Detonate URL - Group-IB TDS Polygon

Detonate URL using Group-IB THF Polygon integration.

Polygon · 10 tasks · 3 inputs · 46 outputs

Details

IDDetonate URL - Group-IB TDS Polygon
From Version5.0.0
Tasks10

README

Detonates one or more files using the Polygon integration. This playbook
returns relevant reports to the War Room and file reputations to the context data.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • GenericPolling

Integrations

This playbook does not use any integrations.

Scripts

  • Set

Commands

  • polygon-upload-url
  • polygon-analysis-info
  • polygon-export-report
  • polygon-export-pcap
  • polygon-export-video

Playbook Inputs

Name Description Default Value Source Required
url The url object to detonate. The URL is taken from the context. None URL.Data Optional
Interval The duration for executing the pooling (in minutes). 1 - Optional
Timeout The duration after which to stop pooling and to resume the playbook (in minutes). 60 - Optional

Playbook Outputs

Path Description Type
File.Name string The full file name (including file extension).
File.MD5 string The MD5 hash of the file
File.SHA1 string The SHA1 hash of the file
File.SHA256 string The SHA256 hash of the file
File.Type string File type
File.Malicious.Vendor string The vendor that reported the file as malicious
File.Malicious.Description string A description explaining why the file was determined to be malicious
DBotScore.Indicator string The indicator that was tested
DBotScore.Type string The indicator type
DBotScore.Vendor string The vendor used to calculate the score
DBotScore.Score number The actual score
IP.Address String IP address
Domain.Name String The Domain name
Domain.DNS String A list of IP objects resolved by DNS.
URL.Data String The URL
URL.Malicious.Vendor string The vendor that reported the url as malicious
URL.Malicious.Description string A description explaining why the url was determined to be malicious
RegistryKey.Path String The path to the registry key
RegistryKey.Value String The value at the given RegistryKey.
Process.Name String Process name
Process.PID String Process PID
Process.CommandLine String Process Command Line
Process.Path String Process path
Process.StartTime date Process start time
Process.EndTime date Process end time
Polygon.Analysis.ID string THF File ID
Polygon.Analysis.Name string File Name
Polygon.Analysis.Size number File Size
Polygon.Analysis.Started date Analysis start timestamp
Polygon.Analysis.Analyzed date Analysis finish timestamp
Polygon.Analysis.MD5 string Analyzed file MD5 hash
Polygon.Analysis.SHA1 string Analyzed file SHA1 hash
Polygon.Analysis.SHA256 string Analyzed file SHA256
Polygon.Analysis.Result boolean Analysis verdict
Polygon.Analysis.Status string Analysis status
Polygon.Analysis.Verdict string Analysis verdict
Polygon.Analysis.Probability string Verdict probability
Polygon.Analysis.Families string Malware families
Polygon.Analysis.Score number Polygon score
Polygon.Analysis.Internet-connection string Internet availability
Polygon.Analysis.Type string File type
Polygon.Analysis.DumpExists boolean Network activity dump exists
Polygon.Analysis.File unknown The information about files in analysis
Polygon.Analysis.URL unknown The information about URL indicators
Polygon.Analysis.IP unknown The information about IP indicators
Polygon.Analysis.Domain unknown The information about Domain indicators
Polygon.Analysis.RegistryKey unknown The information about registry keys which were modified during the analysis
Polygon.Analysis.Process unknown The information about processes started during the analysis

Playbook Image

Polygon Detonate URL

Inputs

  • Interval — Report requests frequency (minutes)
  • Timeout — Report waiting timeout (minutes)
  • url — URL to detonate

Outputs

  • File.Name — The full file name (including file extension).
  • File.MD5 — The MD5 hash of the file
  • File.SHA1 — The SHA1 hash of the file
  • File.SHA256 — The SHA256 hash of the file
  • File.Type — File type
  • File.Malicious.Vendor — The vendor that reported the file as malicious
  • File.Malicious.Description — A description explaining why the file was determined to be malicious
  • DBotScore.Indicator — The indicator that was tested
  • DBotScore.Type — The indicator type
  • DBotScore.Vendor — The vendor used to calculate the score
  • DBotScore.Score — The actual score
  • IP.Address — IP address
  • Domain.Name — The Domain name
  • Domain.DNS — A list of IP objects resolved by DNS.
  • URL.Data — The URL
  • RegistryKey.Path — The path to the registry key
  • RegistryKey.Value — The value at the given RegistryKey.
  • Process.Name — Process name
  • Process.PID — Process PID
  • Process.CommandLine — Process Command Line
  • Process.Path — Process path
  • Process.StartTime — Process start time
  • Process.EndTime — Process end time
  • Polygon.Analysis.ID — Analysis ID in THF
  • Polygon.Analysis.Name — File Name
  • Polygon.Analysis.Size — File Size
  • Polygon.Analysis.Started — Analysis start timestamp
  • Polygon.Analysis.Analyzed — Analysis finish timestamp
  • Polygon.Analysis.MD5 — Analyzed file MD5 hash
  • Polygon.Analysis.SHA1 — Analyzed file SHA1 hash
  • Polygon.Analysis.SHA256 — Analyzed file SHA256
  • Polygon.Analysis.Result — Analysis verdict
  • Polygon.Analysis.Status — The analysis status
  • Polygon.Analysis.Verdict — Analysis verdict
  • Polygon.Analysis.Probability — Verdict probability
  • Polygon.Analysis.Families — Malware families
  • Polygon.Analysis.Score — Polygon score
  • Polygon.Analysis.Internet-connection — Internet availability
  • Polygon.Analysis.Type — File type
  • Polygon.Analysis.DumpExists — Network activity dump exists
  • Polygon.Analysis.File — The information about files in analysis
  • Polygon.Analysis.URL — The information about URL indicators
  • Polygon.Analysis.IP — The information about IP indicators
  • Polygon.Analysis.Domain — The information about Domain indicators
  • Polygon.Analysis.RegistryKey — The information about registry keys which were modified during the analysis
  • Polygon.Analysis.Process — The information about processes started during the analysis

Commands used

polygon-analysis-info polygon-export-pcap polygon-export-report polygon-export-video polygon-upload-url

Flowchart

yes yes Start Start Done Done GenericPolling - GenericPolling GenericPolling GenericPolling polygon-export-report - polygon-export-report polygon-export-report polygon-export-report polygon-analysis-info - polygon-analysis-info polygon-analysis-info polygon-analysis-info polygon-export-pcap - polygon-export-pcap polygon-export-pcap polygon-export-pcap polygon-export-video - polygon-export-video polygon-export-video polygon-export-video polygon-upload-url - polygon-upload-url polygon-upload-url polygon-upload-url Is THF Polygon integration enabled? - Exists Is THF Polygon integratio... Exists Is URL malicious? - IsTrue Is URL malicious? IsTrue

Source

playbook-Detonate_URL_-_Group-IB_TDS_Polygon.yml
Download History Raw 
id: Detonate URL - Group-IB TDS Polygon
version: -1
name: Detonate URL - Group-IB TDS Polygon
description: Detonate URL using Group-IB THF Polygon integration.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 9501b3b5-5523-40bd-8af6-ae6a9d6ac607
    type: start
    task:
      id: 9501b3b5-5523-40bd-8af6-ae6a9d6ac607
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "19"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 540,
          "y": -10
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "4":
    id: "4"
    taskid: 3515a2f8-6b03-4061-8125-756cc50294fd
    type: title
    task:
      id: 3515a2f8-6b03-4061-8125-756cc50294fd
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 540,
          "y": 1630
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "11":
    id: "11"
    taskid: 70256af8-c846-4973-86a8-9c3361ee58b3
    type: playbook
    task:
      id: 70256af8-c846-4973-86a8-9c3361ee58b3
      version: -1
      name: GenericPolling
      description: |-
        Use this playbook as a sub-playbook to block execution of the master playbook until a remote action is complete.
        This playbook implements polling by continuously running the command in Step \#2 until the operation completes.
        The remote action should have the following structure:

        1. Initiate the operation.
        2. Poll to check if the operation completed.
        3. (optional) Get the results of the operation.
      playbookName: GenericPolling
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "14"
    scriptarguments:
      AdditionalPollingCommandArgNames: {}
      AdditionalPollingCommandArgValues: {}
      Ids:
        complex:
          root: Polygon
          accessor: Analysis.ID
          transformers:
          - operator: LastArrayElement
      Interval:
        simple: ${inputs.Interval}
      PollingCommandArgName:
        simple: tds_analysis_id
      PollingCommandName:
        simple: polygon-analysis-info
      Timeout:
        simple: ${inputs.Timeout}
      dt:
        simple: Polygon.Analysis(val.Status !== 'Finished').ID
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
    view: |-
      {
        "position": {
          "x": 840,
          "y": 530
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "12":
    id: "12"
    taskid: 6948ec34-2400-4760-8be6-a298743c12d2
    type: regular
    task:
      id: 6948ec34-2400-4760-8be6-a298743c12d2
      version: -1
      name: polygon-export-report
      description: Export an archive with THF Polygon report to War Room
      script: Group-IB TDS Polygon|||polygon-export-report
      type: regular
      iscommand: true
      brand: Group-IB TDS Polygon
    nexttasks:
      '#none#':
      - "20"
    scriptarguments:
      tds_analysis_id:
        complex:
          root: Polygon
          accessor: Analysis.ID
          transformers:
          - operator: LastArrayElement
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 840,
          "y": 870
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "14":
    id: "14"
    taskid: 4a79b7e8-4212-4b47-8078-bfb2dde6e1b4
    type: regular
    task:
      id: 4a79b7e8-4212-4b47-8078-bfb2dde6e1b4
      version: -1
      name: polygon-analysis-info
      description: Get THF Polygon analysis information
      script: Group-IB TDS Polygon|||polygon-analysis-info
      type: regular
      iscommand: true
      brand: Group-IB TDS Polygon
    nexttasks:
      '#none#':
      - "12"
    scriptarguments:
      tds_analysis_id:
        complex:
          root: Polygon
          accessor: Analysis.ID
          transformers:
          - operator: LastArrayElement
      tds_file_id:
        complex:
          root: Polygon
          accessor: Analysis.ID
          transformers:
          - operator: LastArrayElement
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 840,
          "y": 700
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "16":
    id: "16"
    taskid: 987e1a83-e302-4ddc-8aba-e27e41baebe3
    type: regular
    task:
      id: 987e1a83-e302-4ddc-8aba-e27e41baebe3
      version: -1
      name: polygon-export-pcap
      description: Network activity dump export
      script: Group-IB TDS Polygon|||polygon-export-pcap
      type: regular
      iscommand: true
      brand: Group-IB TDS Polygon
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      tds_analysis_id:
        complex:
          root: Polygon
          accessor: Analysis.ID
          transformers:
          - operator: LastArrayElement
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 840,
          "y": 1440
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "17":
    id: "17"
    taskid: 4df106af-8c5f-4bc6-84e8-7c9617694f27
    type: regular
    task:
      id: 4df106af-8c5f-4bc6-84e8-7c9617694f27
      version: -1
      name: polygon-export-video
      description: Screen activity video export
      script: Group-IB TDS Polygon|||polygon-export-video
      type: regular
      iscommand: true
      brand: Group-IB TDS Polygon
    nexttasks:
      '#none#':
      - "16"
    scriptarguments:
      tds_analysis_id:
        complex:
          root: Polygon
          accessor: Analysis.ID
          transformers:
          - operator: LastArrayElement
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 840,
          "y": 1285
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "18":
    id: "18"
    taskid: 51f1cc88-20ec-4c3f-81f2-2825221bcc6e
    type: regular
    task:
      id: 51f1cc88-20ec-4c3f-81f2-2825221bcc6e
      version: -1
      name: polygon-upload-url
      description: Upload URL for analysis
      script: Group-IB TDS Polygon|||polygon-upload-url
      type: regular
      iscommand: true
      brand: Group-IB TDS Polygon
    nexttasks:
      '#none#':
      - "11"
    scriptarguments:
      url:
        simple: ${inputs.url}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 840,
          "y": 350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "19":
    id: "19"
    taskid: 466aa1ae-b36c-4232-86f0-89cf7d19a2d3
    type: condition
    task:
      id: 466aa1ae-b36c-4232-86f0-89cf7d19a2d3
      version: -1
      name: Is THF Polygon integration enabled?
      description: Check if a given value exists in the context. Will return 'no' for empty empty arrays. To be used mostly with DQ and selectors.
      scriptName: Exists
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "4"
      "yes":
      - "18"
    scriptarguments:
      value:
        complex:
          root: modules
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: modules.brand
                iscontext: true
              right:
                value:
                  simple: Group-IB TDS Polygon
          - - operator: isEqualString
              left:
                value:
                  simple: modules.state
                iscontext: true
              right:
                value:
                  simple: active
          accessor: brand
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 540,
          "y": 140
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "20":
    id: "20"
    taskid: 1bbc3dd0-04f3-43e6-833e-93f803184027
    type: condition
    task:
      id: 1bbc3dd0-04f3-43e6-833e-93f803184027
      version: -1
      name: Is URL malicious?
      description: Check if a given value is true. Will return 'no' otherwise
      scriptName: IsTrue
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "4"
      "yes":
      - "17"
    scriptarguments:
      value:
        complex:
          root: Polygon
          accessor: Analysis.Result
          transformers:
          - operator: LastArrayElement
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 840,
          "y": 1060
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1705,
        "width": 680,
        "x": 540,
        "y": -10
      }
    }
  }
inputs:
- key: Interval
  value:
    simple: "1"
  required: true
  description: Report requests frequency (minutes)
- key: Timeout
  value:
    simple: "60"
  required: true
  description: Report waiting timeout (minutes)
- key: url
  value:
    simple: ${URL.Data}
  required: false
  description: URL to detonate
outputs:
- contextPath: File.Name
  description: The full file name (including file extension).
  type: string
- contextPath: File.MD5
  description: The MD5 hash of the file
  type: string
- contextPath: File.SHA1
  description: The SHA1 hash of the file
  type: string
- contextPath: File.SHA256
  description: The SHA256 hash of the file
  type: string
- contextPath: File.Type
  description: File type
  type: string
- contextPath: File.Malicious.Vendor
  description: The vendor that reported the file as malicious
  type: string
- contextPath: File.Malicious.Description
  description: A description explaining why the file was determined to be malicious
  type: string
- contextPath: DBotScore.Indicator
  description: The indicator that was tested
  type: string
- contextPath: DBotScore.Type
  description: The indicator type
  type: string
- contextPath: DBotScore.Vendor
  description: The vendor used to calculate the score
  type: string
- contextPath: DBotScore.Score
  description: The actual score
  type: number
- contextPath: IP.Address
  description: IP address
  type: string
- contextPath: Domain.Name
  description: The Domain name
  type: string
- contextPath: Domain.DNS
  description: A list of IP objects resolved by DNS.
  type: string
- contextPath: URL.Data
  description: The URL
  type: string
- contextPath: RegistryKey.Path
  description: The path to the registry key
  type: string
- contextPath: RegistryKey.Value
  description: The value at the given RegistryKey.
  type: string
- contextPath: Process.Name
  description: Process name
  type: string
- contextPath: Process.PID
  description: Process PID
  type: number
- contextPath: Process.CommandLine
  description: Process Command Line
  type: string
- contextPath: Process.Path
  description: Process path
  type: string
- contextPath: Process.StartTime
  description: Process start time
  type: date
- contextPath: Process.EndTime
  description: Process end time
  type: date
- contextPath: Polygon.Analysis.ID
  description: Analysis ID in THF
  type: number
- contextPath: Polygon.Analysis.Name
  description: File Name
  type: string
- contextPath: Polygon.Analysis.Size
  description: File Size
  type: number
- contextPath: Polygon.Analysis.Started
  description: Analysis start timestamp
  type: date
- contextPath: Polygon.Analysis.Analyzed
  description: Analysis finish timestamp
  type: date
- contextPath: Polygon.Analysis.MD5
  description: Analyzed file MD5 hash
  type: string
- contextPath: Polygon.Analysis.SHA1
  description: Analyzed file SHA1 hash
  type: string
- contextPath: Polygon.Analysis.SHA256
  description: Analyzed file SHA256
  type: string
- contextPath: Polygon.Analysis.Result
  description: Analysis verdict
  type: string
- contextPath: Polygon.Analysis.Status
  description: The analysis status
  type: string
- contextPath: Polygon.Analysis.Verdict
  description: Analysis verdict
  type: boolean
- contextPath: Polygon.Analysis.Probability
  description: Verdict probability
  type: string
- contextPath: Polygon.Analysis.Families
  description: Malware families
  type: string
- contextPath: Polygon.Analysis.Score
  description: Polygon score
  type: number
- contextPath: Polygon.Analysis.Internet-connection
  description: Internet availability
  type: string
- contextPath: Polygon.Analysis.Type
  description: File type
  type: string
- contextPath: Polygon.Analysis.DumpExists
  description: Network activity dump exists
  type: boolean
- contextPath: Polygon.Analysis.File
  description: The information about files in analysis
  type: unknown
- contextPath: Polygon.Analysis.URL
  description: The information about URL indicators
- contextPath: Polygon.Analysis.IP
  description: The information about IP indicators
- contextPath: Polygon.Analysis.Domain
  description: The information about Domain indicators
- contextPath: Polygon.Analysis.RegistryKey
  description: The information about registry keys which were modified during the analysis
- contextPath: Polygon.Analysis.Process
  description: The information about processes started during the analysis
fromversion: 5.0.0
tests:
- No tests