Detonate Remote File from URL - McAfee ATD

Detonates a File from a URL using the McAfee Advanced Threat Defense sandbox integration.

McAfee Advanced Threat Defense · 10 tasks · 3 inputs · 31 outputs

Details

IDDetonate Remote File from URL - McAfee ATD
From Version5.0.0
Tasks10

README

Detonates a File from a URL using the McAfee Advanced Threat Defense sandbox integration.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • GenericPolling

Integrations

  • McAfee_Advanced_Threat_Defense

Scripts

  • Set

Commands

  • atd-get-report
  • atd-file-upload
  • atd-check-status

Playbook Inputs

Name Description Default Value Required
URL URL to detonate. URL.Data Optional
Interval Polling frequency - how often the polling command should run (minutes) 1 Optional
Timeout How much time to wait before a timeout occurs (minutes) 15 Optional

Playbook Outputs

Path Description Type
ATD.Task.taskId The task ID of the sample uploaded string
ATD.Task.jobId The job ID of the sample uploaded string
ATD.Task.messageId The message Id relevant to the sample uploaded string
ATD.Task.url The URL detonated string
ATD.Task.srcIp Source IPv4 address string
ATD.Task.destIp Destination IPv4 address string
ATD.Task.MD5 MD5 of the sample uploaded string
ATD.Task.SHA1 SHA1 of the sample uploaded string
ATD.Task.SHA256 SHA256 of the sample uploaded string
File.Name Filename (only in case of report type=json) string
File.Type File type e.g. “PE” (only in case of report type=json) string
File.MD5 MD5 hash of the file (only in case of report type=json) string
File.SHA1 SHA1 hash of the file (only in case of report type=json) string
File.SHA256 SHA256 hash of the file (only in case of report type=json) string
File.EntryID The Entry ID of the sample string
DBotScore.Indicator The indicator we tested (only in case of report type=json) string
DBotScore.Type The type of the indicator (only in case of report type=json) string
DBotScore.Vendor Vendor used to calculate the score (only in case of report type=json) string
DBotScore.Score The actual score (only in case of report type=json) number
IP.Address IP’s relevant to the sample string
InfoFile.EntryID The EntryID of the report file string
InfoFile.Extension The extension of the report file string
InfoFile.Name The name of the report file string
InfoFile.Info The info of the report file string
InfoFile.Size The size of the report file number
InfoFile.Type The type of the report file string
File File object unknown
File.Malicious File Malicious object unknown
DBotScore DBotScore object unknown
InfoFile Report file object unknown
URL.Malicious URL Malicious object unknown

Inputs

  • URL — URL to detonate.
  • Interval — Polling frequency - how often the polling command should run (minutes)
  • Timeout — How much time to wait before a timeout occurs (minutes)

Outputs

  • ATD.Task.taskId — The task ID of the sample uploaded
  • ATD.Task.jobId — The job ID of the sample uploaded
  • ATD.Task.messageId — The message Id relevant to the sample uploaded
  • ATD.Task.url — The URL detonated
  • ATD.Task.srcIp — Source IPv4 address
  • ATD.Task.destIp — Destination IPv4 address
  • ATD.Task.MD5 — MD5 of the sample uploaded
  • ATD.Task.SHA1 — SHA1 of the sample uploaded
  • ATD.Task.SHA256 — SHA256 of the sample uploaded
  • File.Name — Filename (only in case of report type=json)
  • File.Type — File type e.g. "PE" (only in case of report type=json)
  • File.MD5 — MD5 hash of the file (only in case of report type=json)
  • File.SHA1 — SHA1 hash of the file (only in case of report type=json)
  • File.SHA256 — SHA256 hash of the file (only in case of report type=json)
  • File.EntryID — The Entry ID of the sample
  • DBotScore.Indicator — The indicator we tested (only in case of report type=json)
  • DBotScore.Type — The type of the indicator (only in case of report type=json)
  • DBotScore.Vendor — Vendor used to calculate the score (only in case of report type=json)
  • DBotScore.Score — The actual score (only in case of report type=json)
  • IP.Address — IP's relevant to the sample
  • InfoFile.EntryID — The EntryID of the report file
  • InfoFile.Extension — The extension of the report file
  • InfoFile.Name — The name of the report file
  • InfoFile.Info — The info of the report file
  • InfoFile.Size — The size of the report file
  • InfoFile.Type — The type of the report file
  • File — File object
  • File.Malicious — File Malicious object
  • DBotScore — DBotScore object
  • InfoFile — Report file object
  • URL.Malicious — URL Malicious object

Commands used

atd-check-status atd-file-upload atd-get-report

Flowchart

yes yes yes Start Start McAfee ATD Upload a File from a URL - atd-file-upload McAfee ATD Upload a File ... atd-file-upload GenericPolling - GenericPolling GenericPolling GenericPolling McAfee ATD Get Report - atd-get-report McAfee ATD Get Report atd-get-report Is there a URL to detonate? Is there a URL to detonate? Done Done Filter taskId Filter taskId Is McAfee ATD sandbox enabled? Is McAfee ATD sandbox ena... atd-check-status - atd-check-status atd-check-status atd-check-status Set Context - Set Set Context Set

Source

playbook-Detonate_Remote_File_from_URL_-_McAfee_ATD.yml
Download History Raw 
id: Detonate Remote File from URL - McAfee ATD
version: -1
fromversion: 5.0.0
name: Detonate Remote File from URL - McAfee ATD
description: Detonates a File from a URL using the McAfee Advanced Threat Defense sandbox integration.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: f2c37122-75bb-4405-80c6-34e8e972d224
    type: start
    task:
      id: f2c37122-75bb-4405-80c6-34e8e972d224
      version: -1
      name: ""
      description: start
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "1":
    id: "1"
    taskid: 6c62dcdb-e814-4ecb-8449-e6d02cfad409
    type: regular
    task:
      id: 6c62dcdb-e814-4ecb-8449-e6d02cfad409
      version: -1
      name: McAfee ATD Upload a File from a URL
      description: Uploads the submission to McAfee ATD.
      script: '|||atd-file-upload'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      analyzeAgain: {}
      dstIp: {}
      entryID: {}
      fileName: {}
      filePriorityQ: {}
      messageId: {}
      skipTaskId: {}
      srcIp: {}
      submitType:
        simple: "3"
      url:
        complex:
          root: inputs.URL
      vmProfileList: {}
      xMode: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 275,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "2":
    id: "2"
    taskid: 2af60cef-ae8f-45d0-88b6-ce81c990523c
    type: playbook
    task:
      id: 2af60cef-ae8f-45d0-88b6-ce81c990523c
      version: -1
      name: GenericPolling
      description: |-
        Use this playbook as a sub-playbook to block execution of the master playbook until a remote action is complete.
        This playbook implements polling by continuously running the command in Step \#2 until the operation completes.
        The remote action should have the following structure:

        1. Initiate the operation.
        2. Poll to check if the operation completed.
        3. (optional) Get the results of the operation.
      playbookName: GenericPolling
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "10"
    scriptarguments:
      Ids:
        complex:
          root: ATD
          filters:
          - - operator: isNotEqualNumber
              left:
                value:
                  simple: ATD.Task.taskId
                iscontext: true
              right:
                value:
                  simple: "-1"
          accessor: Task
          transformers:
          - operator: getField
            args:
              field:
                value:
                  simple: taskId
      Interval:
        complex:
          root: inputs.Interval
      PollingCommandArgName:
        simple: taskId
      PollingCommandName:
        simple: atd-check-status
      Timeout:
        complex:
          root: inputs.Timeout
      dt:
        simple: ATD.Task(val.status != 'Completed').taskId
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 895
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "3":
    id: "3"
    taskid: 61a895d1-e4d7-4c3a-8adc-83f6ee88f040
    type: regular
    task:
      id: 61a895d1-e4d7-4c3a-8adc-83f6ee88f040
      version: -1
      name: McAfee ATD Get Report
      description: Retrieve the reports from McAfee ATD.
      script: '|||atd-get-report'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      jobId: {}
      taskId:
        complex:
          root: ATDTask
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: ATDTask.status
                iscontext: true
              right:
                value:
                  simple: Completed
          transformers:
          - operator: getField
            args:
              field:
                value:
                  simple: taskId
      threshold: {}
      type:
        simple: pdf
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 1420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "5":
    id: "5"
    taskid: 06c9ca27-cfbc-41ab-805d-2091a2b9e210
    type: condition
    task:
      id: 06c9ca27-cfbc-41ab-805d-2091a2b9e210
      version: -1
      name: Is there a URL to detonate?
      description: Checks that there is a URL in the playbook’s input.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "1"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: inputs.URL
            iscontext: true
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "6":
    id: "6"
    taskid: b09656f6-45b8-4a84-872b-4f5b6c727291
    type: title
    task:
      id: b09656f6-45b8-4a84-872b-4f5b6c727291
      version: -1
      name: Done
      description: Done
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1595
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "8":
    id: "8"
    taskid: 4527bfbf-19ea-4c54-87e2-ccee19d7703d
    type: condition
    task:
      id: 4527bfbf-19ea-4c54-87e2-ccee19d7703d
      version: -1
      name: Filter taskId
      description: Checks that valid URLs only have been sent to detonation.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "2"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: ATD
                filters:
                - - operator: isNotEqualNumber
                    left:
                      value:
                        simple: ATD.Task.taskId
                      iscontext: true
                    right:
                      value:
                        simple: "-1"
                accessor: Task
                transformers:
                - operator: getField
                  args:
                    field:
                      value:
                        simple: taskId
            iscontext: true
    view: |-
      {
        "position": {
          "x": 275,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "9":
    id: "9"
    taskid: 0e48dfeb-7b4f-4c39-8a77-610c2cbb8345
    type: condition
    task:
      id: 0e48dfeb-7b4f-4c39-8a77-610c2cbb8345
      version: -1
      name: Is McAfee ATD sandbox enabled?
      description: |
        Verify that there is a valid instance of McAfee ATD enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "5"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: McAfee Advanced Threat Defense
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "10":
    id: "10"
    taskid: aafb15d2-bf2e-481a-8b3b-9e90f2c92d97
    type: regular
    task:
      id: aafb15d2-bf2e-481a-8b3b-9e90f2c92d97
      version: -1
      name: atd-check-status
      description: Updates the status of the tasks in the context.
      script: '|||atd-check-status'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "11"
    scriptarguments:
      jobId: {}
      taskId:
        complex:
          root: ATD
          filters:
          - - operator: isNotEqualNumber
              left:
                value:
                  simple: ATD.Task.taskId
                iscontext: true
              right:
                value:
                  simple: "-1"
          accessor: Task.taskId
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 1070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "11":
    id: "11"
    taskid: a28f0313-4932-4d47-8dbf-bcbf98c11fdc
    type: regular
    task:
      id: a28f0313-4932-4d47-8dbf-bcbf98c11fdc
      version: -1
      name: Set Context
      description: '-'
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      append: {}
      key:
        simple: ATDTask
      value:
        complex:
          root: ATD
          filters:
          - - operator: isNotEqualNumber
              left:
                value:
                  simple: ATD.Task.taskId
                iscontext: true
              right:
                value:
                  simple: "-1"
          accessor: Task
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 1245
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {
      "8_2_yes": 0.57
    },
    "paper": {
      "dimensions": {
        "height": 1610,
        "width": 605,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: URL
  value:
    complex:
      root: URL
      accessor: Data
  required: false
  description: URL to detonate.
  playbookInputQuery: null
- key: Interval
  value:
    simple: "1"
  required: false
  description: Polling frequency - how often the polling command should run (minutes)
  playbookInputQuery: null
- key: Timeout
  value:
    simple: "15"
  required: false
  description: How much time to wait before a timeout occurs (minutes)
  playbookInputQuery: null
outputs:
- contextPath: ATD.Task.taskId
  description: The task ID of the sample uploaded
  type: string
- contextPath: ATD.Task.jobId
  description: The job ID of the sample uploaded
  type: string
- contextPath: ATD.Task.messageId
  description: The message Id relevant to the sample uploaded
  type: string
- contextPath: ATD.Task.url
  description: The URL detonated
  type: string
- contextPath: ATD.Task.srcIp
  description: Source IPv4 address
  type: string
- contextPath: ATD.Task.destIp
  description: Destination IPv4 address
  type: string
- contextPath: ATD.Task.MD5
  description: MD5 of the sample uploaded
  type: string
- contextPath: ATD.Task.SHA1
  description: SHA1 of the sample uploaded
  type: string
- contextPath: ATD.Task.SHA256
  description: SHA256 of the sample uploaded
  type: string
- contextPath: File.Name
  description: Filename (only in case of report type=json)
  type: string
- contextPath: File.Type
  description: File type e.g. "PE" (only in case of report type=json)
  type: string
- contextPath: File.MD5
  description: MD5 hash of the file (only in case of report type=json)
  type: string
- contextPath: File.SHA1
  description: SHA1 hash of the file (only in case of report type=json)
  type: string
- contextPath: File.SHA256
  description: SHA256 hash of the file (only in case of report type=json)
  type: string
- contextPath: File.EntryID
  description: The Entry ID of the sample
  type: string
- contextPath: DBotScore.Indicator
  description: The indicator we tested (only in case of report type=json)
  type: string
- contextPath: DBotScore.Type
  description: The type of the indicator (only in case of report type=json)
  type: string
- contextPath: DBotScore.Vendor
  description: Vendor used to calculate the score (only in case of report type=json)
  type: string
- contextPath: DBotScore.Score
  description: The actual score (only in case of report type=json)
  type: number
- contextPath: IP.Address
  description: IP's relevant to the sample
  type: string
- contextPath: InfoFile.EntryID
  description: The EntryID of the report file
  type: string
- contextPath: InfoFile.Extension
  description: The extension of the report file
  type: string
- contextPath: InfoFile.Name
  description: The name of the report file
  type: string
- contextPath: InfoFile.Info
  description: The info of the report file
  type: string
- contextPath: InfoFile.Size
  description: The size of the report file
  type: number
- contextPath: InfoFile.Type
  description: The type of the report file
  type: string
- contextPath: File
  description: File object
  type: unknown
- contextPath: File.Malicious
  description: File Malicious object
  type: unknown
- contextPath: DBotScore
  description: DBotScore object
  type: unknown
- contextPath: InfoFile
  description: Report file object
  type: unknown
- contextPath: URL.Malicious
  description: URL Malicious object
  type: unknown
tests:
- Test Playbook McAfee ATD
- Detonate URL - Generic Test