Detonate File - Generic

id: Detonate File - Generic
version: -1
name: Detonate File - Generic
description: |-
  Detonate files through one or more active integrations that support file detonation.
  Supported integrations:
  - SecneurX Analysis
  - ANY.RUN Cloud Sandbox
  - McAfee Advanced Threat Defense
  - WildFire
  - Lastline
  - Cuckoo Sandbox
  - Cisco Secure Malware Analytics (ThreatGrid)
  - JoeSecurity
  - CrowdStrike Falcon Sandbox
  - FireEye AX
  - VMRay Analyzer
  - Polygon
  - CrowdStrike Falcon Intelligence Sandbox
  - OPSWAT Filescan.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: bfe472b6-a9fd-40d6-846c-6219d9a54e72
    type: start
    task:
      id: bfe472b6-a9fd-40d6-846c-6219d9a54e72
      version: -1
      name: ""
      description: Playbook start point
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
      - "14"
      - "15"
      - "19"
      - "20"
      - "23"
      - "24"
      - "25"
      - "27"
      - "29"
      - "30"
      - "31"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2415,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: b0feb039-1a24-4bcb-8a2c-e9124b61cfa0
    type: title
    task:
      id: b0feb039-1a24-4bcb-8a2c-e9124b61cfa0
      version: -1
      name: Done
      description: Done
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 3295,
          "y": 890
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: 053c6544-8faa-447a-893b-069da330da1e
    type: playbook
    task:
      id: 053c6544-8faa-447a-893b-069da330da1e
      version: -1
      name: ATD - Detonate File
      description: |-
        Detonates a File using the McAfee Advanced Threat Defense sandbox.
        Advanced Threat Defense supports the following File Types:
        32-bit Portable Executables (PE)files; 64-bit PE+files
        exe, sys, dll, com, scr, cpl, ocx, cgi
        Microsoft Office Suite documents
        doc,dotm, docx, dotx, xls, ppam, xlsx, pps, xlsb, ppsx, xlsm, ppsm, ppt, ppt, pptx, pptm, rtf, shs, xltm, sldm, xltx, sldx, xlam, thmx, docm, xar
        Just Systems Ichitaro documents
        jtd, jtdc
        Adobe
        pdf, swf
        Compressed files
        gz, 7z, tgz, msi, zip, lzh, cab, lzma, rar
        Android application package
        apk, Java, JAR, CLASS, Java Script, Java bin files
        Image files
        jpeg, png, gif
        Other file types
        cmd, ace, bat, arj, vbs, chm, xml, lnk, url, mof, htm, ocx, html, potm, eml, potx, msg, ps1, vb, reg, vba, wsc, vbe, wsf, vbs, wsh
      playbookName: ATD - Detonate File
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      File:
        complex:
          root: inputs.File
      Interval:
        simple: "1"
      Timeout:
        simple: "15"
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 50,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: 13d629fd-83d1-4096-8e89-4d8ca6b4322e
    type: playbook
    task:
      id: 13d629fd-83d1-4096-8e89-4d8ca6b4322e
      version: -1
      name: Detonate File - Lastline v2
      description: |-
        Detonates a file using the Lastline sandbox.
        Lastline supports the following file types:
        EXE, SYS, DLL, COM, SCR, CPL, OCX, CGI, DOC, DOTM, DOCX, DOTX, XLS, PPAM, XSLX, PPS, XLSB, PPSX, XLSM, PPSM, PPT, PPTX, PPTM, RTF, SHS, XLTM, SLDM, XLTX, SLDX, XLAM, THMX, DOCM, XAR, JTD, JTDC, PDF, SWF, GZ, 7Z, TGZ, MSI, ZIP, LZH, CAB, LZMA, APK, JAR, CLASS, JPEG, PNG, GIF, CMD, ACE, BAT, ARJ, VBS, CHM, XML, LNK, URL, MOF, HTM, OCX, HTML, POTM, EML, POTX, MSG, PS, |VB, REG, VBA, WSC, VBE, WSF, VBS, WSH
      playbookName: Detonate File - Lastline v2
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      File:
        complex:
          root: inputs.File
      Interval:
        simple: "1"
      Timeout:
        simple: "15"
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 480,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: d8ff24bf-a089-4590-89f1-6640c60c44ea
    type: playbook
    task:
      id: d8ff24bf-a089-4590-89f1-6640c60c44ea
      version: -1
      name: Detonate File - Cuckoo
      description: Detonates a file using Cuckoo sandbox
      playbookName: Detonate File - Cuckoo
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      File:
        complex:
          root: inputs.File
      interval:
        simple: "1"
      timeout:
        simple: "10"
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 910,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "19":
    id: "19"
    taskid: 1b28b735-33ac-4ddd-8649-6f05613db05d
    type: playbook
    task:
      id: 1b28b735-33ac-4ddd-8649-6f05613db05d
      version: -1
      name: Detonate File - FireEye AX
      description: Detonate one or more files using the FireEye AX integration. This playbook returns relevant reports to the War Room and file reputations to the context data. The detonation supports the following file types - PE32, EXE, DLL, JAR, JS, PDF, DOC, DOCX, RTF, XLS, PPT, PPTX, XML, ZIP, VBN, SEP, XZ, GZ, BZ2, TAR, MHTML, SWF, LNK, URL, MSI, JTD, JTT, JTDC, JTTC, HWP, HWT, HWPX, BAT, HTA, PS1, VBS, WSF, JSE, VBE, CHM, JPG, JPEG, GIF, PNG, XLSX
      playbookName: Detonate File - FireEye AX
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      File:
        complex:
          root: inputs.File
      Interval:
        simple: "1"
      Timeout:
        simple: "30"
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 1340,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "20":
    id: "20"
    taskid: 9d20f56a-244d-4697-8d0a-f8453eb7e638
    type: playbook
    task:
      id: 9d20f56a-244d-4697-8d0a-f8453eb7e638
      version: -1
      name: Detonate File - VMRay
      description: Detonates a file using VMRay
      playbookName: Detonate File - VMRay
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      File:
        complex:
          root: inputs.File
          transformers:
          - operator: uniq
      interval:
        simple: "1"
      timeout:
        simple: "10"
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 1770,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "21":
    id: "21"
    taskid: fd1dbf17-5b12-4369-86c7-8082f714df31
    type: playbook
    task:
      id: fd1dbf17-5b12-4369-86c7-8082f714df31
      version: -1
      name: Detonate File - Group-IB TDS Polygon
      description: 'Detonate file using Group-IB TDS Polygon integration. This playbook returns relevant reports to the War Room and file reputations to the context data. The detonation supports the following file types: 7z, ace, ar, arj, bat, bz2, cab, chm, cmd, com, cpgz, cpl, csv, dat, doc, docm, docx, dot, dotm, dotx, eml, exe, gz, gzip, hta, htm, html, iqy, iso, jar, js, jse, lnk, lz, lzma, lzo,  lzh, mcl, mht, msg, msi, msp, odp, ods, odt, ots, ott, pdf, pif, potm, potx, pps, ppsm, ppsx, ppt, pptm, pptx, ps1, pub, py, pyc, r*, rar, reg, rtf, scr, settingcontent-ms, stc, svg, sxc, sxw, tar, taz,  .tb2, .tbz, .tbz2, tgz, tlz, txz, tzo, txt, url, uue, vbe, vbs, wsf, xar, xls, xlsb, xlsm, xlsx, xml, xz, z*, zip.'
      playbookName: Detonate File - Group-IB TDS Polygon
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      Interval:
        simple: "1"
      Timeout:
        simple: "60"
      file_id:
        complex:
          root: inputs.EntryID
    separatecontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 3510,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "23":
    id: "23"
    taskid: c28803a1-9938-4fa0-8994-4f1d01f7e800
    type: playbook
    task:
      id: c28803a1-9938-4fa0-8994-4f1d01f7e800
      version: -1
      name: Detonate File - SecneurX Analysis
      description: Detonates a file using the SecneurX Analysis Integration. Returns relevant reports to the War Room and file reputations to the context data.
      playbookName: Detonate File - SecneurX Analysis
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    separatecontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2200,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "24":
    id: "24"
    taskid: f19de2c0-c4f0-4e34-8922-c319d40a1781
    type: playbook
    task:
      id: f19de2c0-c4f0-4e34-8922-c319d40a1781
      version: -1
      name: Detonate File - JoeSecurity V2
      description: The Detonate File using Joe Sandbox Process is designed to streamline and enhance the security assessment of files. This automated system accepts a user-submitted file, sends it for in-depth analysis using Joe Sandbox technology, and returns comprehensive results as attachments to the user. The process is designed to be swift, efficient, and secure, providing users with valuable insights into potential threats and vulnerabilities within their files.
      playbookName: Detonate File - JoeSecurity V2
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      File:
        complex:
          root: inputs.File
      InternetAccess:
        simple: "True"
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 2630,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "25":
    id: "25"
    taskid: 65920250-c97e-4ff7-8f34-4d409f651a2c
    type: condition
    task:
      id: 65920250-c97e-4ff7-8f34-4d409f651a2c
      version: -1
      name: Check if EntryID exists
      description: Checks if the entry ID for the file to be detonated exists.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "26"
      - "21"
      - "36"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: inputs.EntryID
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 3295,
          "y": 210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "26":
    id: "26"
    taskid: 4643aaf7-5f3b-4851-8773-b74b87e18603
    type: regular
    task:
      id: 4643aaf7-5f3b-4851-8773-b74b87e18603
      version: -1
      name: Detonate File - MetaDefender Aether
      description: Detonates a file using the MetaDefender Aether Integration. Returns relevant reports to the War Room and file reputations to the context data.
      script: metadefender-aether-scan-file
      type: regular
      iscommand: true
      brand: MetaDefender Aether
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      entry_id:
        complex:
          root: inputs.File
          accessor: EntryID
          transformers:
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 3080,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "27":
    id: "27"
    taskid: 8febf391-f313-4539-89c1-bd4df099dc51
    type: playbook
    task:
      id: 8febf391-f313-4539-89c1-bd4df099dc51
      version: -1
      name: Detonate file - CrowdStrike Falcon Sandbox v2
      description: Detonates a File using CrowdStrike Falcon sandbox.
      playbookName: Detonate file - CrowdStrike Falcon Sandbox v2
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      EnvironmentID:
        simple: "100"
      File:
        complex:
          root: inputs.File
          transformers:
          - operator: uniq
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 5250,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "29":
    id: "29"
    taskid: 3136d7d0-e7cc-49e2-8a83-8ff39ee4c834
    type: playbook
    task:
      id: 3136d7d0-e7cc-49e2-8a83-8ff39ee4c834
      version: -1
      name: Detonate File - ThreatGrid v2
      description: Detonate one or more files using the ThreatGrid integration. This playbook returns relevant reports to the War Room and file reputations to the context data. The detonation supports the following file types - EXE, DLL, JAR, JS, PDF, DOC, DOCX, RTF, XLS, PPT, PPTX, XML, ZIP, VBN, SEP, XZ, GZ, BZ2, TAR, MHTML, SWF, LNK, URL, MSI, JTD, JTT, JTDC, JTTC, HWP, HWT, HWPX, BAT, HTA, PS1, VBS, WSF, JSE, VBE, CHM.
      playbookName: Detonate File - ThreatGrid v2
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      File:
        complex:
          root: inputs.File
      interval:
        simple: "60"
      timeout:
        simple: "900"
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 5680,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "30":
    id: "30"
    taskid: b52cc619-b027-4886-8a06-a0975dbc61a9
    type: playbook
    task:
      id: b52cc619-b027-4886-8a06-a0975dbc61a9
      version: -1
      name: Detonate File - CrowdStrike Falcon Intelligence Sandbox v2
      description: |-
        Detonates a file using CrowdStrike Falcon Intelligence Sandbox.
        Accepted file formats:
        Portable executables: .exe, .scr, .pif, .dll, .com, .cpl, etc.
        Office documents: .doc, .docx, .ppt, .pps, .pptx, .ppsx, .xls, .xlsx, .rtf, .pub
        PDF
        APK
        Executable JAR
        Windows script component: .sct
        Windows shortcut: .lnk
        Windows help: .chm
        HTML application: .hta
        Windows script file: .wsf
        Javascript: .js
        Visual Basic: .vbs, .vbe
        Shockwave Flash: .swf
        Perl: .pl
        Powershell: .ps1, .psd1, .psm1
        Scalable vector graphics: .svg
        Python: .py
        Linux ELF executables
        Email files: MIME RFC 822 .eml, Outlook .msg.
      playbookName: Detonate File - CrowdStrike Falcon Intelligence Sandbox v2
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      EnvironmentID:
        simple: '160: Windows 10'
      File:
        complex:
          root: inputs.File
          transformers:
          - operator: uniq
      FullReport:
        simple: "True"
      Interval:
        simple: "1"
      Timeout:
        simple: "10"
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 6110,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "31":
    id: "31"
    taskid: 18f66f67-79fe-416e-86aa-f68470eacfac
    type: playbook
    task:
      id: 18f66f67-79fe-416e-86aa-f68470eacfac
      version: -1
      name: WildFire - Detonate file v2
      playbookName: WildFire - Detonate file v2
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      File:
        complex:
          root: inputs.File
          transformers:
          - operator: uniq
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 6540,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "33":
    id: "33"
    taskid: 5a218a31-9417-4da1-818f-e46204e57f90
    type: playbook
    task:
      id: 5a218a31-9417-4da1-818f-e46204e57f90
      description: This playbook submits a file extracted from an incident attachment to the ANY.RUN cloud sandbox for dynamic analysis in an Android environment. It helps to automate malware detonation and behavior observation on Android OS.
      version: -1
      name: ANYRUN Detonate File Android
      playbookName: ANYRUN Detonate File Android
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    separatecontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 3960,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "34":
    id: "34"
    taskid: 97ba62f0-bdcd-42ca-8281-4550ece095bd
    type: playbook
    task:
      id: 97ba62f0-bdcd-42ca-8281-4550ece095bd
      description: This playbook submits a file extracted from an incident attachment to the ANY.RUN cloud sandbox for dynamic analysis in an Linux environment. It helps to automate malware detonation and behavior observation on Ubuntu OS.
      version: -1
      name: ANYRUN Detonate File Linux
      playbookName: ANYRUN Detonate File Linux
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    separatecontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 4390,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "35":
    id: "35"
    taskid: cf6dfc9a-fe83-4241-8273-164c93cb29f3
    type: playbook
    task:
      id: cf6dfc9a-fe83-4241-8273-164c93cb29f3
      description: This playbook submits a file extracted from an incident attachment to the ANY.RUN cloud sandbox for dynamic analysis in an Windows environment. It helps to automate malware detonation and behavior observation on Windows OS.
      version: -1
      name: ANYRUN Detonate File Windows
      playbookName: ANYRUN Detonate File Windows
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    separatecontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 4820,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "36":
    id: "36"
    taskid: 9a6ceb8b-af9e-4e7f-8ff3-a4900825e4a0
    type: condition
    task:
      id: 9a6ceb8b-af9e-4e7f-8ff3-a4900825e4a0
      version: -1
      name: Check the correctness of the ANY.RUN parameters
      description: Check the correctness of the ANY.RUN parameters
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "40"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: inputs.anyrun_os
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 4062.5,
          "y": 380
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "40":
    id: "40"
    taskid: 9d870bdd-181b-4f7b-b175-04b532a4efbd
    type: condition
    task:
      id: 9d870bdd-181b-4f7b-b175-04b532a4efbd
      version: -1
      name: Select ANY.RUN playbook
      description: Select ANY.RUN playbook
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      Android:
      - "33"
      Linux:
      - "34"
      Windows:
      - "35"
    separatecontext: false
    conditions:
    - label: Windows
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: inputs.anyrun_os
            iscontext: true
          right:
            value:
              simple: windows
    - label: Android
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: inputs.anyrun_os
            iscontext: true
          right:
            value:
              simple: android
    - label: Linux
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: inputs.anyrun_os
            iscontext: true
          right:
            value:
              simple: linux
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 4390,
          "y": 550
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "25_21_yes": 0.71,
      "25_26_yes": 0.5,
      "25_3_#default#": 0.1,
      "40_33_Android": 0.52
    },
    "paper": {
      "dimensions": {
        "height": 900,
        "width": 6870,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: EntryID
  value:
    complex:
      root: File
      accessor: EntryID
  required: false
  description: Entry ID of file to be detonated
  playbookInputQuery:
- key: File
  value:
    complex:
      root: File
  required: false
  description: File object of file to be detonated
  playbookInputQuery:
- key: anyrun_os
  value:
    simple: windows
  required: false
  description: 'Specify ANY.RUN operation system type. Supports: windows, linux, android'
  playbookInputQuery:
inputSections:
- inputs:
  - EntryID
  - File
  name: General (Inputs group)
  description: Generic group for inputs
- inputs:
  - anyrun_os
  name: ANY.RUN
  description: ANY.RUN group for inputs
outputs:
- contextPath: Joe.Analysis.Status
  description: Analysis Status.
  type: string
- contextPath: File.Name
  description: The file's name (only in case of report type=json).
  type: string
- contextPath: File.SHA1
  description: SHA1 hash of the file.
  type: string
- contextPath: File.SHA256
  description: SHA256 hash of the file.
  type: string
- contextPath: File.Size
  description: File size (only in case of report type=json).
  type: number
- contextPath: File.Type
  description: File type e.g. "PE" (only in case of report type=json).
  type: string
- contextPath: File.Malicious
  description: The File malicious description.
  type: unknown
- contextPath: File.Malicious.Description
  description: For malicious files, the reason for the vendor to make the decision.
  type: string
- contextPath: File.Malicious.Vendor
  description: For malicious files, the vendor that made the decision.
  type: string
- contextPath: DBotScore
  description: The Indicator's object.
  type: unknown
- contextPath: DBotScore.Indicator
  description: The indicator that was tested.
  type: string
- contextPath: DBotScore.Score
  description: The actual score.
  type: number
- contextPath: DBotScore.Type
  description: The type of the indicator.
  type: string
- contextPath: DBotScore.Vendor
  description: Vendor used to calculate the score.
  type: string
- contextPath: IP.Address
  description: IP's relevant to the sample.
  type: string
- contextPath: DBotScore.Malicious.Vendor
  description: Vendor used to calculate the score.
  type: string
- contextPath: DBotScore.Malicious.Detections
  description: The sub analysis detection statuses.
  type: string
- contextPath: DBotScore.Malicious.SHA1
  description: The SHA1 of the file.
  type: string
- contextPath: File
  description: The File's object.
  type: unknown
- contextPath: File.MD5
  description: MD5 hash of the file.
  type: string
- contextPath: Joe.Analysis.SampleName
  description: Sample Data, could be a file name or URL.
  type: string
- contextPath: Joe.Analysis.Comments
  description: Analysis Comments.
  type: string
- contextPath: Joe.Analysis.Time
  description: Submitted Time.
  type: date
- contextPath: Joe.Analysis.Runs
  description: Sub-Analysis Information.
  type: unknown
- contextPath: Joe.Analysis.Result
  description: Analysis Results.
  type: string
- contextPath: Joe.Analysis.Errors
  description: Raised errors during sampling.
  type: unknown
- contextPath: Joe.Analysis.Systems
  description: Analysis OS.
  type: unknown
- contextPath: Joe.Analysis.MD5
  description: MD5 of analysis sample.
  type: string
- contextPath: Joe.Analysis.SHA1
  description: SHA1 of analysis sample.
  type: string
- contextPath: Joe.Analysis.SHA256
  description: SHA256 of analysis sample.
  type: string
- contextPath: InfoFile.Name
  description: FileName of the report file.
  type: string
- contextPath: InfoFile.EntryID
  description: The EntryID of the report file.
  type: string
- contextPath: InfoFile.Size
  description: File Size.
  type: number
- contextPath: InfoFile.Type
  description: File type e.g. "PE".
  type: string
- contextPath: InfoFile.Info
  description: Basic information of the file.
  type: string
- contextPath: File.Extension
  description: The extension of the file.
  type: string
- contextPath: InfoFile
  description: The report file's object.
  type: unknown
- contextPath: WildFire.Report
  description: The submission object.
  type: unknown
- contextPath: WildFire.Report.Status
  description: The status of the submission.
  type: string
- contextPath: WildFire.Report.SHA256
  description: SHA256 of the submission.
  type: string
- contextPath: WildFire.Report.MD5
  description: MD5 of the submission.
  type: string
- contextPath: WildFire.Report.FileType
  description: The type of the submission.
  type: string
- contextPath: WildFire.Report.Size
  description: The size of the submission.
  type: number
- contextPath: Joe.Analysis
  description: The Analysis object.
  type: string
- contextPath: Cuckoo.Task.Category
  description: Category of task.
  type: string
- contextPath: Cuckoo.Task.Machine
  description: Machine of task.
  type: string
- contextPath: Cuckoo.Task.Errors
  description: Errors of task.
  type: string
- contextPath: Cuckoo.Task.Target
  description: Target of task.
  type: string
- contextPath: Cuckoo.Task.Package
  description: Package of task.
  type: string
- contextPath: Cuckoo.Task.SampleID
  description: Sample ID of task.
  type: string
- contextPath: Cuckoo.Task.Guest
  description: Task guest.
  type: string
- contextPath: Cuckoo.Task.Custom
  description: Custom values of task.
  type: string
- contextPath: Cuckoo.Task.Owner
  description: Task owner.
  type: string
- contextPath: Cuckoo.Task.Priority
  description: Priority of task.
  type: string
- contextPath: Cuckoo.Task.Platform
  description: Platform of task.
  type: string
- contextPath: Cuckoo.Task.Options
  description: Task options.
  type: string
- contextPath: Cuckoo.Task.Status
  description: Task status.
  type: string
- contextPath: Cuckoo.Task.EnforceTimeout
  description: Is timeout of task enforced.
  type: string
- contextPath: Cuckoo.Task.Timeout
  description: Task timeout.
  type: string
- contextPath: Cuckoo.Task.Memory
  description: Task memory.
  type: string
- contextPath: Cuckoo.Task.Tags
  description: Task tags.
  type: string
- contextPath: Cuckoo.Task.ID
  description: ID of task.
  type: string
- contextPath: Cuckoo.Task.AddedOn
  description: Date on which the task was added.
  type: string
- contextPath: Cuckoo.Task.CompletedOn
  description: Date on which the task was completed.
  type: string
- contextPath: Cuckoo.Task.Score
  description: Reported score of the the task.
  type: string
- contextPath: Cuckoo.Task.Monitor
  description: Monitor of the reported task.
  type: string
- contextPath: VMRay.Job
  description: The Job Object.
  type: unknown
- contextPath: VMRay.Job.JobID
  description: The ID of a new job.
  type: number
- contextPath: VMRay.Job.SampleID
  description: The ID of sample.
  type: number
- contextPath: VMRay.Job.Created
  description: The timestamp of the created job.
  type: date
- contextPath: VMRay.Job.VMName
  description: The name of virtual machine.
  type: string
- contextPath: VMRay.Job.VMID
  description: The ID of virtual machine.
  type: number
- contextPath: VMRay.Sample
  description: The Sample For Analysis.
  type: unknown
- contextPath: VMRay.Sample.SampleID
  description: The sample ID of the task.
  type: number
- contextPath: VMRay.Sample.Created
  description: The timestamp of the created sample.
  type: date
- contextPath: VMRay.Sample.FileName
  description: The file name of the sample.
  type: string
- contextPath: VMRay.Sample.MD5
  description: The MD5 hash of the sample.
  type: string
- contextPath: VMRay.Sample.SHA1
  description: The SHA1 hash of the sample.
  type: string
- contextPath: VMRay.Sample.SHA256
  description: The SHA256 hash of the sample.
  type: string
- contextPath: VMRay.Sample.SSDeep
  description: The SSDeep of the sample.
  type: string
- contextPath: VMRay.Sample.Verdict
  description: Verdict for the sample (Malicious, Suspicious, Clean, Not Available).
  type: String
- contextPath: VMRay.Sample.VerdictReason
  description: Description of the Verdict Reason.
  type: String
- contextPath: VMRay.Sample.Severity
  description: Severity of the sample (Malicious, Suspicious, Good, Blacklisted, Whitelisted, Unknown). Deprecated.
  type: string
- contextPath: VMRay.Sample.Type
  description: The file type.
  type: string
- contextPath: VMRay.Sample.Classifications
  description: The classifications of the sample.
  type: string
- contextPath: VMRay.Submission
  description: Submission Object.
  type: unknown
- contextPath: VMRay.Submission.SubmissionID
  description: The submission ID.
  type: number
- contextPath: VMRay.Submission.HadErrors
  description: Whether there are any errors in the submission.
  type: boolean
- contextPath: VMRay.Submission.IsFinished
  description: The status of submission. Can be, "true" or "false".
  type: boolean
- contextPath: VMRay.Submission.MD5
  description: The MD5 hash of the sample in submission.
  type: string
- contextPath: VMRay.Submission.SHA1
  description: The SHA1 hash of the sample in submission.
  type: string
- contextPath: VMRay.Submission.SHA256
  description: The SHA256 hash of the sample in submission.
  type: string
- contextPath: VMRay.Submission.Verdict
  description: Verdict for the sample (Malicious, Suspicious, Clean, Not Available).
  type: String
- contextPath: VMRay.Submission.VerdictReason
  description: Description of the Verdict Reason.
  type: String
- contextPath: VMRay.Submission.Severity
  description: Severity of the sample (Malicious, Suspicious, Good, Blacklisted, Whitelisted, Unknown). Deprecated.
  type: string
- contextPath: VMRay.Submission.SSDeep
  description: The SSDeep hash of the sample in submission.
  type: string
- contextPath: VMRay.Submission.SampleID
  description: The ID of the sample in submission.
  type: number
- contextPath: VMRay.Sample.IOC.File
  description: File Object.
  type: unknown
- contextPath: VMRay.Sample.IOC.File.AnalysisID
  description: The IDs of other analyses that contain the given file.
  type: number
- contextPath: VMRay.Sample.IOC.File.Name
  description: The name of the file.
  type: string
- contextPath: VMRay.Sample.IOC.File.Operation
  description: The operation of the given file.
  type: string
- contextPath: VMRay.Sample.IOC.File.ID
  description: The ID of the file.
  type: number
- contextPath: VMRay.Sample.IOC.File.Type
  description: The type of the file.
  type: string
- contextPath: VMRay.Sample.IOC.File.Hashes
  description: File Hashes Object.
  type: unknown
- contextPath: VMRay.Sample.IOC.File.Hashes.MD5
  description: The MD5 hash of the given file.
  type: string
- contextPath: VMRay.Sample.IOC.File.Hashes.SSDeep
  description: The SSDeep hash of the given file.
  type: string
- contextPath: VMRay.Sample.IOC.File.Hashes.SHA256
  description: The SHA256 hash of the given file.
  type: string
- contextPath: VMRay.Sample.IOC.File.Hashes.SHA1
  description: The SHA1 hash of the given file.
  type: string
- contextPath: VMRay.Sample.IOC.URL
  description: URL Object.
  type: unknown
- contextPath: VMRay.Sample.IOC.URL.AnalysisID
  description: The IDs of the other analyses that contain the given URL.
  type: number
- contextPath: VMRay.Sample.IOC.URL.URL
  description: The URL.
  type: string
- contextPath: VMRay.Sample.IOC.URL.Operation
  description: The operation of the specified URL.
  type: string
- contextPath: VMRay.Sample.IOC.URL.ID
  description: The ID of the URL.
  type: number
- contextPath: VMRay.Sample.IOC.URL.Type
  description: The type of the URL.
  type: string
- contextPath: VMRay.Sample.IOC.Domain
  description: Domain Object.
  type: unknown
- contextPath: VMRay.Sample.IOC.Domain.AnalysisID
  description: The IDs of the other analyses that contain the given domain.
  type: number
- contextPath: VMRay.Sample.IOC.Domain.Domain
  description: The domain.
  type: string
- contextPath: VMRay.Sample.IOC.Domain.ID
  description: The ID of the domain.
  type: number
- contextPath: VMRay.Sample.IOC.Domain.Type
  description: The type of the domain.
  type: string
- contextPath: VMRay.Sample.IOC.IP
  description: IP Object.
  type: unknown
- contextPath: VMRay.Sample.IOC.IP.AnalysisID
  description: The IDs of the other analyses that contain the given IP address.
  type: number
- contextPath: VMRay.Sample.IOC.IP.IP
  description: The IP address.
  type: string
- contextPath: VMRay.Sample.IOC.IP.Operation
  description: The operation of the given IP address.
  type: string
- contextPath: VMRay.Sample.IOC.IP.ID
  description: The ID of the IP address.
  type: number
- contextPath: VMRay.Sample.IOC.IP.Type
  description: The type of the IP address.
  type: string
- contextPath: VMRay.Sample.IOC.Mutex
  description: Mutex Object.
  type: unknown
- contextPath: VMRay.Sample.IOC.Mutex.AnalysisID
  description: The IDs of other analyses that contain the given IP address.
  type: number
- contextPath: VMRay.Sample.IOC.Mutex.Name
  description: The name of the mutex.
  type: string
- contextPath: VMRay.Sample.IOC.Mutex.Operation
  description: The operation of the given mutex.
  type: string
- contextPath: VMRay.Sample.IOC.Mutex.ID
  description: The ID of the mutex.
  type: number
- contextPath: VMRay.Sample.IOC.Mutex.Type
  description: The type of the mutex.
  type: string
- contextPath: VMRay.ThreatIndicator
  description: Indicator Object.
  type: unknown
- contextPath: VMRay.ThreatIndicator.AnalysisID
  description: The list of connected analysis IDs.
  type: number
- contextPath: VMRay.ThreatIndicator.Category
  description: The category of threat indicators.
  type: string
- contextPath: VMRay.ThreatIndicator.Classification
  description: The classifications of threat indicators.
  type: string
- contextPath: VMRay.ThreatIndicator.ID
  description: The ID of the threat indicator.
  type: number
- contextPath: VMRay.ThreatIndicator.Operation
  description: The operation that caused the indicators.
  type: string
- contextPath: SecneurXAnalysis.Report.SHA256
  description: SHA256 value of the analyzed sample.
  type: string
- contextPath: SecneurXAnalysis.Report.Verdict
  description: Summary result of the analyzed sample.
  type: string
- contextPath: SecneurXAnalysis.Report.Tags
  description: More details of the analyzed sample.
  type: string
- contextPath: SecneurXAnalysis.Report.IOC
  description: List of IOC's observed in the analyzed sample.
  type: string
- contextPath: SecneurXAnalysis.Report.Status
  description: Analysis queued sample state.
  type: String
- contextPath: SecneurXAnalysis.Report.DnsRequests
  description: List of DNS data observed in the analyzed sample.
  type: string
- contextPath: SecneurXAnalysis.Report.HttpRequests
  description: List of HTTP data observed in the analyzed sample.
  type: string
- contextPath: SecneurXAnalysis.Report.JA3Digests
  description: List of JA3 data observed in the analyzed sample.
  type: string
- contextPath: SecneurXAnalysis.Report.ProcessCreated
  description: Process behaviour data observed in the analyzed sample.
  type: string
- contextPath: SecneurXAnalysis.Report.RegistrySet
  description: List of Registry creations observed in the analyzed sample.
  type: string
- contextPath: SecneurXAnalysis.Report.RegistryDeleted
  description: List of Registry deletions observed in the analyzed sample.
  type: string
- contextPath: SecneurXAnalysis.Report.FileCreated
  description: List of File creations observed in the analyzed sample.
  type: string
- contextPath: SecneurXAnalysis.Report.FileDropped
  description: List of File drops observed in the analyzed sample.
  type: string
- contextPath: SecneurXAnalysis.Report.FileDeleted
  description: List of File deletions observed in the analyzed sample.
  type: string
- contextPath: SecneurXAnalysis.Report.FileModified
  description: List of File changes observed in the analyzed sample.
  type: string
- contextPath: SecneurXAnalysis.Report.Platform
  description: Platform of the analyzed sample.
  type: String
- contextPath: ATD.Task.taskId
  description: The task ID of the sample uploaded.
  type: string
- contextPath: ATD.Task.jobId
  description: The job ID of the sample uploaded.
  type: string
- contextPath: ATD.Task.messageId
  description: The message Id relevant to the sample uploaded.
  type: string
- contextPath: ATD.Task.srcIp
  description: Source IPv4 address.
  type: string
- contextPath: ATD.Task.destIp
  description: Destination IPv4 address.
  type: string
- contextPath: ATD.Task.MD5
  description: MD5 of the sample uploaded.
  type: string
- contextPath: ATD.Task.SHA1
  description: SHA1 of the sample uploaded.
  type: string
- contextPath: ATD.Task.SHA256
  description: SHA256 of the sample uploaded.
  type: string
- contextPath: InfoFile.Extension
  description: The extension of the report file.
  type: string
- contextPath: File.EntryID
  description: The Entry ID of the sample.
  type: string
- contextPath: URL.Data
  description: List of malicious URLs identified by Lastline analysis.
  type: string
- contextPath: URL.Malicious.Vendor
  description: For malicious URLs, the vendor that made the decision.
  type: string
- contextPath: URL.Malicious.Description
  description: For malicious URLs, the reason for the vendor to make the decision.
  type: string
- contextPath: URL.Malicious.Score
  description: For malicious URLs, the score from the vendor.
  type: number
- contextPath: Lastline.Submission.Status
  description: Status of the submission.
  type: string
- contextPath: Lastline.Submission.DNSqueries
  description: List of DNS queries done by the analysis subject.
  type: string
- contextPath: Lastline.Submission.NetworkConnections
  description: ist of network connections done by the analysis subject.
  type: string
- contextPath: Lastline.Submission.DownloadedFiles
  description: List of files that were downloaded using the Microsoft Windows file-download API functions. Each element is a tuple of file-origin URL and a File element.
  type: string
- contextPath: Lastline.Submission.UUID
  description: Task UUID of submitted sample.
  type: number
- contextPath: Lastline.Submission.YaraSignatures.name
  description: Yara signatures name.
  type: string
- contextPath: Lastline.Submission.YaraSignatures.score
  description: The score according to the yara signatures. from 0 to 100.
  type: number
- contextPath: Lastline.Submission.YaraSignatures.internal
  description: True if the signature is only for internal usage.
  type: boolean
- contextPath: Lastline.Submission.Process.arguments
  description: Argument of the process.
  type: string
- contextPath: Lastline.Submission.Process.process_id
  description: The process ID.
  type: string
- contextPath: Lastline.Submission.Process.executable.abs_path
  description: Absolute path of the executable of the process.
  type: string
- contextPath: Lastline.Submission.Process.executable.filename
  description: Filename of the executable.
  type: string
- contextPath: Lastline.Submission.Process.executable.yara_signature_hits
  description: Yara signature of the executable of the process.
  type: string
- contextPath: Lastline.Submission.Process.executable.ext_info
  description: Executable info of the process.
  type: string
- contextPath: Joe.Analysis.ID
  description: Web ID.
  type: string
- contextPath: Domain.Name
  description: The Domain name.
  type: string
- contextPath: Domain.DNS
  description: A list of IP objects resolved by DNS.
  type: string
- contextPath: RegistryKey.Path
  description: The path to the registry key.
  type: string
- contextPath: RegistryKey.Value
  description: The value at the given RegistryKey.
  type: string
- contextPath: Process.Name
  description: Process name.
  type: string
- contextPath: Process.PID
  description: Process PID.
  type: number
- contextPath: Process.CommandLine
  description: Process Command Line.
  type: string
- contextPath: Process.Path
  description: Process path.
  type: string
- contextPath: Process.StartTime
  description: Process start time.
  type: date
- contextPath: Process.EndTime
  description: Process end time.
  type: date
- contextPath: Polygon.Analysis.ID
  description: Analysis ID in THF.
  type: number
- contextPath: Polygon.Analysis.Name
  description: File Name.
  type: string
- contextPath: Polygon.Analysis.Size
  description: File Size.
  type: number
- contextPath: Polygon.Analysis.Started
  description: Analysis start timestamp.
  type: date
- contextPath: Polygon.Analysis.Analyzed
  description: Analysis finish timestamp.
  type: date
- contextPath: Polygon.Analysis.MD5
  description: Analyzed file MD5 hash.
  type: string
- contextPath: Polygon.Analysis.SHA1
  description: Analyzed file SHA1 hash.
  type: string
- contextPath: Polygon.Analysis.SHA256
  description: Analyzed file SHA256.
  type: string
- contextPath: Polygon.Analysis.Result
  description: Analysis verdict.
  type: string
- contextPath: Polygon.Analysis.Status
  description: The analysis status.
  type: string
- contextPath: Polygon.Analysis.Verdict
  description: Analysis verdict.
  type: boolean
- contextPath: Polygon.Analysis.Probability
  description: Verdict probability.
  type: string
- contextPath: Polygon.Analysis.Families
  description: Malware families.
  type: string
- contextPath: Polygon.Analysis.Score
  description: Polygon score.
  type: number
- contextPath: Polygon.Analysis.Internet-connection
  description: Internet availability.
  type: string
- contextPath: Polygon.Analysis.Type
  description: File type.
  type: string
- contextPath: Polygon.Analysis.DumpExists
  description: Network activity dump exists.
  type: boolean
- contextPath: Polygon.Analysis.File
  description: The information about files in analysis.
  type: string
- contextPath: Polygon.Analysis.URL
  description: The information about URL indicators.
  type: string
- contextPath: Polygon.Analysis.IP
  description: The information about IP indicators.
  type: string
- contextPath: Polygon.Analysis.Domain
  description: The information about Domain indicators.
  type: string
- contextPath: Polygon.Analysis.RegistryKey
  description: The information about registry keys which were modified during the analysis.
  type: string
- contextPath: Polygon.Analysis.Process
  description: The information about processes started during the analysis.
  type: string
- contextPath: csfalconx.resource.id
  description: Analysis ID.
  type: String
- contextPath: csfalconx.resource.verdict
  description: Analysis verdict.
  type: String
- contextPath: csfalconx.resource.created_timestamp
  description: Analysis start time.
  type: String
- contextPath: csfalconx.resource.environment_id
  description: Environment ID.
  type: String
- contextPath: csfalconx.resource.threat_score
  description: Score of the threat.
  type: Int
- contextPath: csfalconx.resource.submit_url
  description: URL submitted for analysis.
  type: String
- contextPath: csfalconx.resource.submission_type
  description: Type of submitted artifact, for example file, URL, etc.
  type: String
- contextPath: csfalconx.resource.filetype
  description: File type.
  type: String
- contextPath: csfalconx.resource.filesize
  description: File size.
  type: Int
- contextPath: csfalconx.resource.sha256
  description: SHA256 hash of the submitted file.
  type: String
- contextPath: csfalconx.resource.ioc_report_strict_csv_artifact_id
  description: ID of the IOC pack to download (CSV).
  type: String
- contextPath: csfalconx.resource.ioc_report_broad_csv_artifact_id
  description: ID of the IOC pack to download (CSV).
  type: String
- contextPath: csfalconx.resource.ioc_report_strict_json_artifact_id
  description: ID of the IOC pack to download (JSON).
  type: Int
- contextPath: csfalconx.resource.ioc_report_broad_json_artifact_id
  description: ID of the IOC pack to download (JSON).
  type: String
- contextPath: csfalconx.resource.ioc_report_strict_stix_artifact_id
  description: ID of the IOC pack to download (STIX).
  type: String
- contextPath: csfalconx.resource.ioc_report_broad_stix_artifact_id
  description: ID of the IOC pack to download (STIX).
  type: Int
- contextPath: csfalconx.resource.ioc_report_strict_maec_artifact_id
  description: ID of the IOC pack to download (MAEC).
  type: String
- contextPath: csfalconx.resource.ioc_report_broad_maec_artifact_id
  description: ID of the IOC pack to download (MAEC).
  type: String
- contextPath: csfalconx.resource.snadbox.environment_description
  description: Environment description.
  type: String
- contextPath: OPSWAT.Filescan.Submission.flow_id
  description: The flow ID.
  type: string
- contextPath: OPSWAT.Filescan.Analysis.finalVerdict.verdict
  description: The final verdict.
  type: string
- contextPath: OPSWAT.Filescan.Analysis.allTags
  description: All tags.
  type: string
- contextPath: OPSWAT.Filescan.Analysis.overallState
  description: Overall state of the scan.
  type: string
- contextPath: OPSWAT.Filescan.Analysis.subtaskReferences
  description: Status of scan subtasks.
  type: string
- contextPath: OPSWAT.Filescan.Analysis.allSignalGroups
  description: All signal groups.
  type: string
- contextPath: OPSWAT.Filescan.Analysis.resources
  description: Resources.
  type: string
- contextPath: OPSWAT.Filescan.Analysis.taskReference.name
  description: Name of the main scan task.
  type: string
- contextPath: OPSWAT.Filescan.Analysis.taskReference.additionalInfo
  description: Additional informations about the main scan task.
  type: string
- contextPath: OPSWAT.Filescan.Analysis.taskReference.ID
  description: ID of the main scan task.
  type: string
- contextPath: OPSWAT.Filescan.Analysis.taskReference.state
  description: State of the main scan task.
  type: string
- contextPath: OPSWAT.Filescan.Analysis.taskReference.resourceReference
  description: Resource reference of the main scan task.
  type: string
- contextPath: OPSWAT.Filescan.Analysis.taskReference.opcount
  description: Counter.
  type: string
- contextPath: OPSWAT.Filescan.Analysis.taskReference.processTime
  description: processTime.
  type: string
- contextPath: OPSWAT.Filescan.Analysis.file.name
  description: The name of the file.
- contextPath: OPSWAT.Filescan.Analysis.file.hash
  description: The SHA256 of the file.
- contextPath: OPSWAT.Filescan.Analysis.file.type
  description: The type of the submission.
- contextPath: ANYRUN.SandboxAnalysis.mitre.name
  description: 'MITRE Technic text description.'
  type: String
- contextPath: ANYRUN.SandboxAnalysis.mitre.phases
  description: "MITRE Technic phases."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.mitre.id
  description: "MITRE Technic identifier."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.debugStrings
  type: Unknown
  description: "Analysis debug information."
- contextPath: ANYRUN.SandboxAnalysis.incidents.process
  description: "Analysis process."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.incidents.events.time
  type: Date
  description: "Event time."
- contextPath: ANYRUN.SandboxAnalysis.incidents.events.cmdline
  description: "Event command line."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.incidents.events.image
  description: "Event image."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.incidents.mitre.v
  description: "MITRE version."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.incidents.mitre.sid
  description: "SID."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.incidents.mitre.tid
  description: "TID."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.incidents.count
  description: "Count of related incidents."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.incidents.firstSeen
  type: Date
  description: "Incident first seen date."
- contextPath: ANYRUN.SandboxAnalysis.incidents.source
  description: "Incident source."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.incidents.desc
  description: "Incident description."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.incidents.title
  description: "Incident title."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.incidents.threatLevel
  description: "Incident threat level."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.incidents.events.typeValue
  description: "Event type value."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.incidents.events.key
  description: "Event key."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.incidents.events.value
  description: "Event value."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.incidents.events.name
  description: "Event name."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.incidents.events.operation
  description: "Even operation."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.incidents.events.cmdParent
  description: "Event parent cmd."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.incidents.events.cmdChild
  description: "Event child cmd."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.modified.registry.time
  type: Date
  description: "Registry time."
- contextPath: ANYRUN.SandboxAnalysis.modified.registry.process
  description: "Registry process."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.modified.registry.operation
  description: "Registry operation."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.modified.registry.value
  description: "Registry value."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.modified.registry.name
  description: "Registry name."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.modified.registry.key
  description: "Registry key."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.modified.files.process
  description: "File process."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.modified.files.size
  description: "File size."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.modified.files.filename
  description: "Filename."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.modified.files.time
  type: Date
  description: "File creating time."
- contextPath: ANYRUN.SandboxAnalysis.modified.files.info.mime
  description: "File MIME type."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.modified.files.info.file
  description: "File content."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.modified.files.permanentUrl
  description: "File url."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.modified.files.hashes.ssdeep
  description: "File SSDeep."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.modified.files.hashes.sha256
  description: "File sha256 hash."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.modified.files.hashes.sha1
  description: "File sha1 hash."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.modified.files.hashes.md5
  description: "File md5 hash."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.modified.files.threatLevel
  description: "File threat level."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.modified.files.type
  description: "File type."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.network.threats
  type: Unknown
  description: "Analysis network threats."
- contextPath: ANYRUN.SandboxAnalysis.network.connections.reputation
  description: "Network connection reputation."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.network.connections.tlsFingerprint.ja3SFullstring
  description: "Network connection ja3S."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.network.connections.tlsFingerprint.ja3S
  description: "Network connection ja3S."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.network.connections.tlsFingerprint.ja3Fullstring
  description: "Network connection ja3F."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.network.connections.tlsFingerprint.ja3
  description: "Network connection ja3F."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.network.connections.time
  type: Date
  description: "Network connection time."
- contextPath: ANYRUN.SandboxAnalysis.network.connections.asn
  description: "Network connection ASN."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.network.connections.country
  description: "Network connection country."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.network.connections.protocol
  description: "Network connection protocol."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.network.connections.port
  description: "Network connection port."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.network.connections.ip
  description: "Network connection ip."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.network.connections.process
  description: "Network connection processes."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.network.connections.tlsFingerprint.jarm
  description: "Network connection jarm."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.network.httpRequests.country
  description: "HTTP Request country."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.network.httpRequests.reputation
  description: "HTTP Request reputation."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.network.httpRequests.process
  description: "HTTP Request related process."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.network.httpRequests.httpCode
  description: "HTTP Request status code."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.network.httpRequests.status
  description: "HTTP Request status."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.network.httpRequests.user-agent
  description: "HTTP Request User-Agent header value."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.network.httpRequests.proxyDetected
  description: "HTTP Request is proxy detected."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.network.httpRequests.port
  description: "HTTP Request port."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.network.httpRequests.ip
  description: "HTTP Request ip."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.network.httpRequests.url
  description: "HTTP Request url."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.network.httpRequests.host
  description: "HTTP Request host."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.network.httpRequests.method
  description: "HTTP Request method."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.network.httpRequests.time
  type: Date
  description: "HTTP Request time estimate."
- contextPath: ANYRUN.SandboxAnalysis.network.dnsRequests.reputationNumber
  description: "DNS Request reputation number."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.network.dnsRequests.reputation
  description: "DNS Request reputation."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.network.dnsRequests.ips
  description: "DNS Request IPs."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.network.dnsRequests.domain
  description: "DNS Request domain."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.network.dnsRequests.time
  type: Date
  description: "DNS Request time estimate."
- contextPath: ANYRUN.SandboxAnalysis.malconf
  type: Unknown
  description: "Analysis malconf."
- contextPath: ANYRUN.SandboxAnalysis.processes.synchronization
  type: Unknown
  description: "Analysis processes synchronization."
- contextPath: ANYRUN.SandboxAnalysis.processes.modules
  type: Unknown
  description: "Analysis processes modules."
- contextPath: ANYRUN.SandboxAnalysis.processes.hasMalwareConfig
  description: "Process has malware config."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.processes.parentUUID
  description: "Process parent UUID."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.processes.status
  description: "Process status."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.processes.scores.specs.malwareConfig
  description: "Process malware config."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.processes.scores.specs.privEscalation
  description: "Process priv escalation."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.processes.scores.specs.stealing
  description: "Process stealing."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.processes.scores.specs.networkLoader
  description: "Process network loader."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.processes.scores.specs.network
  description: "Process network."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.processes.scores.specs.lowAccess
  description: "Process low access."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.processes.scores.specs.knownThreat
  description: "Process known threat."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.processes.scores.specs.injects
  description: "Process inject."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.processes.scores.specs.exploitable
  description: "Process exploitable."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.processes.scores.specs.executableDropped
  description: "Process executable dropped."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.processes.scores.specs.debugOutput
  description: "Process debug output."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.processes.scores.specs.crashedApps
  description: "Process crashed apps."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.processes.scores.specs.autoStart
  description: "Process auto start."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.processes.scores.loadsSusp
  description: "Process loads susp."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.processes.scores.injected
  description: "Process injected."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.processes.scores.dropped
  description: "Process dropped."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.processes.scores.verdict.threatLevelText
  description: "Process threat level text."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.processes.scores.verdict.threatLevel
  description: "Process threat level."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.processes.scores.verdict.score
  description: "Process score."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.processes.context.userName
  description: "Process context username."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.processes.context.integrityLevel
  description: "Process context integrity level."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.processes.context.rebootNumber
  description: "Process context reboot number."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.processes.versionInfo.version
  description: "Process version."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.processes.versionInfo.description
  description: "Process description."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.processes.versionInfo.company
  description: "Process company."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.processes.mainProcess
  description: "Process main process."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.processes.fileType
  description: "Process file type."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.processes.fileName
  description: "Process filename."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.processes.commandLine
  description: "Process cmd."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.processes.image
  description: "Process image."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.processes.uuid
  description: "Process uuid."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.processes.ppid
  description: "Process PPID."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.processes.important
  description: "Process important."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.processes.pid
  description: "Process PID."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.processes.exitCode
  description: "Process exit code."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.processes.times.terminate
  type: Date
  description: "Process time terminate."
- contextPath: ANYRUN.SandboxAnalysis.processes.times.start
  type: Date
  description: "Process time start."
- contextPath: ANYRUN.SandboxAnalysis.processes.resolvedCOM.title
  description: "Process resolved COM title."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.processes.synchronization.operation
  description: "Process sync operation."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.processes.synchronization.type
  description: "Process sync type."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.processes.synchronization.name
  description: "Process sync name."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.processes.synchronization.time
  type: Date
  description: "Process sync time."
- contextPath: ANYRUN.SandboxAnalysis.processes.modules.image
  description: "Process module image."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.processes.modules.time
  type: Date
  description: "Process module time."
- contextPath: ANYRUN.SandboxAnalysis.processes.scores.monitoringReason
  description: "Process monitoring reason."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.processes.times.monitoringSince
  type: Date
  description: "Process monitoring since."
- contextPath: ANYRUN.SandboxAnalysis.counters.synchronization.type.event
  description: "Process sync event."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.counters.synchronization.type.mutex
  description: "Process sync mutex."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.counters.synchronization.operation.create
  description: "Process sync operation create."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.counters.synchronization.operation.open
  description: "Process sync operation open."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.counters.synchronization.total
  description: "Process sync total."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.counters.registry.delete
  description: "Registry delete."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.counters.registry.write
  description: "Registry write."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.counters.registry.read
  description: "Registry reed."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.counters.registry.total
  description: "Registry total."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.counters.files.malicious
  description: "File malicious count."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.counters.files.suspicious
  description: "File suspicious count."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.counters.files.text
  description: "File text."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.counters.files.unknown
  description: "File unknown count."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.counters.network.threats
  description: "Network threats count."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.counters.network.dns
  description: "Network dns count."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.counters.network.connections
  description: "Network connections count."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.counters.network.http
  description: "Network networks count."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.counters.processes.malicious
  description: "Malicious processes count."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.counters.processes.suspicious
  description: "Suspicious processes count."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.counters.processes.monitored
  description: "Monitored processes count."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.counters.processes.total
  description: "Total processes count."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.environments.hotfixes.title
  description: "Environment hotfixes title."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.environments.software.version
  description: "Environment software version."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.environments.software.title
  description: "Environment software title."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.environments.internetExplorer.kbnum
  description: "Environment Internet Explorer KBNUM."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.environments.internetExplorer.version
  description: "Environment Internet Explorer version."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.environments.os.bitness
  description: "Environment OS version."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.environments.os.softSet
  description: "Environment OS software set."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.environments.os.servicePack
  description: "Environment OS service pack."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.environments.os.major
  description: "Environment OS major version."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.environments.os.productType
  description: "Environment OS product type."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.environments.os.variant
  description: "Environment OS variant."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.environments.os.product
  description: "Environment OS product."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.environments.os.build
  description: "Environment OS build."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.environments.os.title
  description: "Environment OS title."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.analysis.content.dumps
  type: Unknown
  description: "Content dumps."
- contextPath: ANYRUN.SandboxAnalysis.analysis.content.screenshots.thumbnailUrl
  description: "Screenshots thumbnail url."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.analysis.content.screenshots.permanentUrl
  description: "Screenshots permanent url."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.analysis.content.screenshots.time
  description: "Screenshots time."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.analysis.content.screenshots.uuid
  description: "Screenshots uuid."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.analysis.content.sslkeys.present
  description: "SSL keys present."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.analysis.content.pcap.permanentUrl
  description: "Pcap dump permanent url."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.analysis.content.pcap.present
  description: "Pcap present."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.analysis.content.video.permanentUrl
  description: "Video permanent url."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.analysis.content.video.present
  description: "Video present."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.analysis.content.mainObject.hashes.ssdeep
  description: "Main object ssdeep."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.analysis.content.mainObject.hashes.sha256
  description: "Main object sha256."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.analysis.content.mainObject.hashes.sha1
  description: "Main object sha1."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.analysis.content.mainObject.hashes.md5
  description: "Main object md5."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.analysis.content.mainObject.url
  description: "Main object url."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.analysis.content.mainObject.type
  description: "Main object type."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.knownThreat
  description: "Specs known threat."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.malwareConfig
  description: "Specs malware Config."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.notStarted
  description: "Specs not started."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.privEscalation
  description: "Specs priv escalation."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.torUsed
  description: "Specs TOR used."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.suspStruct
  description: "Specs susp structure."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.stealing
  description: "Specs stealing."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.staticDetections
  description: "Specs static detections."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.spam
  description: "Specs spam."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.serviceLauncher
  description: "Specs service launcher."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.rebooted
  description: "Specs rebooted."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.networkThreats
  description: "Specs network threats."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.networkLoader
  description: "Specs network loader."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.multiprocessing
  description: "Specs multiprocessing."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.memOverrun
  description: "Specs memory overrun."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.lowAccess
  description: "Specs low access."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.exploitable
  description: "Specs exploitable."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.executableDropped
  description: "Specs executable dropped."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.debugOutput
  description: "Specs debug output."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.crashedTask
  description: "Specs crashed task."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.crashedApps
  description: "Specs crashed apps."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.cpuOverrun
  description: "Specs CPU overrun."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.autoStart
  description: "Specs suto start."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.injects
  description: "Specs injects."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.analysis.scores.verdict.threatLevelText
  description: "Verdict threat level text."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.analysis.scores.verdict.threatLevel
  description: "Verdict threat level."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.analysis.scores.verdict.score
  description: "Verdict score."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.analysis.options.automatization.uac
  description: "Options automatization UAC."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.analysis.options.privateSample
  description: "Options private sample."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.analysis.options.privacy
  description: "Options privacy."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.analysis.options.network
  description: "Options network."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.analysis.options.hideSource
  description: "Options hide source."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.analysis.options.video
  description: "Options video."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.analysis.options.presentation
  description: "Options presentation."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.analysis.options.tor.used
  description: "Options tor used."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.analysis.options.mitm
  description: "Options MITM proxy."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.analysis.options.heavyEvasion
  description: "Options kernel heavy evasion."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.analysis.options.fakeNet
  description: "Options fake network."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.analysis.options.additionalTime
  description: "Options additions time."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.analysis.options.timeout
  description: "Options timeout."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.analysis.tags
  type: Unknown
  description: "Analysis tags."
- contextPath: ANYRUN.SandboxAnalysis.analysis.stopExecText
  type: Date
  description: "Analysis stopExecText."
- contextPath: ANYRUN.SandboxAnalysis.analysis.stopExec
  type: Date
  description: "Analysis creation stopExec."
- contextPath: ANYRUN.SandboxAnalysis.analysis.creationText
  type: Date
  description: "Analysis creation creation text."
- contextPath: ANYRUN.SandboxAnalysis.analysis.creation
  type: Date
  description: "Analysis creation date."
- contextPath: ANYRUN.SandboxAnalysis.analysis.duration
  description: "Analysis duration."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.analysis.sandbox.plan.name
  description: "Analysis sandbox user plan name."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.analysis.sandbox.name
  description: "Analysis sandbox name."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.analysis.reports.graph
  description: "Analysis reports graph."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.analysis.reports.STIX
  description: "Analysis STIX report url."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.analysis.reports.HTML
  description: "Analysis HTML report url."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.analysis.reports.MISP
  description: "Analysis MISP report url."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.analysis.reports.IOC
  description: "Analysis IOC report url."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.analysis.permanentUrl
  description: "Analysis permanent url."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.analysis.uuid
  description: "Analysis uuid."
  type: String
- contextPath: ANYRUN.SandboxAnalysis.status
  description: "Analysis status."
  type: String
- contextPath: ANYRUN.SandboxAnalysisReportVerdict
  description: "The analysis verdict."
  type: String
- contextPath: ANYRUN_DetonateFileAndroid.TaskID
  description: 'Task UUID.'
  type: String
- contextPath: ANYRUN_DetonateFileLinux.TaskID
  description: 'Task UUID.'
  type: String
- contextPath: ANYRUN_DetonateFileWindows.TaskID
  description: 'Task UUID.'
  type: String
fromversion: 5.0.0
tests:
- Detonate File - No Files test
- Detonate File - Generic Test
contentitemexportablefields:
  contentitemfields: {}