Detonate File - Group-IB TDS Polygon

id: Detonate File - Group-IB TDS Polygon
version: -1
contentitemexportablefields:
  contentitemfields: {}
name: Detonate File - Group-IB TDS Polygon
description: 'Detonate file using Group-IB THF Polygon integration. This playbook returns relevant reports to the War Room and file reputations to the context data. The detonation supports the following file types: 7z, ace, ar, arj, bat, bz2, cab, chm, cmd, com, cpgz, cpl, csv, dat, doc, docm, docx, dot, dotm, dotx, eml, exe, gz, gzip, hta, htm, html, iqy, iso, jar, js, jse, lnk, lz, lzma, lzo,  lzh, mcl, mht, msg, msi, msp, odp, ods, odt, ots, ott, pdf, pif, potm, potx, pps, ppsm, ppsx, ppt, pptm, pptx, ps1, pub, py, pyc, r*, rar, reg, rtf, scr, settingcontent-ms, stc, svg, sxc, sxw, tar, taz,  .tb2, .tbz, .tbz2, tgz, tlz, txz, tzo, txt, url, uue, vbe, vbs, wsf, xar, xls, xlsb, xlsm, xlsx, xml, xz, z*, zip.'
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 9501b3b5-5523-40bd-8af6-ae6a9d6ac607
    type: start
    task:
      id: 9501b3b5-5523-40bd-8af6-ae6a9d6ac607
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "18"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 560,
          "y": 20
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: fc02e787-ad1e-4381-8e8a-96bd716a9255
    type: regular
    task:
      id: fc02e787-ad1e-4381-8e8a-96bd716a9255
      version: -1
      name: polygon-upload-file
      description: Upload file for analysis
      script: Group-IB TDS Polygon|||polygon-upload-file
      type: regular
      iscommand: true
      brand: Group-IB TDS Polygon
    nexttasks:
      '#none#':
      - "11"
    scriptarguments:
      file_id:
        complex:
          root: File
          filters:
          - - operator: match
              left:
                value:
                  simple: File.Type
                iscontext: true
              right:
                value:
                  simple: .*(?:7Z|ACE|AR|BAT|ARJ|BAT|BZ2|CAB|CHM|CMD|COM|CPGZ|CPL|CSV|DAT|DOC|DOCM|DOCX|DOCT|DOTM|DOTX|EML|EXE|GZ|GZIP|HTA|THM|HTML|IQY|ISO|JAR|JS|JS|JSE|LNK|LZ|LZMA|IZO|IZH|MCL|MHTMSG|MSI|MSP|ODP|ODS|ODT|OTS|OTT|PDF|PIF|POTM|POTX|PPS|PPT|PPTM|PPTX|PS1|PUB|PY|PYC|RAR|REG|RTF|SCR|SETTINGSCONTENT-MS|STC|SVG|SXC|SXW|TAR|TAZ|TB2|TBZ|TBZ2|TGZ|TLZ|TXZ|TZO|TXT|URL|UUE|VBE|VBS|WSF|XAR|XLS|XLSB|XLSM|XLSX|XML|XZ|ZIP)\b
              ignorecase: true
            - operator: match
              left:
                value:
                  simple: File.Extension
                iscontext: true
              right:
                value:
                  simple: .*(?:7Z|ACE|AR|BAT|ARJ|BAT|BZ2|CAB|CHM|CMD|COM|CPGZ|CPL|CSV|DAT|DOC|DOCM|DOCX|DOCT|DOTM|DOTX|EML|EXE|GZ|GZIP|HTA|THM|HTML|IQY|ISO|JAR|JS|JS|JSE|LNK|LZ|LZMA|IZO|IZH|MCL|MHTMSG|MSI|MSP|ODP|ODS|ODT|OTS|OTT|PDF|PIF|POTM|POTX|PPS|PPT|PPTM|PPTX|PS1|PUB|PY|PYC|RAR|REG|RTF|SCR|SETTINGSCONTENT-MS|STC|SVG|SXC|SXW|TAR|TAZ|TB2|TBZ|TBZ2|TGZ|TLZ|TXZ|TZO|TXT|URL|UUE|VBE|VBS|WSF|XAR|XLS|XLSB|XLSM|XLSX|XML|XZ|ZIP)\b
              ignorecase: true
          - - operator: in
              left:
                value:
                  simple: File.EntryID
                iscontext: true
              right:
                value:
                  simple: inputs.file_id
                iscontext: true
          accessor: EntryID
          transformers:
          - operator: uniq
      language:
        simple: en
      password:
        complex:
          root: inputs.Password
          transformers:
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1030,
          "y": 510
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: 3515a2f8-6b03-4061-8125-756cc50294fd
    type: title
    task:
      id: 3515a2f8-6b03-4061-8125-756cc50294fd
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 560,
          "y": 1730
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: 70256af8-c846-4973-86a8-9c3361ee58b3
    type: playbook
    task:
      id: 70256af8-c846-4973-86a8-9c3361ee58b3
      version: -1
      name: GenericPolling
      description: |-
        Use this playbook as a sub-playbook to block execution of the master playbook until a remote action is complete.
        This playbook implements polling by continuously running the command in Step \#2 until the operation completes.
        The remote action should have the following structure:

        1. Initiate the operation.
        2. Poll to check if the operation completed.
        3. (optional) Get the results of the operation.
      playbookName: GenericPolling
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "14"
    scriptarguments:
      Ids:
        complex:
          root: Polygon
          accessor: Analysis.ID
          transformers:
          - operator: LastArrayElement
      Interval:
        simple: ${inputs.Interval}
      PollingCommandArgName:
        simple: tds_analysis_id
      PollingCommandName:
        simple: polygon-analysis-info
      Timeout:
        simple: ${inputs.Timeout}
      dt:
        simple: Polygon.Analysis(val.Status !== 'Finished').ID
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 1030,
          "y": 690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: d2123158-1ae0-4f5e-87fd-ed63ac94647f
    type: regular
    task:
      id: d2123158-1ae0-4f5e-87fd-ed63ac94647f
      version: -1
      name: polygon-export-report
      description: Export an archive with THF Polygon report to War Room
      script: Group-IB TDS Polygon|||polygon-export-report
      type: regular
      iscommand: true
      brand: Group-IB TDS Polygon
    nexttasks:
      '#none#':
      - "19"
    scriptarguments:
      tds_analysis_id:
        complex:
          root: Polygon
          accessor: Analysis.ID
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1030,
          "y": 1040
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: 4a79b7e8-4212-4b47-8078-bfb2dde6e1b4
    type: regular
    task:
      id: 4a79b7e8-4212-4b47-8078-bfb2dde6e1b4
      version: -1
      name: polygon-analysis-info
      description: Get THF Polygon analysis information
      script: Group-IB TDS Polygon|||polygon-analysis-info
      type: regular
      iscommand: true
      brand: Group-IB TDS Polygon
    nexttasks:
      '#none#':
      - "12"
    scriptarguments:
      tds_analysis_id:
        complex:
          root: Polygon
          accessor: Analysis.ID
          transformers:
          - operator: LastArrayElement
      tds_file_id:
        complex:
          root: Polygon
          accessor: Analysis.ID
          transformers:
          - operator: LastArrayElement
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1030,
          "y": 860
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "16":
    id: "16"
    taskid: 7d9a2924-35c5-4686-8ecb-7de719029f3f
    type: regular
    task:
      id: 7d9a2924-35c5-4686-8ecb-7de719029f3f
      version: -1
      name: polygon-export-pcap
      description: Network activity dump export
      script: Group-IB TDS Polygon|||polygon-export-pcap
      type: regular
      iscommand: true
      brand: Group-IB TDS Polygon
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      tds_analysis_id:
        complex:
          root: Polygon
          accessor: Analysis.ID
          transformers:
          - operator: LastArrayElement
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1040,
          "y": 1550
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "17":
    id: "17"
    taskid: 93f7ba3c-51fa-46f0-8b14-fc6609f50f2f
    type: regular
    task:
      id: 93f7ba3c-51fa-46f0-8b14-fc6609f50f2f
      version: -1
      name: polygon-export-video
      description: Screen activity video export
      script: Group-IB TDS Polygon|||polygon-export-video
      type: regular
      iscommand: true
      brand: Group-IB TDS Polygon
    nexttasks:
      '#none#':
      - "16"
    scriptarguments:
      tds_analysis_id:
        complex:
          root: Polygon
          accessor: Analysis.ID
          transformers:
          - operator: LastArrayElement
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1040,
          "y": 1395
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "18":
    id: "18"
    taskid: 6bf891c0-3f7e-4265-8eb9-17931764bff6
    type: condition
    task:
      id: 6bf891c0-3f7e-4265-8eb9-17931764bff6
      version: -1
      name: Is THF Polygon integration enabled?
      description: Check if a given value exists in the context. Will return 'no' for empty arrays. To be used mostly with DQ and selectors.
      scriptName: Exists
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "4"
      "yes":
      - "21"
    scriptarguments:
      value:
        complex:
          root: modules
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: modules.brand
                iscontext: true
              right:
                value:
                  simple: Group-IB TDS Polygon
          - - operator: isEqualString
              left:
                value:
                  simple: modules.state
                iscontext: true
              right:
                value:
                  simple: active
          accessor: brand
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 560,
          "y": 150
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "19":
    id: "19"
    taskid: e4ad7e47-59bc-45b2-8408-0d9da0ab7da2
    type: condition
    task:
      id: e4ad7e47-59bc-45b2-8408-0d9da0ab7da2
      version: -1
      name: Is file malicious?
      description: Check if a given value is true. Will return 'no' otherwise
      scriptName: IsTrue
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "4"
      "yes":
      - "17"
    scriptarguments:
      value:
        complex:
          root: Polygon
          accessor: Analysis.Result
          transformers:
          - operator: LastArrayElement
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1030,
          "y": 1220
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "21":
    id: "21"
    taskid: 1ce58e07-640e-41d0-8e8d-713959491e1c
    type: condition
    task:
      id: 1ce58e07-640e-41d0-8e8d-713959491e1c
      version: -1
      name: Is the file type supported?
      type: condition
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      '#default#':
      - "4"
      "yes":
      - "1"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: match
          left:
            value:
              complex:
                root: File
                accessor: Type
            iscontext: true
          right:
            value:
              simple: .*(?:7Z|ACE|AR|BAT|ARJ|BAT|BZ2|CAB|CHM|CMD|COM|CPGZ|CPL|CSV|DAT|DOC|DOCM|DOCX|DOCT|DOTM|DOTX|EML|EXE|GZ|GZIP|HTA|THM|HTML|IQY|ISO|JAR|JS|JS|JSE|LNK|LZ|LZMA|IZO|IZH|MCL|MHTMSG|MSI|MSP|ODP|ODS|ODT|OTS|OTT|PDF|PIF|POTM|POTX|PPS|PPT|PPTM|PPTX|PS1|PUB|PY|PYC|RAR|REG|RTF|SCR|SETTINGSCONTENT-MS|STC|SVG|SXC|SXW|TAR|TAZ|TB2|TBZ|TBZ2|TGZ|TLZ|TXZ|TZO|TXT|URL|UUE|VBE|VBS|WSF|XAR|XLS|XLSB|XLSM|XLSX|XML|XZ|ZIP)\b
          ignorecase: true
        - operator: match
          left:
            value:
              complex:
                root: File
                accessor: Extension
            iscontext: true
          right:
            value:
              simple: .*(?:7Z|ACE|AR|BAT|ARJ|BAT|BZ2|CAB|CHM|CMD|COM|CPGZ|CPL|CSV|DAT|DOC|DOCM|DOCX|DOCT|DOTM|DOTX|EML|EXE|GZ|GZIP|HTA|THM|HTML|IQY|ISO|JAR|JS|JS|JSE|LNK|LZ|LZMA|IZO|IZH|MCL|MHTMSG|MSI|MSP|ODP|ODS|ODT|OTS|OTT|PDF|PIF|POTM|POTX|PPS|PPT|PPTM|PPTX|PS1|PUB|PY|PYC|RAR|REG|RTF|SCR|SETTINGSCONTENT-MS|STC|SVG|SXC|SXW|TAR|TAZ|TB2|TBZ|TBZ2|TGZ|TLZ|TXZ|TZO|TXT|URL|UUE|VBE|VBS|WSF|XAR|XLS|XLSB|XLSM|XLSX|XML|XZ|ZIP)\b
          ignorecase: true
      - - operator: in
          left:
            value:
              complex:
                root: File
                accessor: EntryID
            iscontext: true
          right:
            value:
              simple: inputs.file_id
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 820,
          "y": 330
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1775,
        "width": 860,
        "x": 560,
        "y": 20
      }
    }
  }
inputs:
- key: file_id
  value:
    complex:
      root: File
      accessor: EntryID
  required: false
  description: The File EntryID which will be detonated.
  playbookInputQuery:
- key: Interval
  value:
    simple: "1"
  required: true
  description: Report requests frequency (minutes)
  playbookInputQuery:
- key: Timeout
  value:
    simple: "60"
  required: true
  description: Report waiting timeout (minutes)
  playbookInputQuery:
- key: Password
  value: {}
  required: false
  description: Password for the uploaded file.
  playbookInputQuery:
outputs:
- contextPath: File.Name
  description: The full file name (including file extension).
  type: string
- contextPath: File.MD5
  description: The MD5 hash of the file.
  type: string
- contextPath: File.SHA1
  description: The SHA1 hash of the file.
  type: string
- contextPath: File.SHA256
  description: The SHA256 hash of the file.
  type: string
- contextPath: File.Type
  description: File type.
  type: string
- contextPath: File.Malicious.Vendor
  description: The vendor that reported the file as malicious.
  type: string
- contextPath: File.Malicious.Description
  description: A description explaining why the file was determined to be malicious.
  type: string
- contextPath: DBotScore.Indicator
  description: The indicator that was tested.
  type: string
- contextPath: DBotScore.Type
  description: The indicator type.
  type: string
- contextPath: DBotScore.Vendor
  description: The vendor used to calculate the score.
  type: string
- contextPath: DBotScore.Score
  description: The actual score.
  type: number
- contextPath: IP.Address
  description: IP address.
  type: string
- contextPath: Domain.Name
  description: The domain name.
  type: string
- contextPath: Domain.DNS
  description: A list of IP objects resolved by DNS.
  type: string
- contextPath: URL.Data
  description: The URL.
  type: string
- contextPath: RegistryKey.Path
  description: The path to the registry key.
  type: string
- contextPath: RegistryKey.Value
  description: The value at the given RegistryKey.
  type: string
- contextPath: Process.Name
  description: Process name.
  type: string
- contextPath: Process.PID
  description: Process PID.
  type: number
- contextPath: Process.CommandLine
  description: Process command line.
  type: string
- contextPath: Process.Path
  description: Process path.
  type: string
- contextPath: Process.StartTime
  description: Process start time.
  type: date
- contextPath: Process.EndTime
  description: Process end time.
  type: date
- contextPath: Polygon.Analysis.ID
  description: Analysis ID in THF.
  type: number
- contextPath: Polygon.Analysis.Name
  description: File name.
  type: string
- contextPath: Polygon.Analysis.Size
  description: File size.
  type: number
- contextPath: Polygon.Analysis.Started
  description: Analysis start timestamp.
  type: date
- contextPath: Polygon.Analysis.Analyzed
  description: Analysis finish timestamp.
  type: date
- contextPath: Polygon.Analysis.MD5
  description: Analyzed file MD5 hash.
  type: string
- contextPath: Polygon.Analysis.SHA1
  description: Analyzed file SHA1 hash.
  type: string
- contextPath: Polygon.Analysis.SHA256
  description: Analyzed file SHA256.
  type: string
- contextPath: Polygon.Analysis.Result
  description: Analysis verdict.
  type: string
- contextPath: Polygon.Analysis.Status
  description: The analysis status.
  type: string
- contextPath: Polygon.Analysis.Verdict
  description: Analysis verdict.
  type: boolean
- contextPath: Polygon.Analysis.Probability
  description: Verdict probability.
  type: string
- contextPath: Polygon.Analysis.Families
  description: Malware families.
  type: string
- contextPath: Polygon.Analysis.Score
  description: Polygon score.
  type: number
- contextPath: Polygon.Analysis.Internet-connection
  description: Internet availability.
  type: string
- contextPath: Polygon.Analysis.Type
  description: File type.
  type: string
- contextPath: Polygon.Analysis.DumpExists
  description: Network activity dump exists.
  type: boolean
- contextPath: Polygon.Analysis.File
  description: The information about files in analysis.
  type: unknown
- contextPath: Polygon.Analysis.URL
  description: The information about URL indicators.
- contextPath: Polygon.Analysis.IP
  description: The information about IP indicators.
- contextPath: Polygon.Analysis.Domain
  description: The information about domain indicators.
- contextPath: Polygon.Analysis.RegistryKey
  description: The information about registry keys which were modified during the analysis.
- contextPath: Polygon.Analysis.Process
  description: The information about processes started during the analysis.
fromversion: 5.0.0
tests:
- No tests