Detonate URL - FireEye AX

id: Detonate URL - FireEye AX
version: -1
contentitemexportablefields:
  contentitemfields: {}
name: Detonate URL - FireEye AX
description: Detonating URL with FireEye AX.
starttaskid: '0'
tasks:
  '0':
    id: '0'
    taskid: ac486e14-1500-41db-8579-c2acb8b805ef
    type: start
    task:
      id: ac486e14-1500-41db-8579-c2acb8b805ef
      version: -1
      name: ''
      description: starting test
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '1'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 60
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '1':
    id: '1'
    taskid: d19b6d0f-7bce-4fb6-85ad-10899a219703
    type: condition
    task:
      id: d19b6d0f-7bce-4fb6-85ad-10899a219703
      version: -1
      name: Is there an active FireEye AX instance?
      description: Check for an active instance.
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '6'
      yes:
      - '2'
    separatecontext: false
    conditions:
    - label: yes
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: fireeye
                    ignorecase: true
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                    ignorecase: true
                accessor: brand
            iscontext: true
          right:
            value: {}
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '2':
    id: '2'
    taskid: ab3448ba-c6f1-484e-83aa-cb95282953e1
    type: condition
    task:
      id: ab3448ba-c6f1-484e-83aa-cb95282953e1
      version: -1
      name: Is there a URL?
      description: Checks if there is a URL to detonate.
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '6'
      yes:
      - '3'
    separatecontext: false
    conditions:
    - label: yes
      condition:
      - - operator: isExists
          left:
            value:
              simple: inputs.URL
            iscontext: true
          right:
            value: {}
    view: |-
      {
        "position": {
          "x": 300,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '3':
    id: '3'
    taskid: 500ad9f9-523f-443a-8efc-5f7de8e0178f
    type: regular
    task:
      id: 500ad9f9-523f-443a-8efc-5f7de8e0178f
      version: -1
      name: Send URL to FireEye AX sandbox
      description: Submit a URL for analysis by FireEye.
      script: fireeye|||fe-submit-url
      type: regular
      iscommand: true
      brand: fireeye
    nexttasks:
      '#none#':
      - '8'
    scriptarguments:
      analysistype:
        simple: '2'
      application:
        simple: '2'
      force:
        simple: 'true'
      prefetch:
        simple: '1'
      priority:
        simple: '0'
      profiles:
        simple: win7-sp1
      timeout:
        complex:
          root: inputs.timeout
      urls:
        complex:
          root: inputs.URL
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 455,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '4':
    id: '4'
    taskid: d77e95a7-5c88-441a-8a56-c86b589f368d
    type: playbook
    task:
      id: d77e95a7-5c88-441a-8a56-c86b589f368d
      version: -1
      name: GenericPolling
      description: |-
        Use this playbook as a sub-playbook to block execution of the master playbook until a remote action is complete.
        This playbook implements polling by continuously running the command in Step \#2 until the operation completes.
        The remote action should have the following structure:

        1. Initiate the operation.
        2. Poll to check if the operation completed.
        3. (optional) Get the results of the operation.
      playbookName: GenericPolling
      type: playbook
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '7'
    scriptarguments:
      Ids:
        complex:
          root: FireEyeAX.Submissions.URL
          accessor: Key
      Interval:
        complex:
          root: inputs.interval
      PollingCommandArgName:
        simple: submission_Key
      PollingCommandName:
        simple: fe-submit-url-status
      Timeout:
        complex:
          root: inputs.timeout
      dt:
        simple: FireEyeAX.Submissions.URL(val.Status == 'In Progress').Key
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ''
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 455,
          "y": 1040
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '6':
    id: '6'
    taskid: 40e39159-5c17-4857-8220-89cfecc8bb32
    type: title
    task:
      id: 40e39159-5c17-4857-8220-89cfecc8bb32
      version: -1
      name: Done
      description: '-'
      type: title
      iscommand: false
      brand: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1380
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '7':
    id: '7'
    taskid: eb1d3ebb-47be-497e-8f40-2a725ee12697
    type: regular
    task:
      id: eb1d3ebb-47be-497e-8f40-2a725ee12697
      version: -1
      name: Get task report
      description: Results of the URL submission
      script: fireeye|||fe-submit-url-result
      type: regular
      iscommand: true
      brand: fireeye
    nexttasks:
      '#none#':
      - '6'
    scriptarguments:
      info_level:
        complex:
          root: inputs.Info_Level
      submissionID:
        complex:
          root: FireEyeAX.Submissions.URL
          accessor: ID
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 455,
          "y": 1205
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '8':
    id: '8'
    taskid: 4cb63add-21f4-4d58-8cdd-124544b56ce7
    type: regular
    task:
      id: 4cb63add-21f4-4d58-8cdd-124544b56ce7
      version: -1
      name: Sleep (let the sandbox create the task)
      description: sleep
      scriptName: Sleep
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '9'
    scriptarguments:
      seconds:
        simple: '5'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 455,
          "y": 710
        }
      }
    note: false
    timertriggers: []
    ignoreworker: true
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '9':
    id: '9'
    taskid: f9135ff3-abfa-4a84-8ed5-ffb206a143dd
    type: regular
    task:
      id: f9135ff3-abfa-4a84-8ed5-ffb206a143dd
      version: -1
      name: View task
      description: Get a status for a url submitted to FireEye analysis
      script: '|||fe-submit-url-status'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - '4'
    scriptarguments:
      submission_Key:
        complex:
          root: FireEyeAX.Submissions.URL
          accessor: Key
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 455,
          "y": 875
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
view: |-
  {
    "linkLabelsPosition": {
      "1_6_#default#": 0.18,
      "2_6_#default#": 0.14
    },
    "paper": {
      "dimensions": {
        "height": 1385,
        "width": 785,
        "x": 50,
        "y": 60
      }
    }
  }
inputs:
- key: URL
  value:
    complex:
      root: URL
      accessor: Data
  required: false
  description: URL to detonate
  playbookInputQuery:
- key: interval
  value:
    simple: '1'
  required: false
  description: How often to poll for results.
  playbookInputQuery:
- key: timeout
  value:
    simple: '30'
  required: false
  description: How long to wait before giving up waiting for results.
  playbookInputQuery:
- key: Info_Level
  value: {}
  required: false
  description: This parameter specifies the level of information to be returned in the URL submission report. Information levels include concise (default), normal, or extended.
  playbookInputQuery:
outputs:
- contextPath: FireEyeAX.Submissions.URL.Key
  description: The submission key.
- contextPath: FireEyeAX.Submissions.Severity
  description: The severity level of the file.
- contextPath: FireEyeAX.Submissions.InfoLevel
  description: The info level of the report.
- contextPath: DBotScore.Score
  description: The actual score.
  type: unknown
- contextPath: DBotScore.Indicator
  description: The indicator that was tested.
  type: unknown
- contextPath: DBotScore.Vendor
  description: Vendor used to calculate the score.
  type: unknown
tests:
- No tests (auto formatted)
fromversion: 6.2.0