Detonate File - FireEye AX

Detonate one or more files using the FireEye AX integration. This playbook returns relevant reports to the War Room and file reputations to the context data. The detonation supports the following file types - PE32, EXE, DLL, JAR, JS, PDF, DOC, DOCX, RTF, XLS, PPT, PPTX, XML, ZIP, VBN, SEP, XZ, GZ, BZ2, TAR, MHTML, SWF, LNK, URL, MSI, JTD, JTT, JTDC, JTTC, HWP, HWT, HWPX, BAT, HTA, PS1, VBS, WSF, JSE, VBE, CHM, JPG, JPEG, GIF, PNG, XLSX

FireEye (AX Series) · 9 tasks · 3 inputs · 14 outputs

Details

ID	`Detonate File - FireEye AX`
From Version	5.0.0
Tasks	9

README

Detonates one or more files using the FireEye AX integration. This playbook returns relevant reports to the War Room and file reputations to the context data.

The detonation supports the following file types - PE32, EXE, DLL, JAR, JS, PDF, DOC, DOCX, RTF, XLS, PPT, PPTX, XML, ZIP, VBN, SEP, XZ, GZ, BZ2, TAR, MHTML, SWF, LNK, URL, MSI, JTD, JTT, JTDC, JTTC, HWP, HWT, HWPX, BAT, HTA, PS1, VBS, WSF, JSE, VBE, CHM.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

GenericPolling

Integrations

fireeye

Scripts

Commands

fe-submit
fe-submit-result

Playbook Inputs

Name	Description	Default Value	Source	Required
File	The file object of the file to detonate.	None	File	Optional
Interval	The polling frequency. How often the polling command should run (in minutes).	1	-	Required
Timeout	The time to wait before a timeout occurs (in minutes).	30	-	Required

Playbook Outputs

Path	Description	Type
File.SHA256	The SHA256 hash of the file.	string
File.Malicious	The file’s malicious description.	unknown
File.Type	The file type. For example, “PE”.	string
File.Size	The file size.	number
File.MD5	The MD5 hash of the file.	string
File.Name	The filename.	string
File.SHA1	The SHA1 hash of the file.	string
File	The file object.	unknown
File.Malicious.Vendor	The vendor that made the decision that the file is malicious.	string
DBotScore	The DBotScore object.	unknown
DBotScore.Indicator	The indicator that was tested.	string
DBotScore.Type	The type of the indicator.	string
DBotScore.Vendor	The vendor used to calculate the score.	string
DBotScore.Score	The actual score.	number

Playbook Image

Detonate_File_FireEye_AX

Inputs

File — File object of the file to detonate.
Interval — Polling frequency - how often the polling command should run (minutes)
Timeout — How much time to wait before a timeout occurs (minutes)

Outputs

File.SHA256 — SHA256 hash of the file
File.Malicious — The File malicious description
File.Type — File type e.g. "PE"
File.Size — File size
File.MD5 — MD5 hash of the file
File.Name — Filename
File.SHA1 — SHA1 hash of the file
File — The File object
File.Malicious.Vendor — For malicious files, the vendor that made the decision
DBotScore — The DBotScore object
DBotScore.Indicator — The indicator we tested
DBotScore.Type — The type of the indicator
DBotScore.Vendor — Vendor used to calculate the score
DBotScore.Score — The actual score

Commands used

fe-submit fe-submit-result

Flowchart

Source

playbook-Detonate_File_-_FireEye_AX.yml

Download History Raw

id: Detonate File - FireEye AX
version: -1
name: Detonate File - FireEye AX
fromversion: 5.0.0
description: Detonate one or more files using the FireEye AX integration. This playbook returns relevant reports to the War Room and file reputations to the context data. The detonation supports the following file types - PE32, EXE, DLL, JAR, JS, PDF, DOC, DOCX, RTF, XLS, PPT, PPTX, XML, ZIP, VBN, SEP, XZ, GZ, BZ2, TAR, MHTML, SWF, LNK, URL, MSI, JTD, JTT, JTDC, JTTC, HWP, HWT, HWPX, BAT, HTA, PS1, VBS, WSF, JSE, VBE, CHM, JPG, JPEG, GIF, PNG, XLSX
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 09a1d3ca-6465-42dc-8a28-4a1d382e76ff
    type: start
    task:
      id: 09a1d3ca-6465-42dc-8a28-4a1d382e76ff
      version: -1
      name: ""
      description: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "5":
    id: "5"
    taskid: 6bee82b2-c6ef-4bc4-8b43-dfa80bacd1cd
    type: condition
    task:
      id: 6bee82b2-c6ef-4bc4-8b43-dfa80bacd1cd
      version: -1
      name: Is FireEye AX enabled
      description: Verify that there is a valid instance of FireEye AX enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "14"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Fireeye
                    ignorecase: true
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                    ignorecase: true
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "6":
    id: "6"
    taskid: c7debc9a-f9dd-427b-898a-be6814407698
    type: title
    task:
      id: c7debc9a-f9dd-427b-898a-be6814407698
      version: -1
      name: Done
      description: Done
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 40,
          "y": 1740
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "11":
    id: "11"
    taskid: 2dbe8904-3a0e-421d-8dd6-28d64963f65d
    type: regular
    task:
      id: 2dbe8904-3a0e-421d-8dd6-28d64963f65d
      version: -1
      name: Set file to context
      description: Set the file object into context.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "15"
    scriptarguments:
      append: {}
      key:
        simple: File
      value:
        complex:
          root: inputs.File
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 275,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "13":
    id: "13"
    taskid: b08d6749-94f5-4d7d-8be8-f1a1ec7874aa
    type: regular
    task:
      id: b08d6749-94f5-4d7d-8be8-f1a1ec7874aa
      version: -1
      name: FireEye AX Upload Sample
      description: Submits a sample to FireEye AX
      script: fireeye|||fe-submit
      type: regular
      iscommand: true
      brand: fireeye
    nexttasks:
      '#none#':
      - "16"
    scriptarguments:
      analysistype:
        simple: "2"
      application:
        simple: "0"
      force:
        simple: "false"
      prefetch:
        simple: "1"
      priority:
        simple: "0"
      profiles:
        simple: ' win7-sp1m'
      timeout:
        simple: "300"
      uploadFile:
        simple: ${File.EntryID}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 387.5,
          "y": 895
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "14":
    id: "14"
    taskid: 4f8fafd7-ca9f-47fd-8909-5e5f8a475eb9
    type: condition
    task:
      id: 4f8fafd7-ca9f-47fd-8909-5e5f8a475eb9
      version: -1
      name: Is there a file to detonate?
      description: Asserts there's a file to detonate
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "11"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: inputs.File
            iscontext: true
    view: |-
      {
        "position": {
          "x": 160,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "15":
    id: "15"
    taskid: e870c12f-520e-4a84-8e4c-6eb304a0feeb
    type: condition
    task:
      id: e870c12f-520e-4a84-8e4c-6eb304a0feeb
      version: -1
      name: Is the file type supported?
      description: Asserts the file type is supported
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "13"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: File
                filters:
                - - operator: match
                    left:
                      value:
                        simple: File.Type
                      iscontext: true
                    right:
                      value:
                        simple: .*(?:PE32|EXE|DLL|JAR|JS|PDF|DOC|DOCX|RTF|XLS|PPT|PPTX|XML|ZIP|VBN|SEP|XZ|GZ|BZ2|TAR|MHTML|SWF|LNK|URL|MSI|JTD|JTT|JTDC|JTTC|HWP|HWT|HWPX|BAT|HTA|PS1|VBS|WSF|JSE|VBE|CHM|JPG|JPEG|GIF|PNG|XLSX)\b
                    ignorecase: true
                  - operator: match
                    left:
                      value:
                        simple: File.Info
                      iscontext: true
                    right:
                      value:
                        simple: .*(?:PE32|EXE|DLL|JAR|JS|PDF|DOC|DOCX|RTF|XLS|PPT|PPTX|XML|ZIP|VBN|SEP|XZ|GZ|BZ2|TAR|MHTML|SWF|LNK|URL|MSI|JTD|JTT|JTDC|JTTC|HWP|HWT|HWPX|BAT|HTA|PS1|VBS|WSF|JSE|VBE|CHM|JPG|JPEG|GIF|PNG|XLSX)\b
                    ignorecase: true
                  - operator: match
                    left:
                      value:
                        simple: File.Extension
                      iscontext: true
                    right:
                      value:
                        simple: .*(?:PE32|EXE|DLL|JAR|JS|PDF|DOC|DOCX|RTF|XLS|PPT|PPTX|XML|ZIP|VBN|SEP|XZ|GZ|BZ2|TAR|MHTML|SWF|LNK|URL|MSI|JTD|JTT|JTDC|JTTC|HWP|HWT|HWPX|BAT|HTA|PS1|VBS|WSF|JSE|VBE|CHM|JPG|JPEG|GIF|PNG|XLSX)\b
                    ignorecase: true
            iscontext: true
      - - operator: notEndWith
          left:
            value:
              simple: File.Extension
            iscontext: true
          right:
            value:
              simple: eml
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 275,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "16":
    id: "16"
    taskid: 75d77278-0907-4f26-87dc-ad51c40cb28c
    type: playbook
    task:
      id: 75d77278-0907-4f26-87dc-ad51c40cb28c
      version: -1
      name: GenericPolling
      description: |-
        Use as a sub-playbook to block execution of the master playbook until a remote action is complete.
        This playbook implements polling by continually running the command in Step #2 until the operation completes.
        The remote action should have the following structure:

        1. Initiate the operation.
        2. Poll to check if the operation completed.
        3. (optional) Get the results of the operation.
      playbookName: GenericPolling
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "17"
    scriptarguments:
      AdditionalPollingCommandArgNames: {}
      AdditionalPollingCommandArgValues: {}
      Ids:
        complex:
          root: FireEyeAX
          accessor: Submissions.Key
      Interval:
        complex:
          root: inputs.Interval
      PollingCommandArgName:
        simple: submission_Key
      PollingCommandName:
        simple: fe-submit-status
      Timeout:
        complex:
          root: inputs.Timeout
      dt:
        simple: FireEyeAX.Submissions(val.Status != 'Done').Key
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
    view: |-
      {
        "position": {
          "x": 400,
          "y": 1120
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "17":
    id: "17"
    taskid: 803f374f-daac-43d6-8483-85b6fbd56f77
    type: regular
    task:
      id: 803f374f-daac-43d6-8483-85b6fbd56f77
      version: -1
      name: AX-result
      description: Retrieve result data upon a file. NOTE - This command returns a file
      script: fireeye|||fe-submit-result
      type: regular
      iscommand: true
      brand: fireeye
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      info_level: {}
      submission_Key:
        simple: ${FireEyeAX.Submissions.Key}
    continueonerror: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 387.5,
          "y": 1420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
view: |-
  {
    "linkLabelsPosition": {
      "15_6_#default#": 0.38
    },
    "paper": {
      "dimensions": {
        "height": 1755,
        "width": 740,
        "x": 40,
        "y": 50
      }
    }
  }
inputs:
- key: File
  value:
    complex:
      root: File
  required: false
  description: File object of the file to detonate.
- key: Interval
  value:
    simple: "1"
  required: true
  description: Polling frequency - how often the polling command should run (minutes)
- key: Timeout
  value:
    simple: "30"
  required: true
  description: How much time to wait before a timeout occurs  (minutes)
outputs:
- contextPath: File.SHA256
  description: SHA256 hash of the file
  type: string
- contextPath: File.Malicious
  description: The File malicious description
  type: unknown
- contextPath: File.Type
  description: File type e.g. "PE"
  type: string
- contextPath: File.Size
  description: File size
  type: number
- contextPath: File.MD5
  description: MD5 hash of the file
  type: string
- contextPath: File.Name
  description: Filename
  type: string
- contextPath: File.SHA1
  description: SHA1 hash of the file
  type: string
- contextPath: File
  description: The File object
  type: unknown
- contextPath: File.Malicious.Vendor
  description: For malicious files, the vendor that made the decision
  type: string
- contextPath: DBotScore
  description: The DBotScore object
  type: unknown
- contextPath: DBotScore.Indicator
  description: The indicator we tested
  type: string
- contextPath: DBotScore.Type
  description: The type of the indicator
  type: string
- contextPath: DBotScore.Vendor
  description: Vendor used to calculate the score
  type: string
- contextPath: DBotScore.Score
  description: The actual score
  type: number
tests:
- Detonate File - FireEye AX - Test