Detonate File - BitDam

Detonates one or more files using BitDam integration. Returns verdict to the War Room and file reputations to the context data. Supported file types are mainly PDF & microsoft office software/

BitDam · 9 tasks · 3 inputs · 7 outputs

Details

ID	`Detonate File - BitDam`
From Version	5.0.0
Tasks	9

README

Detonates one or more files using BitDam integration.
Returns verdict to the War Room and file reputations to the context data.

Supported file types are mainly PDF & microsoft office software.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

GenericPolling

Integrations

This playbook does not use any integrations.

Scripts

Commands

bitdam-get-verdict
bitdam-upload-file

Playbook Inputs

Name	Description	Default Value	Source	Required
File	The file object of the file to detonate. The File is taken from the context.	None	File	Optional
Interval	The duration for executing the pooling (in minutes).	1	-	Optional
Timeout	The duration after which to stop pooling and to resume the playbook (in minutes).	10	-	Optional

Playbook Outputs

Path	Description	Type
BitDam.Analysis.ID	The sample ID.	string
DBotScore.Vendor	The name of the vendor: BitDam.	string
BitDam.Analysis.Verdict	The analysis verdict.	string
BitDam.Analysis.Status	The analysis status.	string
DBotScore.Indicator	The name of the sample file or URL.	unknown
DBotScore.Type	The ‘file’ for file samples.	string
DBotScore.Score	The actual score.	number

Playbook Image

Detonate_File_-_BitDam

Inputs

File — File object of the file to detonate. The File is taken from the context.
Interval — Duration for executing the pooling (in minutes)
Timeout — The duration after which to stop pooling and to resume the playbook (in minutes)

Outputs

BitDam.Analysis.ID — Sample ID
DBotScore.Vendor — The name of the vendor: BitDam
BitDam.Analysis.Verdict — Analysis Verdict
BitDam.Analysis.Status — Analysis Status
DBotScore.Indicator — The name of the sample file or URL
DBotScore.Type — 'file' for file samples
DBotScore.Score — The actual score

Commands used

bitdam-get-verdict bitdam-upload-file

Flowchart

Source

playbook-BitDam_Scan_File.yml

Download History Raw

id: Detonate File - BitDam
version: -1
name: Detonate File - BitDam
fromversion: 5.0.0
description: |-
  Detonates one or more files using BitDam integration.
  Returns verdict to the War Room and file reputations to the context data.
  Supported file types are mainly PDF & microsoft office software/
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: cf22dcbc-af9c-42fa-8963-205d412e6965
    type: start
    task:
      id: cf22dcbc-af9c-42fa-8963-205d412e6965
      version: -1
      name: ""
      description: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 50
        }
      }
    note: false
    timertriggers: []
  "2":
    id: "2"
    taskid: 19ace356-7eb1-491e-8b42-9d755950312c
    type: playbook
    task:
      id: 19ace356-7eb1-491e-8b42-9d755950312c
      version: -1
      name: GenericPolling
      description: |-
        Use as a sub-playbook to block execution of the master playbook until a remote action is complete.
        This playbook implements polling by continually running the command in Step #2 until the operation completes.
        The remote action should have the following structure:

        1. Initiate the operation.
        2. Poll to check if the operation completed.
        3. (optional) Get the results of the operation.
      playbookName: GenericPolling
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      Ids:
        complex:
          root: BitDam
          accessor: FileScan.SHA1
      Interval:
        complex:
          root: inputs.Interval
      PollingCommandArgName:
        simple: idValue
      PollingCommandName:
        simple: bitdam-get-verdict
      Timeout:
        complex:
          root: inputs.Timeout
      dt:
        simple: BitDam.Analysis(val.Status !== 'DONE').ID
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
    view: |-
      {
        "position": {
          "x": 387.5,
          "y": 1070
        }
      }
    note: false
    timertriggers: []
  "5":
    id: "5"
    taskid: aa6d7b50-e89e-4046-8245-91d4e430544d
    type: title
    task:
      id: aa6d7b50-e89e-4046-8245-91d4e430544d
      version: -1
      name: Done
      description: ""
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1420
        }
      }
    note: false
    timertriggers: []
  "6":
    id: "6"
    taskid: 840243b7-07df-471e-8cab-7dc8080ce28c
    type: condition
    task:
      id: 840243b7-07df-471e-8cab-7dc8080ce28c
      version: -1
      name: Is there a File to scan?
      description: Look for files to detonate
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "9"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: inputs.File
                accessor: EntryID
            iscontext: true
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 370
        }
      }
    note: false
    timertriggers: []
  "7":
    id: "7"
    taskid: 03079660-b680-41d1-847d-4d667e3bc404
    type: condition
    task:
      id: 03079660-b680-41d1-847d-4d667e3bc404
      version: -1
      name: Is BitDam enabled?
      description: Check if integration instance is enabled
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "6"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: BitDam
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
    note: false
    timertriggers: []
  "8":
    id: "8"
    taskid: 2610cf49-d119-4065-861c-c7b3a5ffd0c8
    type: regular
    task:
      id: 2610cf49-d119-4065-861c-c7b3a5ffd0c8
      version: -1
      name: BitDam Get Verdict
      description: '-'
      script: '|||bitdam-get-verdict'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      idType: {}
      idValue:
        simple: ${BitDam.FileScan.SHA1}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 387.5,
          "y": 1245
        }
      }
    note: false
    timertriggers: []
  "9":
    id: "9"
    taskid: 5f4539b9-bf85-42e5-8892-f12714a02869
    type: regular
    task:
      id: 5f4539b9-bf85-42e5-8892-f12714a02869
      version: -1
      name: Set file to context
      description: ""
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "10"
    scriptarguments:
      append: {}
      key:
        simple: File
      value:
        complex:
          root: inputs.File
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 275,
          "y": 545
        }
      }
    note: false
    timertriggers: []
  "10":
    id: "10"
    taskid: 699619cb-33c2-4b32-88ef-ba0844c2cddf
    type: condition
    task:
      id: 699619cb-33c2-4b32-88ef-ba0844c2cddf
      version: -1
      name: Is File type supported?
      description: ""
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "12"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: File
                filters:
                - - operator: match
                    left:
                      value:
                        simple: File.Type
                      iscontext: true
                    right:
                      value:
                        simple: .*(?:PDF|DOT|DOCX|DOCM|DOTX|DOTM|RTF|XLS|XLT|XLSX|XLSM|XLTX|XLTM|XLSB|XLAM|CSV|PPT|PPTX|PPTM|POTX|POTM|PPAM|PPSX|PPSM|PPS)\b
                    ignorecase: true
                  - operator: match
                    left:
                      value:
                        simple: File.Extension
                      iscontext: true
                    right:
                      value:
                        simple: .*(?:PDF|DOT|DOCX|DOCM|DOTX|DOTM|RTF|XLS|XLT|XLSX|XLSM|XLTX|XLTM|XLSB|XLAM|CSV|PPT|PPTX|PPTM|POTX|POTM|PPAM|PPSX|PPSM|PPS)\b
                    ignorecase: true
                  - operator: match
                    left:
                      value:
                        simple: File.Info
                      iscontext: true
                    right:
                      value:
                        simple: .*(?:PDF|DOT|DOCX|DOCM|DOTX|DOTM|RTF|XLS|XLT|XLSX|XLSM|XLTX|XLTM|XLSB|XLAM|CSV|PPT|PPTX|PPTM|POTX|POTM|PPAM|PPSX|PPSM|PPS)\b
                    ignorecase: true
                accessor: EntryID
            iscontext: true
    view: |-
      {
        "position": {
          "x": 275,
          "y": 720
        }
      }
    note: false
    timertriggers: []
  "12":
    id: "12"
    taskid: 5e010413-b8e7-4562-8fc6-cddc2168851f
    type: regular
    task:
      id: 5e010413-b8e7-4562-8fc6-cddc2168851f
      version: -1
      name: BItDam Upload File
      description: Upload a file sample to BitDam's service
      script: '|||bitdam-upload-file'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      entryId:
        complex:
          root: inputs.File
          filters:
          - - operator: match
              left:
                value:
                  simple: inputs.File.Info
                iscontext: true
              right:
                value:
                  simple: .*(?:PDF|DOT|DOCX|DOCM|DOTX|DOTM|RTF|XLS|XLT|XLSX|XLSM|XLTX|XLTM|XLSB|XLAM|CSV|PPT|PPTX|PPTM|POTX|POTM|PPAM|PPSX|PPSM|PPS)\b
              ignorecase: true
            - operator: match
              left:
                value:
                  simple: inputs.File.Type
                iscontext: true
              right:
                value:
                  simple: .*(?:PDF|DOT|DOCX|DOCM|DOTX|DOTM|RTF|XLS|XLT|XLSX|XLSM|XLTX|XLTM|XLSB|XLAM|CSV|PPT|PPTX|PPTM|POTX|POTM|PPAM|PPSX|PPSM|PPS)\b
              ignorecase: true
            - operator: match
              left:
                value:
                  simple: inputs.File.Extension
                iscontext: true
              right:
                value:
                  simple: .*(?:PDF|DOT|DOCX|DOCM|DOTX|DOTM|RTF|XLS|XLT|XLSX|XLSM|XLTX|XLTM|XLSB|XLAM|CSV|PPT|PPTX|PPTM|POTX|POTM|PPAM|PPSX|PPSM|PPS)\b
              ignorecase: true
          accessor: EntryID
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 387.5,
          "y": 895
        }
      }
    note: false
    timertriggers: []
view: |-
  {
    "linkLabelsPosition": {
      "10_12_yes": 0.89
    },
    "paper": {
      "dimensions": {
        "height": 1435,
        "width": 717.5,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: File
  value:
    complex:
      root: File
  required: false
  description: File object of the file to detonate. The File is taken from the context.
- key: Interval
  value:
    simple: "1"
  required: false
  description: Duration for executing the pooling (in minutes)
- key: Timeout
  value:
    simple: "10"
  required: false
  description: The duration after which to stop pooling and to resume the playbook (in minutes)
outputs:
- contextPath: BitDam.Analysis.ID
  description: Sample ID
  type: string
- contextPath: DBotScore.Vendor
  description: 'The name of the vendor: BitDam'
  type: string
- contextPath: BitDam.Analysis.Verdict
  description: Analysis Verdict
  type: string
- contextPath: BitDam.Analysis.Status
  description: Analysis Status
  type: string
- contextPath: DBotScore.Indicator
  description: The name of the sample file or URL
- contextPath: DBotScore.Type
  description: '''file'' for file samples'
  type: string
- contextPath: DBotScore.Score
  description: The actual score
  type: number
tests:
- Detonate File - BitDam Test