Detonate File - ThreatGrid v2

Detonate one or more files using the ThreatGrid integration. This playbook returns relevant reports to the War Room and file reputations to the context data. The detonation supports the following file types - EXE, DLL, JAR, JS, PDF, DOC, DOCX, RTF, XLS, PPT, PPTX, XML, ZIP, VBN, SEP, XZ, GZ, BZ2, TAR, MHTML, SWF, LNK, URL, MSI, JTD, JTT, JTDC, JTTC, HWP, HWT, HWPX, BAT, HTA, PS1, VBS, WSF, JSE, VBE, CHM

Cisco Secure Malware Analytics · 8 tasks · 3 inputs · 3 outputs

Details

IDDetonate File - ThreatGrid v2
From Version5.0.0
Tasks8

README

Detonate one or more files using the ThreatGrid integration. This playbook returns relevant reports to the War Room and file reputations to the context data. The detonation supports the following file types - EXE, DLL, JAR, JS, PDF, DOC, DOCX, RTF, XLS, PPT, PPTX, XML, ZIP, VBN, SEP, XZ, GZ, BZ2, TAR, MHTML, SWF, LNK, URL, MSI, JTD, JTT, JTDC, JTTC, HWP, HWT, HWPX, BAT, HTA, PS1, VBS, WSF, JSE, VBE, CHM

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

  • ThreatGridv2

Scripts

  • Set

Commands

  • threat-grid-sample-upload

Playbook Inputs

Name Description Default Value Required
File File object of the file to detonate. File Required

Playbook Outputs

Path Description Type
File.Type File type e.g. “PE” string
File.Size File Size number
File.Extension File Extension string

Playbook Image

Detonate File - ThreatGrid

Inputs

  • File — File object of the file to detonate.
  • timeout — Indicates the time in seconds until the polling sequence times out. Default is 60.
  • interval — Indicates the time in seconds to wait between command execution when 'polling' argument is true. Minimum value is 10 seconds. Default is 10.

Outputs

  • File.Type — File type e.g. "PE"
  • File.Size — File Size
  • File.Extension — File Extension

Commands used

threat-grid-sample-upload

Flowchart

yes yes yes yes Start Start Is ThreatGrid enabled? Is ThreatGrid enabled? Is there a file to detonate? Is there a file to detonate? Done Done Is the file type supported? Is the file type supported? ThreatGrid Upload File - threat-grid-sample-upload ThreatGrid Upload File threat-grid-sample-upload Set file to context - Set Set file to context Set Is the file size bigger than 0? Is the file size bigger t...

Source

playbook-Detonate_File_-_ThreatGrid_v2.yml
Download History Raw 
id: Detonate File - ThreatGrid v2
version: -1
name: Detonate File - ThreatGrid v2
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: f850e557-f46a-44e6-87f6-e63960e54b3c
    type: start
    task:
      id: f850e557-f46a-44e6-87f6-e63960e54b3c
      description: start
      version: -1
      name: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 1ce459a4-b6cb-4ce1-8189-8011ab82305b
    type: condition
    task:
      id: 1ce459a4-b6cb-4ce1-8189-8011ab82305b
      description: condition
      version: -1
      name: Is ThreatGrid enabled?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "2"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: containsString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: ThreatGridv2
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 60aa8fdc-d576-4409-8df6-27876aa6a064
    type: condition
    task:
      id: 60aa8fdc-d576-4409-8df6-27876aa6a064
      description: condition
      version: -1
      name: Is there a file to detonate?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "7"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: inputs.File
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: ce5638fa-87ef-4436-8286-910e797bce62
    type: title
    task:
      id: ce5638fa-87ef-4436-8286-910e797bce62
      description: title
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1245
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: 0f9a53c1-0acf-4957-8722-d43505a392ec
    type: condition
    task:
      id: 0f9a53c1-0acf-4957-8722-d43505a392ec
      version: -1
      name: Is the file type supported?
      description: Check whether the values provided in arguments are equal. If either of the arguments are missing, no is returned.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "8"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: match
          left:
            value:
              simple: File.Type
            iscontext: true
          right:
            value:
              simple: .*(?:EXE|DLL|JAR|JS|PDF|DOC|DOCX|RTF|XLS|PPT|PPTX|XML|ZIP|VBN|SEP|XZ|GZ|BZ2|TAR|MHTML|SWF|LNK|URL|MSI|JTD|JTT|JTDC|JTTC|HWP|HWT|HWPX|BAT|HTA|PS1|VBS|WSF|JSE|VBE|CHM)\b
          ignorecase: true
        - operator: match
          left:
            value:
              simple: File.Extension
            iscontext: true
          right:
            value:
              simple: .*(?:EXE|DLL|JAR|JS|PDF|DOC|DOCX|RTF|XLS|PPT|PPTX|XML|ZIP|VBN|SEP|XZ|GZ|BZ2|TAR|MHTML|SWF|LNK|URL|MSI|JTD|JTT|JTDC|JTTC|HWP|HWT|HWPX|BAT|HTA|PS1|VBS|WSF|JSE|VBE|CHM)\b
          ignorecase: true
        - operator: match
          left:
            value:
              simple: File.Info
            iscontext: true
          right:
            value:
              simple: .*(?:EXE|DLL|JAR|JS|PDF|DOC|DOCX|RTF|XLS|PPT|PPTX|XML|ZIP|VBN|SEP|XZ|GZ|BZ2|TAR|MHTML|SWF|LNK|URL|MSI|JTD|JTT|JTDC|JTTC|HWP|HWT|HWPX|BAT|HTA|PS1|VBS|WSF|JSE|VBE|CHM)\b
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 275,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: e4859d43-1c66-4c82-8b80-928a72c6e94f
    type: regular
    task:
      id: e4859d43-1c66-4c82-8b80-928a72c6e94f
      version: -1
      name: ThreatGrid Upload File
      description: Submits a sample to threat grid for analysis. URL or file, not both.
      script: '|||threat-grid-sample-upload'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      file_id:
        simple: ${File.EntryID}
      interval_in_seconds:
        simple: ${inputs.interval}
      timeout_in_seconds:
        simple: ${inputs.timeout}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 275,
          "y": 1070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: e47c11b0-6f32-4b8c-85a6-ae5612f34b82
    type: regular
    task:
      id: e47c11b0-6f32-4b8c-85a6-ae5612f34b82
      version: -1
      name: Set file to context
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      key:
        simple: File
      value:
        simple: ${inputs.File}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 275,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: 23811c43-493a-4db8-8450-5a100168958e
    type: condition
    task:
      id: 23811c43-493a-4db8-8450-5a100168958e
      description: Check if the file size bigger than 0
      version: -1
      name: Is the file size bigger than 0?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "6"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: greaterThan
          left:
            value:
              simple: File.Size
            iscontext: true
          right:
            value:
              simple: "0"
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 387.5,
          "y": 895
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1260,
        "width": 717.5,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: File
  value:
    complex:
      root: File
  required: false
  description: File object of the file to detonate.
  playbookInputQuery: null
- key: timeout
  value:
    simple: "60"
  required: false
  description: Indicates the time in seconds until the polling sequence times out.
    Default is 60.
  playbookInputQuery: null
- key: interval
  value:
    simple: "10"
  required: false
  description: Indicates the time in seconds to wait between command execution when
    'polling' argument is true. Minimum value is 10 seconds. Default is 10.
  playbookInputQuery: null
outputs:
- contextPath: File.Type
  description: File type e.g. "PE"
  type: string
- contextPath: File.Size
  description: File Size
  type: number
- contextPath: File.Extension
  description: File Extension
  type: string
quiet: true
fromversion: 5.0.0
description: Detonate one or more files using the ThreatGrid integration. This playbook returns relevant reports to the War Room and file reputations to the context data. The detonation supports the following file types - EXE, DLL, JAR, JS, PDF, DOC, DOCX, RTF, XLS, PPT, PPTX, XML, ZIP, VBN, SEP, XZ, GZ, BZ2, TAR, MHTML, SWF, LNK, URL, MSI, JTD, JTT, JTDC, JTTC, HWP, HWT, HWPX, BAT, HTA, PS1, VBS, WSF, JSE, VBE, CHM
tests:
- Detonate File - Generic Test
contentitemexportablefields:
  contentitemfields:
    propagationLabels:
    - all