Detonate URL - FireEye AX

Detonating URL with FireEye AX.

FireEye (AX Series) · 9 tasks · 4 inputs · 6 outputs

Details

IDDetonate URL - FireEye AX
From Version6.2.0
Tasks9

README

Detonating URL with FireEye AX.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • GenericPolling

Integrations

  • fireeye
  • Fireeye

Scripts

  • Sleep

Commands

  • fe-submit-url-result
  • fe-submit-url
  • fe-submit-url-status

Playbook Inputs

Name Description Default Value Required
URL URL to detonate URL.Data Optional
interval How often to poll for results. 1 Optional
timeout How long to wait before giving up waiting for results. 30 Optional
Info_Level This parameter specifies the level of information to be returned in the URL submission report. Information levels include concise (default), normal, or extended.   Optional

Playbook Outputs

Path Description Type
FireEyeAX.Submissions.URL.Key The submission key. unknown
FireEyeAX.Submissions.Severity The severity level of the file. unknown
FireEyeAX.Submissions.InfoLevel The info level of the report. unknown
DBotScore.Score The actual score. unknown
DBotScore.Indicator The indicator that was tested. unknown
DBotScore.Vendor Vendor used to calculate the score. unknown

Playbook Image

Detonate URL - FireEye AX

Inputs

  • URL — URL to detonate
  • interval — How often to poll for results.
  • timeout — How long to wait before giving up waiting for results.
  • Info_Level — This parameter specifies the level of information to be returned in the URL submission report. Information levels include concise (default), normal, or extended.

Outputs

  • FireEyeAX.Submissions.URL.Key — The submission key.
  • FireEyeAX.Submissions.Severity — The severity level of the file.
  • FireEyeAX.Submissions.InfoLevel — The info level of the report.
  • DBotScore.Score — The actual score.
  • DBotScore.Indicator — The indicator that was tested.
  • DBotScore.Vendor — Vendor used to calculate the score.

Commands used

fe-submit-url fe-submit-url-result fe-submit-url-status

Flowchart

true true Start Start Is there an active FireEye AX instance? Is there an active FireEy... Is there a URL? Is there a URL? Send URL to FireEye AX sandbox - fe-submit-url Send URL to FireEye AX sa... fe-submit-url GenericPolling - GenericPolling GenericPolling GenericPolling Done Done Get task report - fe-submit-url-result Get task report fe-submit-url-result Sleep (let the sandbox create the task) - Sleep Sleep (let the sandbox cr... Sleep View task - fe-submit-url-status View task fe-submit-url-status

Source

playbook-Detonate_URL_-_FireEye_AX.yml
Download History Raw 
id: Detonate URL - FireEye AX
version: -1
contentitemexportablefields:
  contentitemfields: {}
name: Detonate URL - FireEye AX
description: Detonating URL with FireEye AX.
starttaskid: '0'
tasks:
  '0':
    id: '0'
    taskid: ac486e14-1500-41db-8579-c2acb8b805ef
    type: start
    task:
      id: ac486e14-1500-41db-8579-c2acb8b805ef
      version: -1
      name: ''
      description: starting test
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '1'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 60
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '1':
    id: '1'
    taskid: d19b6d0f-7bce-4fb6-85ad-10899a219703
    type: condition
    task:
      id: d19b6d0f-7bce-4fb6-85ad-10899a219703
      version: -1
      name: Is there an active FireEye AX instance?
      description: Check for an active instance.
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '6'
      yes:
      - '2'
    separatecontext: false
    conditions:
    - label: yes
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: fireeye
                    ignorecase: true
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                    ignorecase: true
                accessor: brand
            iscontext: true
          right:
            value: {}
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '2':
    id: '2'
    taskid: ab3448ba-c6f1-484e-83aa-cb95282953e1
    type: condition
    task:
      id: ab3448ba-c6f1-484e-83aa-cb95282953e1
      version: -1
      name: Is there a URL?
      description: Checks if there is a URL to detonate.
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '6'
      yes:
      - '3'
    separatecontext: false
    conditions:
    - label: yes
      condition:
      - - operator: isExists
          left:
            value:
              simple: inputs.URL
            iscontext: true
          right:
            value: {}
    view: |-
      {
        "position": {
          "x": 300,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '3':
    id: '3'
    taskid: 500ad9f9-523f-443a-8efc-5f7de8e0178f
    type: regular
    task:
      id: 500ad9f9-523f-443a-8efc-5f7de8e0178f
      version: -1
      name: Send URL to FireEye AX sandbox
      description: Submit a URL for analysis by FireEye.
      script: fireeye|||fe-submit-url
      type: regular
      iscommand: true
      brand: fireeye
    nexttasks:
      '#none#':
      - '8'
    scriptarguments:
      analysistype:
        simple: '2'
      application:
        simple: '2'
      force:
        simple: 'true'
      prefetch:
        simple: '1'
      priority:
        simple: '0'
      profiles:
        simple: win7-sp1
      timeout:
        complex:
          root: inputs.timeout
      urls:
        complex:
          root: inputs.URL
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 455,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '4':
    id: '4'
    taskid: d77e95a7-5c88-441a-8a56-c86b589f368d
    type: playbook
    task:
      id: d77e95a7-5c88-441a-8a56-c86b589f368d
      version: -1
      name: GenericPolling
      description: |-
        Use this playbook as a sub-playbook to block execution of the master playbook until a remote action is complete.
        This playbook implements polling by continuously running the command in Step \#2 until the operation completes.
        The remote action should have the following structure:

        1. Initiate the operation.
        2. Poll to check if the operation completed.
        3. (optional) Get the results of the operation.
      playbookName: GenericPolling
      type: playbook
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '7'
    scriptarguments:
      Ids:
        complex:
          root: FireEyeAX.Submissions.URL
          accessor: Key
      Interval:
        complex:
          root: inputs.interval
      PollingCommandArgName:
        simple: submission_Key
      PollingCommandName:
        simple: fe-submit-url-status
      Timeout:
        complex:
          root: inputs.timeout
      dt:
        simple: FireEyeAX.Submissions.URL(val.Status == 'In Progress').Key
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ''
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 455,
          "y": 1040
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '6':
    id: '6'
    taskid: 40e39159-5c17-4857-8220-89cfecc8bb32
    type: title
    task:
      id: 40e39159-5c17-4857-8220-89cfecc8bb32
      version: -1
      name: Done
      description: '-'
      type: title
      iscommand: false
      brand: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1380
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '7':
    id: '7'
    taskid: eb1d3ebb-47be-497e-8f40-2a725ee12697
    type: regular
    task:
      id: eb1d3ebb-47be-497e-8f40-2a725ee12697
      version: -1
      name: Get task report
      description: Results of the URL submission
      script: fireeye|||fe-submit-url-result
      type: regular
      iscommand: true
      brand: fireeye
    nexttasks:
      '#none#':
      - '6'
    scriptarguments:
      info_level:
        complex:
          root: inputs.Info_Level
      submissionID:
        complex:
          root: FireEyeAX.Submissions.URL
          accessor: ID
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 455,
          "y": 1205
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '8':
    id: '8'
    taskid: 4cb63add-21f4-4d58-8cdd-124544b56ce7
    type: regular
    task:
      id: 4cb63add-21f4-4d58-8cdd-124544b56ce7
      version: -1
      name: Sleep (let the sandbox create the task)
      description: sleep
      scriptName: Sleep
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '9'
    scriptarguments:
      seconds:
        simple: '5'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 455,
          "y": 710
        }
      }
    note: false
    timertriggers: []
    ignoreworker: true
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '9':
    id: '9'
    taskid: f9135ff3-abfa-4a84-8ed5-ffb206a143dd
    type: regular
    task:
      id: f9135ff3-abfa-4a84-8ed5-ffb206a143dd
      version: -1
      name: View task
      description: Get a status for a url submitted to FireEye analysis
      script: '|||fe-submit-url-status'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - '4'
    scriptarguments:
      submission_Key:
        complex:
          root: FireEyeAX.Submissions.URL
          accessor: Key
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 455,
          "y": 875
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
view: |-
  {
    "linkLabelsPosition": {
      "1_6_#default#": 0.18,
      "2_6_#default#": 0.14
    },
    "paper": {
      "dimensions": {
        "height": 1385,
        "width": 785,
        "x": 50,
        "y": 60
      }
    }
  }
inputs:
- key: URL
  value:
    complex:
      root: URL
      accessor: Data
  required: false
  description: URL to detonate
  playbookInputQuery:
- key: interval
  value:
    simple: '1'
  required: false
  description: How often to poll for results.
  playbookInputQuery:
- key: timeout
  value:
    simple: '30'
  required: false
  description: How long to wait before giving up waiting for results.
  playbookInputQuery:
- key: Info_Level
  value: {}
  required: false
  description: This parameter specifies the level of information to be returned in the URL submission report. Information levels include concise (default), normal, or extended.
  playbookInputQuery:
outputs:
- contextPath: FireEyeAX.Submissions.URL.Key
  description: The submission key.
- contextPath: FireEyeAX.Submissions.Severity
  description: The severity level of the file.
- contextPath: FireEyeAX.Submissions.InfoLevel
  description: The info level of the report.
- contextPath: DBotScore.Score
  description: The actual score.
  type: unknown
- contextPath: DBotScore.Indicator
  description: The indicator that was tested.
  type: unknown
- contextPath: DBotScore.Vendor
  description: Vendor used to calculate the score.
  type: unknown
tests:
- No tests (auto formatted)
fromversion: 6.2.0