Detonate File - ThreatStream

Detonate one or more files using the Anomali ThreatStream v2 integration. This playbook returns relevant reports to the War Room, and file reputations to the context data.

Anomali ThreatStream · 9 tasks · 7 inputs · 14 outputs

Details

ID	`Detonate File - ThreatStream`
From Version	5.0.0
Tasks	9

README

Detonates one or more files using the Anomali ThreatStream v2 integration. This playbook returns relevant reports to the War Room, and file reputations to the context data.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

GenericPolling

Integrations

This playbook does not use any integrations.

Scripts

Commands

threatstream-submit-to-sandbox
threatstream-analysis-report

Playbook Inputs

Name	Description	Default Value	Source	Required
File	The file object of the file to detonate.	None	File	Optional
VM	The VM to use (string).	-	-	Optional
SubmissionClassification	The classification of the sandbox submission.	-	-	Optional
PremiumSandbox	Specifies if the premium sandbox should be used for detonation.	-	-	Optional
Tags	A CSV list of tags applied to this sample.	-	-	Optional
Interval	The polling frequency. How often the polling command should run (in minutes).	-	-	Optional
Timeout	The amount of time to wait before a timeout occurs (in minutes).	-	-	Optional

Playbook Outputs

Path	Description	Type
File.Malicious	The malicious file’s description.	unknown
File.Malicious.Vendor	The vendor that made the decision that the file is malicious.	string
File.Type	The file type. For example, “PE”.	string
File.Size	The file size.	number
File.MD5	The MD5 hash of the file.	string
File.Name	The file name.	string
File.SHA1	The SHA1 hash of the file.	string
File	The file object.	unknown
File.SHA256	The SHA256 hash of the file.	string
DBotScore	The DBotScore object.	unknown
DBotScore.Indicator	The indicator that was tested.	string
DBotScore.Type	The indicator type.	string
DBotScore.Vendor	The vendor used to calculate the score.	string
DBotScore.Score	The actual score.	number

Playbook Image

Detonate_File_ThreatStream

Inputs

File — File object of the file to detonate.
VM — The VM to use (string)
SubmissionClassification — Classification of the Sandbox submission.
PremiumSandbox — Specifies if the premium sandbox should be used for detonation.
Tags — A CSV list of tags applied to this sample.
Interval — Polling frequency - how often the polling command should run (minutes).
Timeout — Amount of time to wait before a timeout occurs (minutes).

Outputs

File.Malicious — The file malicious description.
File.Malicious.Vendor — For malicious files, the vendor that made the decision.
File.Type — File type, for example: "PE".
File.Size — File size.
File.MD5 — MD5 hash of the file.
File.Name — File name.
File.SHA1 — SHA1 hash of the file.
File — The file object.
File.SHA256 — SHA256 hash of the file.
DBotScore — The DBotScore object.
DBotScore.Indicator — The indicator that was tested.
DBotScore.Type — The indicator type.
DBotScore.Vendor — Vendor used to calculate the score.
DBotScore.Score — The actual score.

Commands used

threatstream-analysis-report threatstream-submit-to-sandbox

Flowchart

Source

playbook-Detonate_File_-_ThreatStream.yml

Download History Raw

id: Detonate File - ThreatStream
version: -1
name: Detonate File - ThreatStream
fromversion: 5.0.0
description: Detonate one or more files using the Anomali ThreatStream v2 integration. This playbook returns relevant reports to the War Room, and file reputations to the context data.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 56650d59-750f-49e8-8323-9a38636631f6
    type: start
    task:
      id: 56650d59-750f-49e8-8323-9a38636631f6
      version: -1
      name: ""
      description: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "5":
    id: "5"
    taskid: e58d872c-656f-4687-8279-50ff40cb4009
    type: condition
    task:
      id: e58d872c-656f-4687-8279-50ff40cb4009
      version: -1
      name: Is Anomali ThreatStream v2 enabled?
      description: Checks if there is a valid instance of the Anomali ThreatStream v2 integration enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "16"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Anomali ThreatStream v2
                    ignorecase: true
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                    ignorecase: true
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "6":
    id: "6"
    taskid: 1d556414-5fc2-441e-856c-27d1d0b0c207
    type: title
    task:
      id: 1d556414-5fc2-441e-856c-27d1d0b0c207
      version: -1
      name: Done
      description: ""
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "8":
    id: "8"
    taskid: 124792e1-e06a-4d0c-8dd4-2fd5fc125aee
    type: regular
    task:
      id: 124792e1-e06a-4d0c-8dd4-2fd5fc125aee
      version: -1
      name: ThreatStream Get Report
      description: Returns a report of the file or URL that was submitted to the sandbox.
      script: '|||threatstream-analysis-report'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      report_id:
        simple: ${ThreatStream.Analysis.ReportID}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 387.5,
          "y": 1245
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "11":
    id: "11"
    taskid: 832bc14a-ab8f-4bd3-8acf-78789433ee61
    type: regular
    task:
      id: 832bc14a-ab8f-4bd3-8acf-78789433ee61
      version: -1
      name: Set file to context
      description: Set the file object into context.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "19"
    scriptarguments:
      append: {}
      key:
        simple: File
      value:
        complex:
          root: inputs.File
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 275,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "15":
    id: "15"
    taskid: 9f3fb5f2-6b4e-4694-8db1-df2211b2b0fd
    type: playbook
    task:
      id: 9f3fb5f2-6b4e-4694-8db1-df2211b2b0fd
      version: -1
      name: GenericPolling
      description: |-
        Use as a sub-playbook to block execution of the master playbook until a remote action is complete.
        This playbook implements polling by continually running the command in Step /#2 until the operation completes.
        The remote action should have the following structure:

        1. Initiate the operation.
        2. Poll to check if the operation completed.
        3. (optional) Get the results of the operation.
      playbookName: GenericPolling
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      AdditionalPollingCommandArgNames: {}
      AdditionalPollingCommandArgValues: {}
      Ids:
        complex:
          root: ThreatStream
          accessor: Analysis.ReportID
      Interval:
        complex:
          root: inputs.Interval
      PollingCommandArgName:
        simple: report_id
      PollingCommandName:
        simple: threatstream-get-analysis-status
      Timeout:
        complex:
          root: inputs.Timeout
      dt:
        simple: ThreatStream.Analysis(val.Status=='processing').ReportID
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
    view: |-
      {
        "position": {
          "x": 387.5,
          "y": 1070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "16":
    id: "16"
    taskid: abdd7f0e-18af-4a32-8bd2-be620253a970
    type: condition
    task:
      id: abdd7f0e-18af-4a32-8bd2-be620253a970
      version: -1
      name: Is there a file to detonate?
      description: Checks if there is a file to detonate. If no file is found, detonation is skipped.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "11"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: inputs.File
            iscontext: true
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "19":
    id: "19"
    taskid: 75b5f3a3-d25a-45d4-8477-76e6473d06fd
    type: condition
    task:
      id: 75b5f3a3-d25a-45d4-8477-76e6473d06fd
      version: -1
      name: Is the file size bigger than 0?
      description: Checks if the fail size is larger than 0.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "20"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: greaterThan
          left:
            value:
              simple: File.Size
            iscontext: true
          right:
            value:
              simple: "0"
    view: |-
      {
        "position": {
          "x": 275,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "20":
    id: "20"
    taskid: 78cece2d-336e-41e1-89c8-a70deb8350ff
    type: regular
    task:
      id: 78cece2d-336e-41e1-89c8-a70deb8350ff
      version: -1
      name: ThreatStream Upload File
      description: Submits a file or URL to the ThreatStream-hosted Sandbox for detonation.
      script: '|||threatstream-submit-to-sandbox'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "15"
    scriptarguments:
      detail:
        simple: ${inputs.Tags}
      premium_sandbox:
        simple: ${inputs.PremiumSandbox}
      report_platform:
        simple: ${inputs.VM}
      submission_classification:
        simple: ${inputs.SubmissionClassification}
      submission_type:
        simple: file
      submission_value:
        simple: ${inputs.File.EntryID}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 387.5,
          "y": 895
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
view: |-
  {
    "linkLabelsPosition": {
      "5_6_#default#": 0.44
    },
    "paper": {
      "dimensions": {
        "height": 1435,
        "width": 717.5,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: File
  value:
    complex:
      root: File
  required: false
  description: File object of the file to detonate.
- key: VM
  value: {}
  required: false
  description: The VM to use (string)
- key: SubmissionClassification
  value: {}
  required: false
  description: Classification of the Sandbox submission.
- key: PremiumSandbox
  value: {}
  required: false
  description: Specifies if the premium sandbox should be used for detonation.
- key: Tags
  value: {}
  required: false
  description: A CSV list of tags applied to this sample.
- key: Interval
  value: {}
  required: false
  description: Polling frequency - how often the polling command should run (minutes).
- key: Timeout
  value: {}
  required: false
  description: Amount of time to wait before a timeout occurs (minutes).
outputs:
- contextPath: File.Malicious
  description: The file malicious description.
  type: unknown
- contextPath: File.Malicious.Vendor
  description: For malicious files, the vendor that made the decision.
  type: string
- contextPath: File.Type
  description: 'File type, for example: "PE".'
  type: string
- contextPath: File.Size
  description: File size.
  type: number
- contextPath: File.MD5
  description: MD5 hash of the file.
  type: string
- contextPath: File.Name
  description: File name.
  type: string
- contextPath: File.SHA1
  description: SHA1 hash of the file.
  type: string
- contextPath: File
  description: The file object.
  type: unknown
- contextPath: File.SHA256
  description: SHA256 hash of the file.
  type: string
- contextPath: DBotScore
  description: The DBotScore object.
  type: unknown
- contextPath: DBotScore.Indicator
  description: The indicator that was tested.
  type: string
- contextPath: DBotScore.Type
  description: The indicator type.
  type: string
- contextPath: DBotScore.Vendor
  description: Vendor used to calculate the score.
  type: string
- contextPath: DBotScore.Score
  description: The actual score.
  type: number
tests:
- No test