
      - "50"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: foundIndicators.value
            iscontext: true
          right:
            value: {}
      - - operator: stringHasLength
          left:
            value:
              complex:
                root: foundIndicators
                accessor: value
            iscontext: true
          right:
            value:
              simple: "32"
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -330,
          "y": 540
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "49":
    id: "49"
    taskid: 620476dc-83d3-40fe-8d2f-8f978fcdfa23
    type: regular
    task:
      id: 620476dc-83d3-40fe-8d2f-8f978fcdfa23
      version: -1
      name: Enrich indicators
      description: commands.local.cmd.enrich.indicators
      script: Builtin|||enrichIndicators
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      indicatorsValues:
        complex:
          root: foundIndicators
          accessor: value
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 750,
          "y": 750
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "50":
    id: "50"
    taskid: e4213b2e-29ba-40d3-8ae3-6deec5436549
    type: regular
    task:
      id: e4213b2e-29ba-40d3-8ae3-6deec5436549
      version: -1
      name: Enrich indicators
      description: commands.local.cmd.enrich.indicators
      script: Builtin|||enrichIndicators
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      indicatorsValues:
        complex:
          root: foundIndicators
          accessor: value
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -120,
          "y": 750
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "10_2_#default#": 0.39,
      "10_45_yes": 0.46,
      "47_15_#default#": 0.44,
      "47_49_yes": 0.41,
      "48_16_#default#": 0.57,
      "48_50_yes": 0.61,
      "4_2_#default#": 0.15,
      "9_2_#default#": 0.19,
      "9_46_yes": 0.51
    },
    "paper": {
      "dimensions": {
        "height": 1115,
        "width": 2530,
        "x": -550,
        "y": -100
      }
    }
  }
inputs:
- key: SHA256
  value:
    complex:
      root: File
      accessor: SHA256
  required: false
  description: The SHA256 hash on which to search.
  playbookInputQuery:
- key: SHA1
  value:
    complex:
      root: File
      accessor: SHA1
  required: false
  description: The SHA1 hash on which to search.
  playbookInputQuery:
- key: MD5
  value:
    complex:
      root: File
      accessor: MD5
  required: false
  description: The MD5 hash on which to search.
  playbookInputQuery:
outputs:
- contextPath: File.SHA256
  description: Output for detected SHA256 hash.
  type: string
- contextPath: File.SHA1
  description: Output for detected SHA1 hash.
  type: string
- contextPath: File.MD5
  description: Output for detected MD5 hash.
  type: string
- contextPath: Indicators.Value
  description: Output for detected hashes.
tests:
- Test Convert file hash to corresponding hashes